Open any website, and the first thing you\u2019ll likely see is a pop-up notification about the use of cookies. You\u2019re usually given the option to accept all cookies, accept only necessary ones, or flatly reject them. Regardless of your choice, you probably won\u2019t notice a difference, and the notification disappears from the screen anyway.<\/p>\n
Today, we dive a little deeper into the cookie jar: what cookies are for, what types exist, how attackers can intercept them, what the risks are, and how to stay safe.<\/p>\n
When you visit a website, it sends a cookie to your browser. This is a small text file that contains data about you, your system, and the actions you\u2019ve taken on the site. Your browser stores this data on your device and sends it back to the server every time you return to that site. This simplifies your interaction with the site: you don\u2019t have to log in on every single page; sites remember your display settings; online stores keep items in your cart; streaming services know at which episode you stopped watching \u2014 the benefits are limitless.<\/p>\n
Cookies can store your login, password, security tokens, phone number, residential address, bank details, and session ID. Let\u2019s take a closer look at the session identifier.<\/p>\n
A session ID<\/strong> is a unique code assigned to each user when they sign in to a website. If a third party manages to intercept this code, the web server will see them as a legitimate user. Here\u2019s a simple analogy: imagine you can enter your office by means of an electronic pass with a unique code. If your pass is stolen, the thief \u2014 whether they look like you or not \u2014 can open any door you have access to without any trouble. Meanwhile, the security system will believe that it\u2019s you entering. Sounds like a scene from a crime TV show, doesn\u2019t it? The same thing happens online: if a hacker steals a cookie with your session ID, they can sign in to a website you were already signed in to, under your name, without needing to enter a username and password; sometimes they can even bypass two-factor authentication. In 2023, hackers stole all three of the YouTube channels of the famous tech blogger Linus Sebastian \u2013 \u201cLinus Tech Tips\u201d and two other Linus Media Group YouTube channels with tens of millions of subscribers \u2014 and this is exactly how they did it. We\u2019ve already covered that case in detail<\/a>.<\/p>\n Now let\u2019s sort through the different cookie varieties. All cookies can be classified according to a number of characteristics.<\/p>\n It\u2019s possible for session cookies to become persistent. For example, if you check a box like \u201cRemember me\u201d, \u201cSave settings\u201d, or some such on a website, the data will be saved in a persistent cookie.<\/p>\n The same cookie can fall into multiple categories: for example, most optional cookies are third-party, while required cookies include temporary ones responsible for the security of a specific browsing session. For more details on how and when all these types of cookies are used, read the full report on Securelist<\/a>.<\/p>\n Cookies that contain a session ID are the most tempting targets for hackers. Theft of a session ID is also known as session hijacking<\/a>. Let\u2019s examine some of the most interesting and widespread methods.<\/p>\n Session hijacking is possible by monitoring or \u201csniffing\u201d the internet traffic between the user and the website. This type of attack happens on websites that use the less secure HTTP<\/a> protocol instead of HTTPS. With HTTP, cookie files are transmitted in plain text within the headers of HTTP requests, meaning they\u2019re not encrypted. A malicious actor can easily intercept the traffic between you and the website you\u2019re on, and extract cookies.<\/p>\n These attacks often occur on public Wi-Fi networks, especially if not protected by either the WPA2 or WPA3 protocols. For this reason, we recommend<\/a> exercising extreme caution with public hotspots. It\u2019s much safer to use mobile data. If you\u2019re traveling abroad, it\u2019s a good idea to use an Kaspersky eSIM Store<\/a>.<\/p>\n Cross-site scripting<\/a> consistently ranks among the top web-security vulnerabilities, and with good reason. This type of attack allows malicious actors to gain access to a site\u2019s data \u2014 including the cookie files that contain the coveted session IDs.<\/p>\n Here\u2019s how it works: the attacker finds a vulnerability in the website\u2019s source code and injects a malicious script; that done, all that remains is for you to visit the infected page and you can kiss your cookies goodbye. The script gains full access to your cookies and sends them to the attacker.<\/p>\n Unlike other types of attacks, cross-site request forgery<\/a> exploits the trust relationship between a website and your browser. An attacker tricks an authenticated user\u2019s browser into performing an unintended action without their knowledge, such as changing a password or deleting data like uploaded videos.<\/p>\n For this type of attack, the threat actor creates a web page or email containing a malicious link, HTML code, or a script with a request to the vulnerable website. Simply opening the page or email, or clicking the link, is enough for the browser to automatically send the malicious request to the target site. All of your cookies for that site will be attached to the request. Believing that it was you who requested, say, the password change or channel deletion, the site will carry out the attackers\u2019 request on your behalf.<\/p>\n That\u2019s why we recommend not opening links received from strangers, and installing a Kaspersky Password Manager<\/a>\u00a0that can alert you to malicious links or scripts.<\/p>\n Sometimes, attackers don\u2019t need to use complex schemes \u2014 they can simply guess the session ID. On some websites, session IDs are generated by predictable algorithms, and might contain information like your IP address plus an easily reproducible sequence of characters.<\/p>\n To pull off this kind of attack, hackers need to collect enough sample IDs, analyze them, and then figure out the generating algorithm to predict session IDs on their own.<\/p>\n There are other ways to steal a session ID, such as session fixation<\/strong>, cookie tossing<\/strong>, and man-in-the-middle (MitM)<\/strong><\/a> attacks. These methods are covered in our dedicated Securelist post<\/a>.<\/p>\n A large part of the responsibility for cookie security lies with website developers. We provide tips for them in our full report on Securelist<\/a>.<\/p>\n But there are some things we can all do to stay safe online.<\/p>\n Want to know even more about cookies? Read these articles:<\/p>\n We explain how cyberattackers intercept cookies, the role of the session ID, and how to keep your cookies from going over to the dark side.<\/p>\n","protected":false},"author":2747,"featured_media":54246,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1788,9],"tags":[810,1278,404,43,321,812,399],"class_list":{"0":"post-54243","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-privacy","8":"category-tips","9":"tag-ads","10":"tag-browsers","11":"tag-cookies","12":"tag-privacy","13":"tag-technology","14":"tag-tracking","15":"tag-websites"},"hreflang":[{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/types-of-cookie-files-and-how-to-protect-them\/54243\/"},{"hreflang":"en-in","url":"https:\/\/www.kaspersky.co.in\/blog\/types-of-cookie-files-and-how-to-protect-them\/29512\/"},{"hreflang":"en-ae","url":"https:\/\/me-en.kaspersky.com\/blog\/types-of-cookie-files-and-how-to-protect-them\/24616\/"},{"hreflang":"ar","url":"https:\/\/me.kaspersky.com\/blog\/types-of-cookie-files-and-how-to-protect-them\/12786\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/types-of-cookie-files-and-how-to-protect-them\/29443\/"},{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/types-of-cookie-files-and-how-to-protect-them\/28552\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/types-of-cookie-files-and-how-to-protect-them\/31382\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/types-of-cookie-files-and-how-to-protect-them\/30053\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/types-of-cookie-files-and-how-to-protect-them\/40395\/"},{"hreflang":"tr","url":"https:\/\/www.kaspersky.com.tr\/blog\/types-of-cookie-files-and-how-to-protect-them\/13751\/"},{"hreflang":"fr","url":"https:\/\/www.kaspersky.fr\/blog\/types-of-cookie-files-and-how-to-protect-them\/23140\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/types-of-cookie-files-and-how-to-protect-them\/32627\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/types-of-cookie-files-and-how-to-protect-them\/29623\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/types-of-cookie-files-and-how-to-protect-them\/35371\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/types-of-cookie-files-and-how-to-protect-them\/35000\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.com\/blog\/tag\/privacy\/","name":"privacy"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/54243","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/users\/2747"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/comments?post=54243"}],"version-history":[{"count":4,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/54243\/revisions"}],"predecessor-version":[{"id":54251,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/54243\/revisions\/54251"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/media\/54246"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/media?parent=54243"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/categories?post=54243"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/tags?post=54243"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}What types of cookies are there?<\/h2>\n
By storage time<\/h4>\n
\n
By source<\/h4>\n
\n
By importance<\/h4>\n
\n
By storage technology<\/h4>\n
\n
How session IDs are stolen through session hijacking<\/h2>\n
Session sniffing<\/h4>\n
Cross-site scripting (XSS)<\/h4>\n
Cross-site request forgery (CSRF\/XSRF)<\/h4>\n
Predictable session IDs<\/h4>\n
How to protect yourself from cookie thieves<\/h2>\n
\n
\n