Hey let’s talk about cookies. No, not the delicious ones that girl scouts are out selling
right now, although those are so good. I’m talking about digital cookies. These are great
for convenience but in the past year, we’ve seen a big uptick in attacks using these bits
of information to bypass 2FA.
Cookies are these little files that are stored by the browser and can be used for authentication,
and that’s a common way for websites to handle your login. Normally, you, a user,
has to type in your username and password, then the website sees that info and creates
a session cookie to maintain your login state while you browse around that website or keep
your browser open. The website returns an authentication token and session cookie. That
way, you don’t have to keep logging into the website every single time you click on
a new page. That would be annoying, hence we have cookies. Cookies can store a bunch
of information, and session cookies specifically store that info as long as the login session
requires. Tracking or third party cookies are also used, and these collect data based
on your browsing habits. There’s also a cookie that is stored locally on your computer,
but we’re going to focus on sessions today.
So how are these cookies hijacked, or stolen, by an attacker?
Usually it happens with malware or open wifi. Back in August, we saw a lot of news about
these kind of attacks happening because of a rise in companies getting breached due to
their employees login session cookies being stolen. We’ve also seen this happen to reputable
Youtubers. And in many of these cases, having 2FA turned on didn’t fix the problem, because
these cookies could let an attacker bypass that six digit code.
In one example, Sophos, a big cybersecurity company, wrote that malware was being used
to send copies of session cookies to attackers. As long as that session hasn’t expired,
the attacker could have access to the account just like the user would, from their own computer.
This malware could be spread through phishing attacks, downloads in emails, pirated free
download software that’s actually malware, and cookies could even be sold on criminal
forums. You’d think that session cookies wouldn’t last that long, but how often do
you have to log into Twitter on your computer? Or how long does it take for your email to
log you out and force you to reauthenticate? Session cookies can last months, weeks, days…
banks are pretty good about forcing you to log out after not being active for a series
of minutes, but most websites don’t do that because they want to make their website as
convenient as possible for you to use.
Cookies and session hijacking are just a few of the many ways our data can find it's way
onto the web without our consent. But it's only one part of the privacy puzzle. If you
aren't taking a larger encompassing approach to data security, then a malicious actor can
still find information about you in other ways. I'm happy to partner with DeleteMe on
this video to share their service, which I've paid for as a customer for years.
DeleteMe automatically opts you out of data broker sites, which makes it harder for people
to find things like your email address, telephone number, home address and more. And they do
it on a recurring basis since a lot of these data brokers will republish your data over
and over again. DeleteMe helps create a more holistic approach to data security and
saves hours of time over sending opt outs yourself every month.
I have an exclusive coupon code now, just for my viewers! Use the code SNUBS at checkout
- that’s S N U B S - for 20% off any of the consumer plans. That’s SNUBS for 20%
off and see how DeleteMe can help you take your online privacy to the next level. Click
the link below or hit up [JoinDeleteMe.com/MorseCode](http://joindeleteme.com/MorseCode) to sign up today!
Huge thank you to DeleteMe for sponsoring this episode.
Websites can do better. Even though session cookies do eventually expire, there are other
precautions websites can take. They can check the IP address to ensure its the same as when
you first logged in. The cookie session can expire sooner, but of course, some companies
wouldn’t do this because it would make their websites less convenient. And websites should
be coded so cookies are transmitted over SSL, not plain text, and they should be encrypted.
But since we users have no control over how websites run their businesses, we can also
do things to protect ourselves when it comes to cookies. First, don’t use open or public
wifi. Attackers can absolutely use open wifi to see who else is connected, and try to steal
your session cookies while they’re being transmitted
to websites. Choosing to stick with your mobile carrier data and not logging into sensitive
websites while you’re out and about can definitely help. And if you absolutely must
get on public Wifi (I fully understand there are times when you have no choice - like if
you need to check into a flight and the local data is nonexistent), use a VPN and make sure
you’re browsing securely, and log out of all your sessions when you’re done. I even
posted a VPN comparison video a couple of months back on this channel.
Even on your own private network or work network, you can take precautions. Ensure websites
you’re visiting use HTTPS instead of HTTP - in chrome, you can click on the little lock
icon next to a website address to see if the connection is secure, if they’re collecting
any cookies, and you can even get real deep and remove or block cookies on a website by
website basis, at least in Chrome you can do this.
If you don’t have time to get super nerdy with the details on every single website that
you visit, you can have your cookies be cleared every time you close your browser. To do this
in Chrome, you’d click on the 3 little dots, go to Settings, Privacy and Security, then
click Cookies and other site data. In here you can choose “Clear cookies and site data
when you close all windows” and toggle that switch to On. Of course, this means you’d
have to re-log into websites every time you start a new browser session, but if you use
a Password Manager, that can speed up the process because Password Managers can auto-fill
your username and password.
You can also subscribe to this channel for more security tips. If you’re finding this
video helpful, a subscribe would me a lot to me. Subscribing is a simple way of showing
me which videos you find helpful and valuable, and it tells me which direction I should take
my channel in. Shoutout to Craig on BuyMeACoffee and Sigmund, Peter, and Chibbsx on Patreon
for the support!
Using a holistic approach to security - such as only downloading apps or programs from
reputable companies or websites or app stores, and never trusting links in emails, can better
protect you from accidentally downloading malware, which could include cookie theft
or credential stealers. Using Anti Virus like Windows Defender and malware detection tools
like MalwareBytes (there’s a free version!) can help as well.
I constantly say you should be using good online security hygiene and if you do this,
it becomes a natural part of your daily life and you don’t even really need to think
about it.
If you want more security tips here’s a video about my favorite password managers
for the year, and here’s a video that Youtube thinks you’ll enjoy.