Welcome Anonymous!  [ logout ]
HOME FORUMS DOWNLOADS LINKS ACCOUNT

 
Forum Index   |  Search   |  Usergroups   |  Edit your profile   |  Members   |  Login, Check Messages
Ranks   |  Staff   |  Statistics   |  Board Rules   |  Forum FAQ   |  Log in

Search for at
http://www.snipergamerselite.com Advanced Search


 
Recent Topics   Next 6 >>  
 Forum   Author   Replies   Last Post 
The new C.O.C Suggestions (Members Only) slackersuaris 33 Mon Sep 19, 2011 9:54 pm
JAMMER1 View latest post
Website renew time! General (Members Only) slackersuaris 1 Tue Aug 23, 2011 10:19 pm
ghostshadow View latest post
The Sn][per Group server Donations General WarhammerTX 3 Mon Nov 25, 2013 11:07 pm
York View latest post
Hey all General Cobrason 0 Tue Feb 21, 2017 3:53 pm
Cobrason View latest post
World of tanks General slackersuaris 3 Fri Dec 23, 2016 6:25 am
slackersuaris View latest post
Hello my good people from an Sn][per from a past life General hawcer 0 Fri Dec 16, 2016 6:49 pm
hawcer View latest post

Invalad session and your corrupt cookies

 
Post new topic   Reply to topic   printer-friendly view   Thank Post    http://www.snipergamerselite.com Forum Index -> Site how to's
View previous topic :: View next topic  
Author Message
Webmaster
Site Owner
Site Owner
Lead Mod
Lead Mod




Joined: Jan 17, 2010
Posts: 47

Reputation: 14.5
blank.png


Status: Offline
PostPosted: Fri Apr 09, 2010 11:39 am Post subject: No icon Invalad session and your corrupt cookies Reply with quote

I'm going to explain the situation once more and then never again ...

phpBB uses sessions to "track" users as they move between pages, forums, topics, etc. A session is made up of a unique 32 character session_id which identifies the current users. This value is stored in the sessions table and either a temporary (i.e. it's deleted when the browser window is closed) cookie on the users machine or if that doesn't seem to be working it's appended to all URLs.

The problem with using just a session_id is that it becomes very easy to hijack (takeover) a session. All a user need do is obtain the session_id and add it to the url as they browse the board. If the id they grab happens to be a logged in admin or moderator ... well you get the picture.

What we do to help complicate the situation is also tie the session to the users IP. Using this method someone would need to spoof an IP and obtain the session_id in order to hijack a session, not incredibly difficult but certainly harder ... and with this sort of software it's really a case of making everything harder to do, thus disuading all but the most ardent "hackers" from bothering to attempt anything.

How do we obtain this IP? We check the availability of two variables, REMOTE_ADDR and HTTP_X_FORWARDED_FOR. Firstly we check for HTTP_X_ ..., this is typically set by "nice" proxies, caches, etc. and contains "an" IP which may be the users "real" IP or some other IP. If that does not exist or it contains a private or restricted IP range (several blocks of IPs are reserved by the international bodies responsible for IP allocation) we instead use the value contained in REMOTE_ADDR. This variable typically contains the users real IP.

However, problems arise with how some ISPs operate their systems. Instead of forwarding the users real IP or indeed a different but static IP they simply make available only the IP of the proxy being browsed. The larger ISPs do not use a single proxy or cache, the load upon it and data passing through it would be far too great. Instead they use several systems in a "proxy farm" (I tend to refer to it as something containing most of those letters ... Very Happy). A user browsing the web may be switched between these machines from one page to another (to help distribute load), with the IP changing as they go.

Obviously a problem then exists in that phpBB's ability to tie a users session to a unique id and an IP fails ... because the IP is constantly changing. There are some "nice" ISPs out there that run these farms within a single "class" or block of IPs, e.g. 1.2.3.4, 1.2.3.5, 1.2.3.6, etc.

This is why in a previous release of phpBB we introduced a slightly reduced IP checking system which now checks only the first three "quads" of an IP, i.e. 1.2.3.4 is checked only for 1.2.3 the 4 is discarded. Remember, that an IPv4 address is 32bits wide, this is generally presented in the form of four 8 bit numbers. By checking just the first three numbers (24bits) we neglect 8 bits or 255 (253 in practice) possible IPs ... that's 253 seperate potential proxies ... IOW enough machines for practically any ISP on the planet. However we can go further and reduce that checking to just the first "two quads", that ignores 255 * 253 IPs!

The problem is some ISPs don't arrange their IP allocation particularly well, either for historical or other reasons ... AOL is one significant culprit. So what happens is that users can jump between completely different Class A (this is a full 32bit block of IPs) networks, e.g. 100.100.100.100 to 200.100.40.40, etc. This renders IP validation completely useless for such situations :(

So you ask, "Okay, but why did 2.0.3 not cause all these Invalid_session errors?!". The answer is fairly simple. When you first visit phpBB (assuming you have autologin enabled) it looks to see if you have a session_id (either in a cookie or the URL). On a new visit you won't have such a session_id and so phpBB creates a new one. If you have autologin set it checks the relevant data and if that matches you are logged in with the appropriate user_id. You can then immediately browse the board, post messages, do admin tasks (if applicable), etc.

Now let's take a situation where a naughty person creates a bogus form on their site. You are (for some reason) browsing this form. However, unknown to you this form contains all the necessary data to delete a pile of topics in a given forum (you having moderator rights on a certain board). When you submit that form it will be transmitted to the appropriate website. No session exists so phpBB, as noted above creates a new one and immediately processes the form data ... all the relevant topics are deleted from the database and you only find out when the boards "The selected topics have been deleted" message appears ...

To help negate the effectiveness of this we backported some code from phpBB 2.2 and introduced additional code. The admin control panel now appends your session_id to every url. When you browse within that panel it checks the session_id in the url with that stored in the sessions table. If they match, great, if they don't it redirects you back to the ACP index. This will help prevent users accidently, without their knowledge suffering issues as noted above.

Similarly the Moderator control panel has the session_id appended to urls and carries out a check. The difference here is that it throws up an Invalid session if the ids do not match, note that redirection like the admin panel wouldn't alter the result here ... if you tried submitting data via the MCP with an invalid session you'd just be returned to MCP front page ... losing any data entered previously. Other issues with voting and posting were also addressed thanks to a concerned user notifying us. Thus similar checks were put in place there.

The problem is that for users whose session is forever being renewed due to their IP changing this extra level of checking can cause issues. For many ISPs the noted changing of 6 to 4 in the IP validation check will be sufficient ... however AOL crops up (as per usual in nearly all similar situations with all software ...) as the sore thumb.

"What can you do about it?" you may ask, very little is the response. We could remove the extra validation but that leaves a gap that frankly I'm not prepared to leave ... if hadn't addressed this I would make a handsome bet that at some near future point we would've had users shouting and screaming about how damage was done to their boards and why didn't we (phpBB) fix it if we knew about it :D

What else can we do? As I said, very little that won't impact users completely unaffected by this issue (of which I'm betting there are a great many) ... in phpBB 2.2 we are introducing a feature to set the level of IP validation by the ACP, including disabling it completely. However disabling IP validation will, as noted leave your users open to simplified hijacking. For many people this may not be a problem and thus could be a solution. To do this in phpBB 2.0 you need to either remove the validation code from sessions.php or change the 6 to a 0 (the relevant lines are as noted in this topic). Be aware of what you are doing though and keep quiet about it ... if people don't know IP validation isn't operational they may believe it still is. If you have security issues you can trace to users sessions being hijacked we don't want to know about it ;)

We could introduce a change to sessions whereby what happens when a new session is created is "weakened". What do I mean by weakened? Well, at present we generate a new session whenever we cannot validate an existing one. Instead what we could do is compare the users current session_id (if they have one) with that in the database. If a match is found and the time differential is some "small" number we instead continue that session. The problem here is that it's just as open to hijacking as removing IP validation. Why? Because that check will ignore the users IP and care only about the session_id ... and thus isn't something I'm keen on without direct admin control.

We could, as per a new Mod listed elsewhere on the board, ignore IP validation whenever the users IP is within a given list. While this isn't as bad as removing validation completely it's not terribly far off. Why? Because instead of having to go to some trouble to obtain a users current IP you can instead (given you know a user connects via a given ISP or proxy) just look it up ... you still need to spoof it but a step has been removed ... and as noted previously all we can do is make these peoples lives harder. There are additional issues with the extra processing required (which may or may not be significant depending on the number of IPs, users browsing, etc.) and of keeping the list up to date.

We could append a random set of alphanumerics to every single page, changing the value of it with every page view and storing the new data in the sessions table. This would add protection because a hijacker would need not only the session_id but also the current unique identifier. Of all the ideas this is probably my favourite and may make it into a future release (unless I've missed something obvious which renders it useless or bad for performance!).

"Okay, fine but what can we do about it now?!" I hear you say. Well, you can remove or reduce validation as noted above (being aware of what you are doing), you could add the Mod noted above (you'll find it presently in another Invalid session topic ... no doubt it will be moved to one of the Mod forums in time) or finally you could remove the piece of code (from all affected pages) that looks like or similar to this:

Code: Select all
   // session id check
   if ($sid == '' || $sid != $userdata['session_id'])
   {
      message_die(GENERAL_ERROR, 'Invalid_session');
   }


This removes the added security of validation so if you do this we aren't interested in any security related problems that may arise. I highly recommend that you do not remove the added security from the admin control panel.

There, that just about covers it I think ...
Back to top
View user's profile Send private message Visit poster's website
theone



Gender: Gender:Male
Joined: Apr 28, 2010
Age: 28
Posts: 20
Location: Hobart, Indiana
Reputation: 9.4
usa.png


Status: Offline
PostPosted: Wed Apr 28, 2010 12:36 pm Post subject: No icon Re: Invalad session and your corrupt cookies Reply with quote

I'm gonna corrupt your cookies.
Back to top
View user's profile Send private message Visit poster's website AIM Address MSN Messenger Visit member's Facebook: http://www.facebook.com/CardinalBiggles MySpace Profile: www.myspace.com/geturfingeroutofthere
Webmaster
Site Owner
Site Owner
Lead Mod
Lead Mod




Joined: Jan 17, 2010
Posts: 47

Reputation: 14.5
blank.png


Status: Offline
PostPosted: Wed Apr 28, 2010 3:17 pm Post subject: No icon Re: Invalad session and your corrupt cookies Reply with quote

????????????????????????????????????????????????????????????????????????????????""????pebcak??????????????????
 
Okyakusama no akaunto no komori o suru tsumori wa nai desu! Mondai wa anata ga y?suru sa re masu anata jishin no mono de wa naku, saito no er? ga hassei shi masu watashi-tachi wa, mohaya sakujo akaunto o"" er? o pebcak tame shisa shite iru. Jibun de nani ka o manabu.


Noi non intendiamo fare da babysitter tuo account! I problemi si verificano a voi stessi e non a causa di errori del sito. Ho suggerito di non cancellare gli account a causa di pebcak "errori. imparare a fare qualcosa da soli.
Back to top
View user's profile Send private message Visit poster's website
Sponsor
theone



Gender: Gender:Male
Joined: Apr 28, 2010
Age: 28
Posts: 20
Location: Hobart, Indiana
Reputation: 9.4
usa.png


Status: Offline
PostPosted: Wed Apr 28, 2010 7:43 pm Post subject: No icon Re: Invalad session and your corrupt cookies Reply with quote

I agree.


Back to top
View user's profile Send private message Visit poster's website AIM Address MSN Messenger Visit member's Facebook: http://www.facebook.com/CardinalBiggles MySpace Profile: www.myspace.com/geturfingeroutofthere
MasterVyper
Sysops
Sysops
{Sn][per} Member
{Sn][per} Member




Joined: Apr 28, 2010
Posts: 97

Reputation: 72.8
blank.png


Status: Offline
PostPosted: Fri Apr 30, 2010 12:19 pm Post subject: No icon Re: Invalad session and your corrupt cookies Reply with quote

all cookies need to be eaten
Back to top
View user's profile Send private message
theone



Gender: Gender:Male
Joined: Apr 28, 2010
Age: 28
Posts: 20
Location: Hobart, Indiana
Reputation: 9.4
usa.png


Status: Offline
PostPosted: Fri Apr 30, 2010 9:14 pm Post subject: No icon Re: Invalad session and your corrupt cookies Reply with quote

mmmmm


Back to top
View user's profile Send private message Visit poster's website AIM Address MSN Messenger Visit member's Facebook: http://www.facebook.com/CardinalBiggles MySpace Profile: www.myspace.com/geturfingeroutofthere
Sponsor
Webmaster
Site Owner
Site Owner
Lead Mod
Lead Mod




Joined: Jan 17, 2010
Posts: 47

Reputation: 14.5
blank.png


Status: Offline
PostPosted: Fri Sep 10, 2010 1:08 am Post subject: No icon Re: Invalad session and your corrupt cookies Reply with quote

bump
Back to top
View user's profile Send private message Visit poster's website
Display posts from previous:
Post new topic  Reply to topic   printer-friendly view   Thank Post http://www.snipergamerselite.com Forum Index ->  Site how to's Time synchronized with your computer time
Page 1 of 1


 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum

Related topics
 Topics   Replies   Author   Views   Last Post 
No new posts HELP SUPPORT THIS SITE!!!! 3 slackersuaris 2334 Sun Dec 05, 2010 6:50 pm
WarhammerTX View latest post
No new posts Announcement: Site Update 0 Devmonta 16 Sun Oct 20, 2013 9:08 pm
Devmonta View latest post
No new posts Interesting bf3 hack post 1 WarhammerTX 36 Mon May 28, 2012 3:32 am
hathcock2005 View latest post
No new posts Slow-N-Steady checking in again 0 Slow 1017 Fri Sep 30, 2011 8:37 pm
Slow View latest post
 




Powered By: phpBB © 2001 - 2006 phpBB Group
Nuke-Evo Conversion By: Evo-Themez | phpBB-Template By: Codezwiz
Forums ©


Spambot Killer
Site Map

[News Feed] [Forums Feed] [Downloads Feed] [Web Links Feed] Powered by HTML Purifier[Validate robots.txt]


PHP-Nuke Copyright © 2006 by Francisco Burzi.
All logos, trademarks and posts in this site are property of their respective owners, all the rest © 2006 by the site owner.
Powered by Nuke Evolution 2.0.7 - Nuke-Evolution Xtreme 2.0 Edition.

This site is cached. Click here to update the cache.
[ Page Generation: 0.26 Seconds | Memory Usage: 12.73 MB | DB Queries: 80 ]

Do Not Click