hello this is Aaron Berman from CA
Technologies and I am here to talk about
another security tool to secure your
applications from attackers the CA se
minors session linker as technology
evolves so do the way hackers used to
break into websites and steal
confidential information in our recent
video we demonstrated how see a site
minder 12/5 to enhance session insurance
with device DNA can stop a session
hijacking attack on a site minor session
with CA se minors session secured we are
well on our way to securing our site
against these sessions dealing and
replay issues but there are still other
session hijacking attacks you must
secure against once attackers determined
they cannot successfully steal and then
replay the site minder session they will
look at the next obvious target session
cookies that are part of the application
itself in most cases when applications
integrate with site minder they read the
secure HTTP headers provided by the
sidewinder agent or secure proxy server
and then create an application specific
session token this can take the form of
an ASP or dotnet session a jet Java J
session and a off token LTP a token or
others in most cases this application
specific session token is still
vulnerable to session hijacking here is
a pictorial of such an attack our user
Ben logs into site minder and gets a
site minder session this has been
secured against session replay using
enhanced session assurance with device
DNA then the request is passed on to the
application where the application sees
that Ben does not yet have an
application session but that the
identity is in the HTTP headers so it
creates a session token for further use
our attacker andre who is a bad guy
comes in and logs in the see a site
minder using his own credential and is
granted a site miner session once logged
in to site minder andre steals ben's
application cookie and then replays it
the application sees a valid session so
it reads the identity from the
application cookie which contains Ben's
I
identity and displays Ben's data site
minder has a component called the
session linker that can link an
application session to a specific see a
site matter session in the event that a
different site minder session presents
the same application session token' the
session linker takes action and can be
configured either to log the user out or
delete the session token from the
attacker linking the application session
to the site minder session when you are
using enhanced session assurance with
device DNA can also allow an
administrator not just to apply their
device DNA to the CA segment accession
but also to the application session as
well since they are linked together this
can be done when using site minder
secure proxy server and does not require
any modifications to the application
itself
now let's demo the session link or in
action I will demonstrate a user logging
into site minder and visiting an
application the application will look
for an existing session and if president
will use it otherwise it will create a
new session based on the secure HTTP
headers provided by the site minder
agent in this case for our application
session we are using a plaintext cookie
called user but this also applies to
encrypted tokens as well another user
will then log in a site minder using a
different ID feel the applications
session token and then access the actual
application
when we do this without session linking
we will see that the site miner sees the
real users identity but the application
thinks that the attacker B is the user
being impersonated we will then do the
same thing again this time using the
session Laker we will demonstrate that
this with the session linker on the
application will use the same identity
for the site minder session as the
application no for this demo our
application uses a clear text cookie
this makes it very easy for us to follow
along what is happening but even if the
cookie is encrypted the same result can
occur
from this page I can demonstrate what it
will happen with and without session
linking first we demonstrate this
without session linking been logs into
the application and the application sees
that see a site miner is indicating the
user has been and the application sees
the user has been next andre logs in and
the application sees that site miner is
indicating the user is andre and the
application sees the user is andre now
let's see what Ben's session cookie
looks like
here we see the cooking end-user set to
Ben we will copy that value then we'll
go into Andres browser and set that user
cookie to Ben
now when Andre goes into the application
while CA site - still sees the user is
Andre the application thinks the user is
Ben this is the problem Andre can now
see an access Ben's data now when Andre
tries to access an application that used
this the site mightor session linker we
can observe that the session linker sees
that Ben's applications session cookie
belong to a different site minder
session and it was removed
this allowed the application to read the
secure site matter headers and both the
application and site minder identified
the user as Andre
Andres attack has failed
I hope you have found the security
feature both interesting and useful for
your site minder implementations in fact
CSI minor is the only SSO solution on
the marketplace that is using device DNA
to secure this SSO session token this
secured session token can then be
securely linked to the applications
session token for enhanced security the
session linker provides value when used
by itself but when combined with
enhanced session assurance with device
DNA we feel that this adds another layer
to the defense of your online
applications from attackers just like
one must assume the attackers will
attempt session hijacking on the site
minder session one must assume attackers
will attempt session hijacking on the
applications session that are behind
site minder as well the session liquor
can help prevent this form of attack
from being successful thank you for your
time and for more information please
visit