携帯電話からセッションIDの漏洩を防ぐ 
携帯電話向けWebアプリの脆弱性事情はどうなっているのか@高木浩光＠自宅の日記 より
リンク先のWebサイトには、Refererと共に端末IDもリクエストヘッダとして送信されているわけで、セッションID入りURLと端末IDがセットで流出するのだから、当然、同じHTTPリクエストを送るだけの方法でなりすましアクセスされてしまう。
URIにセッションIDを含める方法では、悪意のあるサイトにリンクを張るだけでRefererヘッダからセッションIDが取り放題となる。また、悪意のあるサイトにアクセスしたユーザーは端末IDもHTTPヘッダに含めそのサイトに送信してしまう。端末IDは簡単に詐称することが出来るので、端末IDをチェックしてもセッションハイジャックの防止線にはならない、というお話。
私は携帯端末は専門ではないので細かいことは良くわからないのだが、以下を前提にして、携帯電話からセッションIDの漏洩を防ぐ方策を記述する。以下前提である(*1)。
- GETメソッドでセッションを保持するにはURIにセッションIDを含める以外に方法がない
- Webアプリケーションは「端末IDを詐称したPC」と「正規の携帯電話」を区別する方法を持っていない
- Referer送出を防ぐ手立てがない
- 携帯端末にはバグがない(例えばこういうバグ)
この場合、以下の方法を取ることにより、RefererからのセッションIDの窃取、またそれによるセッションハイジャックを防ぐことができる。
- テンプレートなどにおいて、責任が持てるサイト以外には直接リンクを張らない。責任が持てない場合は必ず方策3を取る。
- Blogのコメント欄のように自動的に生成されるリンクでは、必ず方策3を採る
- 責任が持てないサイトにリンクを張る場合、またはBlogのコメント欄のように外部からリンクを任意に張られるような場合は、セッションIDを含めないURLに一旦誘導し、そこから外部リンクに飛ばすようにする。
ここで、「責任が持てるサイト」というのは「お友達のサイト」とか「取引先のサイト」とかそういうのではない。どんなに信用がおけるサイトでも、そのサイトがクラックされたりログが漏れたりする可能性は否定できない。自身の責任の及ばないサイト、簡単に言えば他人のサイトには直接リンクを張るなということである。
例えばURLにセッションIDを含むページにおいて、
<a href="http://www.example.com">リンク</a>
というリンクを構成した場合、www.example.comへはRefererとしてセッションIDが送出され、これが漏洩してしまう可能性がある。そこで、例えばjumpというWebアプリケーションを用意し、
<a href="/jump?uri=http%3A%2F%2Fwww.example.com">リンク</a>
というようにセッションIDを含めない形で、内部ページに一旦遷移させる(*2)。アプリケーション「jump」では、クエリ文字列から「url」を取得し、それが安全なURIであることを確認した上でそのURIへと遷移させる。これで外部にRefererとしてセッションIDが漏洩することはなくなる。
しかし上記の方法ではjumpアプリケーション自体がリダイレクタとして「踏み台」に使われてしまう可能性があるのでそのまま実装すべきではない。実際Googleなどで同様の事件が起きている。従ってuriのホワイトリストを作る、uriに対応するワンタイムトークンを発行するなどの方策が別に必要となる(*3)。
なお、冒頭の高木氏のエントリの注釈に、
（IPアドレスを確認すればそれで本当になりすまし不可能にできるのかは知らない。それは携帯電話事業者が公式に示すべきことだ。）
とあるが、携帯電話のIPアドレス制限神話にも書いたように、IPアドレスで携帯電話とPCを確実に見分ける方法は3キャリアとも公表していないようだ。
関連エントリ
注釈
- (*1)Cookieを利用している場合や、Refererを送出しない端末の場合この問題は発生しない。
- (*2)特にPHPのsession.use_trans_sidは、出力中の相対uriに勝手にセッションIDを埋めてしまうので注意が必要だ。
- (*3) jumpアプリケーションがRefererをチェックすれば良いように思えるかもしれないが、Refererを送るか送らないかは携帯端末に依存している。当然外部からのRefererを蹴るようにすれば一定の効果はあるが万全とは言えない。
2011/12/09 - 18:20:31 -
Recent Blogroll Additions…
[…]usually posts some very interesting stuff like this. If you’re new to this site[…]…
2011/12/09 - 18:37:27 -
Read was interesting, stay in touch…
[…]please visit the sites we follow, including this one, as it represents our picks from the web[…]…
2011/12/09 - 20:13:31 -
Read was interesting, stay in touch…
[…]please visit the sites we follow, including this one, as it represents our picks from the web[…]…
2011/12/09 - 21:53:15 -
Recommeneded websites
[…]Here are some of the sites we recommend for our visitors[…]…
2011/12/09 - 23:09:32 -
[…]we like to honor many other internet sites on the web, even if they aren’t linked to us, by linking to them. Under are some webpages worth checking out[…]…
[…]Here are some of the sites we recommend for our visitors[…]…
2011/12/09 - 23:58:42 -
Visitor recommendations
[…]one of our visitors recently recommended the following website[…]…
2011/12/10 - 00:33:03 -
Its hard to find good help
I am regularly saying that its difficult to find good help, but here is
2011/12/10 - 02:23:48 -
Cool sites
[…]we came across a cool site that you might enjoy. Take a look if you want[…]…
2011/12/10 - 03:52:51 -
Sites we Like…
[…] Every once in a while we choose blogs that we read. Listed below are the latest sites that we choose […]…
2011/12/10 - 05:42:12 -
Great website
[…]we like to honor many other internet sites on the web, even if they aren’t linked to us, by linking to them. Under are some webpages worth checking out[…]…
2011/12/10 - 06:46:02 -
Websites we think you should visit
[…]although websites we backlink to below are considerably not related to ours, we feel they are actually worth a go through, so have a look[…]…
2011/12/10 - 08:21:52 -
Read was interesting, stay in touch…
[…]please visit the sites we follow, including this one, as it represents our picks from the web[…]…
2011/12/10 - 08:50:48 -
Gems form the internet
[…]very few websites that happen to be detailed below, from our point of view are undoubtedly well worth checking out[…]…
2011/12/10 - 09:25:05 -
Online Article…
[…]The information mentioned in the article are some of the best available […]…
2011/12/10 - 09:33:57 -
Sources
[…]check below, are some totally unrelated websites to ours, however, they are most trustworthy sources that we use[…]…
2011/12/10 - 10:25:29 -
Recent Blogroll Additions…
[…]usually posts some very interesting stuff like this. If you’re new to this site[…]…
2011/12/10 - 11:11:21 -
You should check this out
[…] Wonderful story, reckoned we could combine a few unrelated data, nevertheless really worth taking a look, whoa did one learn about Mid East has got more problerms as well […]…
2011/12/10 - 11:26:53 -
Gems form the internet
[…]very few websites that happen to be detailed below, from our point of view are undoubtedly well worth checking out[…]…
2011/12/10 - 12:24:46 -
Gems form the internet
[…]very few websites that happen to be detailed below, from our point of view are undoubtedly well worth checking out[…]…
2011/12/10 - 12:54:51 -
Websites you should visit
[…]below you’ll find the link to some sites that we think you should visit[…]…
2011/12/10 - 22:18:37 -
Online Articleâ?¦
[…]The information mentioned in the article are some of the best available […]…
2011/12/11 - 01:02:52 -
Awesome website
[…]the time to read or visit the content or sites we have linked to below the[…]…
2011/12/11 - 01:11:03 -
Gems form the internet
[…]very few websites that happen to be detailed below, from our point of view are undoubtedly well worth checking out[…]…
2011/12/11 - 03:11:58 -
Related…
[…]just beneath, are numerous totally not related sites to ours, however, they are surely worth going over[…]…
2011/12/11 - 03:48:18 -
Recommeneded websites
[…]Here are some of the sites we recommend for our visitors[…]…
2011/12/11 - 05:16:34 -
Related…
[…]just beneath, are numerous totally not related sites to ours, however, they are surely worth going over[…]…
2011/12/11 - 07:35:25 -
Great Source Of Web Marketing Material
[…]Awesome information that I’ve been searching for for some time! I got some interesting strategies from this[…]
2011/12/11 - 08:54:57 -
Gems form the internet
[…]very few websites that happen to be detailed below, from our point of view are undoubtedly well worth checking out[…]…
2011/12/11 - 10:04:37 -
Gems form the internet
[…]very few websites that happen to be detailed below, from our point of view are undoubtedly well worth checking out[…]…
2011/12/11 - 11:46:16 -
Websites you should visit
[…]below you’ll find the link to some sites that we think you should visit[…]…
2011/12/11 - 18:14:42 -
Check this out
[…] that is the end of this article. Here you’ll find some sites that we think you’ll appreciate, just click the links over[…]…
2011/12/11 - 22:45:35 -
Online Article…
[…]The information mentioned in the article are some of the best available […]…
2011/12/12 - 00:59:48 -
Recommeneded websites
[…]Here are some of the sites we recommend for our visitors[…]…
2011/12/12 - 01:29:54 -
Related…
[…]just beneath, are numerous totally not related sites to ours, however, they are surely worth going over[…]…
2011/12/12 - 02:34:10 -
Gems form the internet
[…]very few websites that happen to be detailed below, from our point of view are undoubtedly well worth checking out[…]…
2011/12/12 - 03:26:57 -
Websites worth visiting
[…]here are some links to sites that we link to because we think they are worth visiting[…]…
2011/12/12 - 06:05:55 -
Visitor recommendations
[…]one of our visitors recently recommended the following website[…]…
2011/12/12 - 06:55:48 -
Links
[…]Sites of interest we have a link to[…]…
2011/12/12 - 07:22:32 -
Cool sites
[…]we came across a cool site that you might enjoy. Take a look if you want[…]…
2011/12/12 - 08:42:14 -
Related…
[…]just beneath, are numerous totally not related sites to ours, however, they are surely worth going over[…]…
2011/12/12 - 09:09:01 -
Websites worth visiting
[…]here are some links to sites that we link to because we think they are worth visiting[…]…
2011/12/12 - 14:13:15 -
new dating site
I savour, result in I found exactly what I was taking a look for. You have ended my 4 day lengthy hunt! God Bless you man. Have a nice day. Bye
2011/12/12 - 17:28:34 -
Websites you should visit
[…]below you’ll find the link to some sites that we think you should visit[…]…
2011/12/12 - 18:18:50 -
Superb website
[…]always a big fan of linking to bloggers that I love but don’t get a lot of link love from[…]…
2011/12/12 - 18:27:23 -
100 free dating sites
Normally I don’t read article on blogs, but I wish to say that this write-up very forced me to try and do so! Your writing style has been amazed me. Thanks, very nice post.
2011/12/12 - 19:09:11 -
Blogs ou should be reading
[…]Here is a Great Blog You Might Find Interesting that we Encourage You[…]…
2011/12/12 - 20:41:33 -
Awesome website
[…]the time to read or visit the content or sites we have linked to below the[…]…
2011/12/12 - 20:50:42 -
Visitor recommendations
[…]one of our visitors recently recommended the following website[…]…
2011/12/12 - 21:56:46 -
Sites we Like…
[…] Every once in a while we choose blogs that we read. Listed below are the latest sites that we choose […]…
2011/12/12 - 22:04:11 -
Superb website
[…]always a big fan of linking to bloggers that I love but don’t get a lot of link love from[…]…
2011/12/13 - 00:07:49 -
Websites we think you should visit
[…]although websites we backlink to below are considerably not related to ours, we feel they are actually worth a go through, so have a look[…]…
2011/12/13 - 00:59:09 -
Recent Blogroll Additions…
[…]usually posts some very interesting stuff like this. If you’re new to this site[…]…
2011/12/13 - 01:34:55 -
Websites worth visiting
[…]here are some links to sites that we link to because we think they are worth visiting[…]…
2011/12/13 - 03:25:35 -
Read was interesting, stay in touch…
[…]please visit the sites we follow, including this one, as it represents our picks from the web[…]…
2011/12/13 - 04:43:48 -
Websites you should visit
[…]below you’ll find the link to some sites that we think you should visit[…]…
2011/12/13 - 06:40:08 -
Recent Blogroll Additions…
[…]usually posts some very interesting stuff like this. If you’re new to this site[…]…
2011/12/13 - 06:46:40 -
2012 Fashion ideas i
Whenever you hear the consensus of scientists agrees on something or other, reach for your wallet, because you’re being had.
2011/12/13 - 07:07:57 -
You should check this out
[…] Wonderful story, reckoned we could combine a few unrelated data, nevertheless really worth taking a look, whoa did one learn about Mid East has got more problerms as well […]…
2011/12/13 - 08:19:08 -
Check this out
[…] that is the end of this article. Here you’ll find some sites that we think you’ll appreciate, just click the links over[…]…
2011/12/13 - 08:40:59 -
Check this out
[…] that is the end of this article. Here you’ll find some sites that we think you’ll appreciate, just click the links over[…]…
2011/12/13 - 09:45:43 -
Awesome website
[…]the time to read or visit the content or sites we have linked to below the[…]…
2011/12/13 - 09:55:56 -
Gems form the internet
[…]very few websites that happen to be detailed below, from our point of view are undoubtedly well worth checking out[…]…
2011/12/13 - 10:06:24 -
Awesome website
[…]the time to read or visit the content or sites we have linked to below the[…]…
2011/12/13 - 15:55:03 -
Links
[…]Sites of interest we have a link to[…]…
2011/12/13 - 17:26:42 -
Online Article…
[…]The information mentioned in the article are some of the best available […]…
2011/12/13 - 23:55:58 -
Visitor recommendations
[…]one of our visitors recently recommended the following website[…]…
2011/12/14 - 00:33:45 -
Sources
[…]check below, are some totally unrelated websites to ours, however, they are most trustworthy sources that we use[…]…
2011/12/14 - 04:23:15 -
Related…
[…]just beneath, are numerous totally not related sites to ours, however, they are surely worth going over[…]…
2011/12/14 - 04:56:19 -
You should check this out
[…] Wonderful story, reckoned we could combine a few unrelated data, nevertheless really worth taking a look, whoa did one learn about Mid East has got more problerms as well […]…
2011/12/14 - 05:06:21 -
Read was interesting, stay in touch…
[…]please visit the sites we follow, including this one, as it represents our picks from the web[…]…
2011/12/14 - 05:14:53 -
Online Article…
[…]The information mentioned in the article are some of the best available […]…
2011/12/14 - 05:30:39 -
Superb website
[…]always a big fan of linking to bloggers that I love but don’t get a lot of link love from[…]…
2011/12/14 - 06:57:31 -
Online Article…
[…]The information mentioned in the article are some of the best available […]…
2011/12/14 - 07:01:09 -
Check this out
[…] that is the end of this article. Here you’ll find some sites that we think you’ll appreciate, just click the links over[…]…
2011/12/14 - 08:29:59 -
Websites worth visiting
[…]here are some links to sites that we link to because we think they are worth visiting[…]…
2011/12/14 - 09:14:24 -
Websites you should visit
[…]below you’ll find the link to some sites that we think you should visit[…]…
2011/12/14 - 10:11:49 -
Superb website
[…]always a big fan of linking to bloggers that I love but don’t get a lot of link love from[…]…
2011/12/14 - 15:51:09 -
Sites we Like…
[…] Every once in a while we choose blogs that we read. Listed below are the latest sites that we choose […]…
2011/12/14 - 17:08:37 -
Websites you should visit
[…]below you’ll find the link to some sites that we think you should visit[…]…
2011/12/14 - 17:17:25 -
Websites we think you should visit
[…]although websites we backlink to below are considerably not related to ours, we feel they are actually worth a go through, so have a look[…]…
2011/12/14 - 18:24:31 -
Websites worth visiting
[…]here are some links to sites that we link to because we think they are worth visiting[…]…
2011/12/14 - 18:33:03 -
Websites we think you should visit
[…]although websites we backlink to below are considerably not related to ours, we feel they are actually worth a go through, so have a look[…]…
2011/12/14 - 18:59:27 -
Superb website
[…]always a big fan of linking to bloggers that I love but don’t get a lot of link love from[…]…
2011/12/14 - 19:31:50 -
Recent Blogroll Additions…
[…]usually posts some very interesting stuff like this. If you’re new to this site[…]…
2011/12/14 - 21:56:55 -
Links
[…]Sites of interest we have a link to[…]…
2011/12/14 - 22:07:56 -
Great website
[…]we like to honor many other internet sites on the web, even if they aren’t linked to us, by linking to them. Under are some webpages worth checking out[…]…
2011/12/14 - 22:10:27 -
Blogs ou should be reading
[…]Here is a Great Blog You Might Find Interesting that we Encourage You[…]…
2011/12/14 - 22:49:31 -
Really interesting post
This original really replied my set back, thank you!.
2011/12/14 - 23:23:23 -
Awesome website
[…]the time to read or visit the content or sites we have linked to below the[…]…
2011/12/15 - 00:36:51 -
Websites we think you should visit
[…]although websites we backlink to below are considerably not related to ours, we feel they are actually worth a go through, so have a look[…]…
2011/12/15 - 05:08:44 -
Gems form the internet
[…]very few websites that happen to be detailed below, from our point of view are undoubtedly well worth checking out[…]…
2011/12/15 - 05:18:42 -
You should check this out
[…] Wonderful story, reckoned we could combine a few unrelated data, nevertheless really worth taking a look, whoa did one learn about Mid East has got more problerms as well […]…
2011/12/15 - 06:33:31 -
Links
[…]Sites of interest we have a link to[…]…
2011/12/15 - 09:47:18 -
Recent Blogroll Additions…
[…]usually posts some very interesting stuff like this. If you’re new to this site[…]…
2011/12/15 - 10:01:08 -
Websites we think you should visit
[…]although websites we backlink to below are considerably not related to ours, we feel they are actually worth a go through, so have a look[…]…
2011/12/15 - 11:43:14 -
Its hard to find good help
I am regularly saying that its difficult to get quality help, but here is
2011/12/15 - 13:43:52 -
Where To Find Billiga Solglasögon Online
[…]Awesome info that I’ve been seeking for some time! Maintain up using the superior writing.[…]
2011/12/15 - 16:48:14 -
Websites we think you should visit
[…]although websites we backlink to below are considerably not related to ours, we feel they are actually worth a go through, so have a look[…]…
2011/12/15 - 17:07:49 -
Awesome website
[…]the time to read or visit the content or sites we have linked to below the[…]…
2011/12/15 - 18:06:43 -
Recent Blogroll Additions…
[…]usually posts some very interesting stuff like this. If you’re new to this site[…]…
2011/12/15 - 18:28:28 -
Related…
[…]just beneath, are numerous totally not related sites to ours, however, they are surely worth going over[…]…
2011/12/15 - 19:22:17 -
free dating site
It???s truly a nice and useful piece of info. I am happy that you simply shared this useful information with us. Please stay us up to date like this. Thanks for sharing.
2011/12/15 - 19:37:22 -
Links
[…]Sites of interest we have a link to[…]…
2011/12/15 - 21:02:45 -
Recommeneded websites
[…]Here are some of the sites we recommend for our visitors[…]…
2011/12/15 - 21:53:02 -
Online Article…
[…]The information mentioned in the article are some of the best available […]…
2011/12/15 - 22:15:07 -
Awesome website
[…]the time to read or visit the content or sites we have linked to below the[…]…
2011/12/15 - 22:50:48 -
Sources
[…]check below, are some totally unrelated websites to ours, however, they are most trustworthy sources that we use[…]…
2011/12/15 - 23:57:58 -
Websites worth visiting
[…]here are some links to sites that we link to because we think they are worth visiting[…]…
2011/12/16 - 00:12:40 -
Related…
[…]just beneath, are numerous totally not related sites to ours, however, they are surely worth going over[…]…
2011/12/16 - 01:26:40 -
Websites worth visiting
[…]here are some links to sites that we link to because we think they are worth visiting[…]…
2011/12/16 - 03:49:38 -
Check this out
[…] that is the end of this article. Here you’ll find some sites that we think you’ll appreciate, just click the links over[…]…
2011/12/16 - 05:56:15 -
Sites we Like…
[…] Every once in a while we choose blogs that we read. Listed below are the latest sites that we choose […]…
2011/12/16 - 06:07:25 -
Related…
[…]just beneath, are numerous totally not related sites to ours, however, they are surely worth going over[…]…
2011/12/16 - 07:50:52 -
Cool sites
[…]we came across a cool site that you might enjoy. Take a look if you want[…]…
2011/12/16 - 08:41:32 -
Recommeneded websites
[…]Here are some of the sites we recommend for our visitors[…]…
2011/12/16 - 09:44:54 -
Superb website
[…]always a big fan of linking to bloggers that I love but don’t get a lot of link love from[…]…
2011/12/16 - 09:49:07 -
Check this out
[…] that is the end of this article. Here you’ll find some sites that we think you’ll appreciate, just click the links over[…]…