All news with #session cookie theft tag

🔒 Cybersecurity researchers disclosed a critical session isolation vulnerability in Writer, an enterprise generative AI platform, that allowed cross-tenant account takeover via a one-click exploit named WriteOut. An attacker could create an agent, share its live preview link, and when a logged-in user opened the link their session cookie would be forwarded into the attacker’s sandbox and exfiltrated. Writer has patched the issue by isolating session cookies and preventing them from being forwarded into sandbox previews.

🔒 A 44-year-old man has been sentenced to seven years after pleading guilty to operating “evil twin” Wi‑Fi networks to harvest credentials and intimate images. AFP officers found a Wi‑Fi Pineapple, a laptop and a phone after airline staff reported a suspicious hotspot during a domestic flight. Forensic analysis recovered thousands of images and account credentials, and investigators linked malicious pages to airports and flights. Authorities advised users to disable automatic Wi‑Fi, use a reputable VPN, turn off file sharing and avoid sensitive transactions on public hotspots.

🔒 This article explains how web cookies work, their classifications, and why session IDs are particularly valuable to attackers. It outlines common attack methods — including session sniffing over HTTP, cross‑site scripting (XSS), cross‑site request forgery (CSRF), and predictable session IDs — and describes specialized tracking like supercookies and evercookies. Practical advice for users and developers covers HTTPS, browser updates, cookie management, two‑factor authentication, cautious use of public Wi‑Fi, and preferring essential cookies only.