A stolen session cookie can open your bank account without a password or login alert

Stealing a session cookie lets a fraudster act as you inside an account you have already logged into, which is why this type of fraud, known as session hijacking, is so hard to notice. The Guardian set out how it works and how to defend against it.

Why a cookie works like a key

When you log into a website such as your bank’s, you receive a unique cookie that sits on your device and temporarily stores your data. It spares you from entering your credentials on every page. This is the “session cookie”, and it stops being useful once you log out.

The session can outlast your activity, though, if you ask a site to remember you or do not close it properly. During that window you are exposed. Marijus Briedis, chief technology officer at cyber security company NordVPN, says: “Cookies have become the primary target for hackers,”.

Briedis offers an image: “Think of a session cookie as a digital key that’s already turned in the lock.” The figure is NordVPN’s own count of cookies, not a tally of victims or frauds.

How the theft happens

The cookies are taken from your device, usually after you have downloaded malware without knowing. According to Briedis, the malicious program goes for the browser’s database, collects the active session cookies and sends them back to the hacker.

To the website, the thief looks like you. Briedis says: “They don’t need your password, they don’t trigger a login alert, and they can often bypass your multifactor authentication (MFA).” You may only find out later, when someone has used the cookie to get into your account.

What follows depends on the account. A hijacked social media or email account can be used to trick other people. Access to a bank account could let a fraudster reach the money or use the details found there for an impersonation scam. During online shopping, they could alter and redirect an order and charge it to your saved payment details.

Spotting the warning signs

Infostealer malware tends to hide in downloaded extensions and software, so caution there matters most. Briedis lists red flags that a laptop or phone may be infected:

• the device struggles with simple tasks;
• the battery drains faster than it should;
• crashes become frequent;
• the browser redirects you, shows pop-ups or has a changed homepage.

A security alert from a site, for instance a message asking whether you tried to change your details, can also signal a problem.

Protecting your accounts

Log out of accounts as a habit. “Just closing a tab doesn’t end the session,” says Briedis, who adds that you need to log out manually to make the cookie useless to a thief. He also suggests moving passwords out of the browser and into a dedicated password manager. Clearing your cookies regularly reduces what can be stolen.

Multifactor authentication still protects better than a password alone, even though a stolen cookie can often get around it. Insecure public wifi is a low risk for cookie theft, but it is wise to avoid it for sites that require a login.

1. Run an antivirus scan on the device.
2. Log out of your accounts on every device.
3. Change your passwords.
4. Alert your bank if you notice any suspicious payments.

Photo: nappy / Pexels