Session Hijacking

Session hijacking, also well-known as TCP session hijacking, is a technique of taking over a Web user session by secretly obtaining the session ID and masquerading as the legal user. Once the user's session ID has been retrieved (through session calculation), the attacker can masquerade as that user and do whatever the user is authorized to do on the network.

SPOOFING VERSUS HIJACKING spoofing and hijacking are measured to be same thing. Actually they are completely different from each other.

Spoofing: A hacker will imitate himself to gain access. Unlike hijacking, it actually creates a new session using target pinched credentials rather than using present session.

Hijacking: Unlike spoofing, it takes over current active session. It will depend on some legitimate user to establish a linking and even authentication.

Techniques of session Hijacking:

It may include any of the following techniques:

• Stealing: It refers to all those methods accepted in order to steal session IDs.  
• Brute Force: It is totally hit and trial. An attacker will try various IDs until get success. 
• Calculation: An attacker will try to compute the session Ids with use of non-randomly twisted IDs.

Application level session hijacking

Session Hijacking in OSI model can be attained at both application as well as network level. Here, in this article, application level session hijacking is explained in much detail.

1. Sniffing: An attacker to sniff a valid session IDs on the network can make use of a sniffer like a popular one is Wireshark. It keeps its eye on network traffic and from this usefulness we can use valid token session to get authorized access in an unauthorized way.
2. Session Token Prediction: It is commonly used to forecast a session ID or for impersonation task. It helps an attacker to use compromised user privileges to ping the websites with them.
3. MITM attack:  The MITM attack is a Man in the Middle attack. It is used to interrupt into an existing connection between machines to know traded messages between them.

Process:
i. First divide the TCP connection into two: Client to Attacker, An Attacker to Server.
ii. On being completely interrupted, an attacker can read, inject and even modify data into this connection

4. MIB attack: The MIB attack is a Man in the Browser attack. It makes use of the Trojan horse to interrupt the calls between the browser and its security model. It is mainly used for triggering financial deceptions by adjusting transactions of Net Banking mechanism.

Process:
 i. The Trojan horse first tries to infect computer application or its OS.
ii. Malevolent code installation and saved to configuration of the browser.
iii. When user restarts the infested browser, Trojan is being loaded and a handler is listed for every visit.
iv. While web page is loaded, extensions make use of URL and equate it with list of targeted sites.
 v. User then log in.
vi. When a specific page load is noticed, button event handler is enumerated and then compared to targeted list. vii. Finally, browser directs the form and manipulated values to the server.

5. Client Side Attacks: They are kind of an attack, in which the malevolent scripts are then injected into websites. This destructive code can be embedded in a web page and even does not alert any kind of notice.

EFFECTIVE COUNTERMEASURES:

•  Use SSL to have protected communication channel. 
•  There must be logout utility for session termination. 
•  Trust HTTPS connection for transient authentication cookies. 
•  Always allow encrypted data between user and webservers. 
•  Accept a secure protocol. 
•  Regeneration of Session ID after user log in. 
•  Lessen having remote access. 
•  Importance on Encryption. 
•  Decrease incoming connections. 
•  Decrease the life span of session or cookie.
•  Create session keys with lengthy strings or random numbers. 
•  Try stopping Eavesdropping. 
•  Expire the session when user logs out. 
•  Do not access links received via mails. 
•  Use firewall and browser settings to limit cookies. 
•  Make sure website which we are retrieving is certified by certified authority.  Clear history, offline contents and cookies from browser after each secret or sensitive transaction.

Handling Security Issues in SDLC

ASP.NET software companies in India must take special care while developing internal web applications that are accessed from outside with the help of world wide web. Moreover the increase in personally-owned mobile devices (e.g., watch gear, smartphones, tablets, and laptops) as well as the vast variety of vulnerable mobile apps results into a higher risk of revealing highly confidential and business-related information in the workplace. This is possible when such information is stored on personally-owned devices. Cyber-attacks often exploit such vulnerabilities inherent in applications and operating systems. Hence The software code must be developed following a secure coding guidelines and frequent updates and patches to software are necessary.

Security is unquestionably mandatory and no-one can overlook that. It may take longer and including security into SDLC may result into a more complicated practice.  Nevertheless, the alternatives are not that satisfactory as there are always hackers only too eager to disrupt into systems.

The consequences of not including security within the SDLC process can be catastrophic and could cause distressing concerns for companies' status and earnings. By safeguarding SDLC, unnecessary& un-planned costs can be evaded and security matters can be tackled as there is no need to wait for threats to emerge and then having to spend money in fitting current or probable matters that could have been dodged.

Software companies in India use secure-SDLC thatfocuses on enforcing security into the Software Development Life Cycle. Every phase of SDLC will emphasize the enforcement of security – over and above the present set of events. Incorporating S-SDLC into an organization’s structure has many benefits that guarantees a secure product.

The focus of asp .net software companies in India, with respect to security domain,ison phases of SDLC such as design, implementation, delivery, operation, maintenance, and retirement. Information security and privacy experts must be involved in all phases of SDLC so that the overall effectiveness of security controls with respect to privacy concerns are taken care of. 

The subsequent list recognizes key security guidelines at each stage in the development life cycle for asp .net software companies in India:

• System feasibility: Pinpoint security requirements, including governing requirements, in-house policies and standards that must be looked at. 
• Software plans and requirements: Recognize the vulnerabilities, threats, and risks to software. Outline the desired level of protection. Conduct a cost-benefit analysis. 
• Product design: Proposefor the security criteria in product design (e.g., access controls or encryption). 
• Detailed design: Determine business requirements and legal obligations within the design of security controls in a product or system. 
• Coding: Develop the security-related software code, comments and citations. 
• Integration product: Investigate security measures and make alterations. 
• Implementation: Implement any additional safetydealings prior to go-live. 
• Operations and maintenance: Observe the software and system for variations in security controls. Assess current controls against newly-discovered threats and vulnerabilities. Implement proper updates and patches, when essential. Certify the complete effectiveness of application and system security.
• Product retirement: Safeguard information that was used and warehoused (i.e., archived), relocated to another database or system, or sterilized (i.e., erased) from the system.

Thus asp .net software companies in India can identify, reduce, mitigate and eliminate various security threats and adverse impacts that could be present in each stage of SDLC. It ultimately results into reduction in overall cost, efforts and time of delivering the final product or service in IT industry.