TLS Downgrade Attack for Email Transport

If not redirected, please click here https://www.thesecuritybuddy.com/email-security/tls-downgrade-attack-for-email-transport/

Electronic mails are indispensable nowadays. We can hardly imagine a single day without accessing our emails. Lots of sensitive information are exchanged using these emails. And thus, the transport of emails is also not safe from the attackers.

There are a number of ways in which the attackers can steal sensitive information transferred through emails. And, one of those is TLS Downgrade Attack.

What is TLS Downgrade Attack ?

TLS or Transport Layer Security is a protocol which is widely used to transfer sensitive data between two hosts over the unsecure network. In this protocol, data is encrypted using cryptographic keys before the transfer.

A TLS Downgrade Attack is an attack in which the attacker tricks the server and the client communicating with each other to use a lower version of TLS, so that the attacker can take advantage of that to steal sensitive information. Most of the cases, this TLS Downgrade Attack is performed as part of a Man-In-The-Middle Attack, in which the attacker listens to the conversation between the server and the client and intercepts the data to steal sensitive information.

How can attackers perpetrate TLS Downgrade Attack to steal sensitive data transferred over emails ?

SMTP or Simple Mail Transfer Protocol is a protocol which is widely used to transfer emails from one provider to another.

Suppose, Alice has the email address alice@source.com and she wants to send an email to Bob, who has an email address bob@destination.com.

So, when Alice will send an email to Bob's email address, the mail server for Alice' mail provider will contact mail server for Bob's mail provider and the email will be transferred.

Now, SMTP is a protocol which came in existence 1982 which is much before the TLS protocol, which came in existence in 1995. So, TLS had to be retrofitted to the SMTP protocol.

This was done by adding the extension STARTTLS.

So, when Alice wants to send an email from alice@source.com to bob@destination.com of Bob, the source mail server communicates with the destination mail server. And, after the TCP Handshake is done, the destination mail server will send a STARTTLS to the source mail server. At this point, if the source mail server supports TLS, it will understand the STARTTLS and encryption will be used over the communication. Otherwise, data transfer will be done in clear text format.

Here, the two servers cannot use TLS by default, be cause they won't be knowing whether the other server supports TLS. Especially if the two servers are from two different mail providers, it won't be possible for them to know beforehead whether the other one supports TLS. And, the attacker takes this advantage to perform a Man-In-The-Middle attack.

The attacker first listens to the communication between the two mail servers. And, when the destination mail server sends a STARTTLS to find out whether the source mail server supports TLS, the attacker simply replaces the STARTTLS command with a garbage string.

The source mail server receives the garbage string and it ignores that. But, the destination server assumes the source mail server does not support TLS. And, the communication falls back to using normal clear text. Now, the attacker can easily read the sensitive data getting transferred.

How can we safeguard ourselves ?

SMTP STP is a recent technology which can be used effectively to mitigate this attack. SMTP STS or SMTP Strict Transport Security is a policy that ensures secure SMTP sessions over TLS. 

You will find more information on this policy here : SMTP STS

Other than that, we can use a good encryption technology and encrypt our emails before sending it. PGP is a good example that we can use. It uses public key cryptography. Both the sender and the receiver generate a public-private keypair, using which the emails are encrypted and sent.

To find out more on PGP, you can look in here : What is PGP ?

Otherwise, nowadays almost all webmail providers give us the option of sending encrypted emails. That would help us.

So, TLS Downgrade Attack is quite a widely known attack and the attackers can use this for stealing sensitive information in transport of emails also. But, with a little awareness we can avoid this attack.



Read More

Infographic : How to sign and encrypt emails using PGP ?

What is PGP or Pretty Good Privacy ?

How are S/MIME and PGP different from each other in encrypting emails ?

How can Bitmessage be used to send encrypted messages ?

What is SMTP Strict Transport Security ? 

How can attackers perpetrate DNS Hijacking Attack to steal sensitive data transferred over emails ?

What is DNS Cache Poisoning ?

If not redirected, please click here https://www.thesecuritybuddy.com/securing-dns/what-is-dns-cache-poisoning/

When we want to visit a website, we simply type the URL of the website in the address bar of the browser and the webpage loads. We do not need to memorize the IP address of the website. This process is called Domain Name Resolution. And, the servers responsible for this are called DNS Servers.

How Domain Name Resolution Works

When we type a URL of a website in the address bar of the browser, our computer contacts the Domain Name Servers or DNS Servers to resolve the IP address of the website. These DNS Servers are coordinated by ICANN or Internet Corporation for Assigned Names and Numbers. Normally, our computer uses a DNS Server which is used by our ISP or Internet Service Provider.

So, our computer makes a DNS query with the URL to the DNS Server and the corresponding DNS Server responds with proper IP address. And, using this IP address our browser opens the website in the browser.

What is DNS Cache

The Internet does not have a single DNS Server, because that would be very inefficient. Instead, our ISP runs its own DNS Servers, which cache information from other DNS Servers. Our home router has its own DNS Server, which caches information from ISP's DNS Servers. And, our computer has a local DNS cache, which stores responses of previous DNS queries made by the computer.

The function of DNS cache is to store responses of previously made DNS queries, so that next time the same DNS query is made, it doesn't have to contact the DNS Servers again. Instead, it can retrieve the IP address from its cache.

What is DNS Cache Poisoning

DNS Cache is said to be poisoned when stores a malicious entry instead of a valid one. For example, if we type google.com, for the first time our computer will make a DNS query to appropriate DNS Server and once it gets a response, it will store the IP address of google.com in its DNS Cache, with a timestamp upto which the entry remains valid.

Within that time, if we type google.com again, our computer will look at its DNS Cache for the entry.

Suppose, our computer has made a DNS query and waiting for a response from the DNS Servers. But, instead of an authentic response it gets a response containing IP address of the attacker's website. So, its DNS Cache will be poisoned and next time onwards, whenever the computer will try to resolve the IP address of the same URL, it will end up being to the attacker's website.

In similar way, DNS Cache of any DNS Server also may get poisoned. Because, ISP's DNS Server gets response from other DNS Servers and it stores the responses in its cache. If that cache is poisoned, the same poisoned entry will spread to all home routers and from them to all computers.

How Is DNS Cache Poisoning Done

When our computer makes a DNS query, it has to wait for certain amount of time before it gets a response from the DNS Servers. Within that time, if the attacker's DNS Server sends malicious response to the computer, the computer will not be able to recognize that it is a fraudulent response. And, if the attacker's DNS Servers send multiple such fraudulent responses, then the computer will be tricked to consider that fraudulent responses to be the authentic ones. Because, the authentic DNS Server will send a single response only.

As a result, the computer will discard the response from the authentic DNS Server and store the malicious response to its DNS Cache instead. And now, the computer's DNS Cache is poisoned. So, next time onwards whenever the computer will try to open the same URL, it will end up being in the malicious website controlled by the attacker. In similar way, cache of other DNS Servers also may get poisoned.

Purpose of DNS Cache Poisoning

An attacker may have many nefarious purposes behind DNS Cache Poisoning. One such purppose may be Pharming, in which lots of innocent traffic is forwarded to a website to generate advertising revenue illegitimately. For example, you may type facebook.com and end up being a website full of pop-ups and advertisements and controlled by hackers to generate monetary revenues.

Another purpose may be Phishing. In that case, the attacker may create a website that looks like a legitimate website and asks for actual username and password. The attackers can use those credentials for hacking the account and doing other malicious activities.

And, the other purpose may be spreading malware. If a malicious website opens up, it can easily spread malware even on just visiting the website, using Drive-By Download.

Mitigation

We can take a couple of steps to mitigate DNS Cache Poisoning attack.

• Organizations should configure their DNS Servers to limit trust relationships with other DNS Servers. This will make it difficult for the attackers to use their own fraudulent DNS Servers for malicious purposes.
• Domain Name Systems that use BIND 9.5.0 or higher include features that help in preventing DNS Cache Poisoning attack.
• IT teams should configure their DNS name servers to limit recursive queries, store only data related to the requested domain and restrict query responses to only provide information about the requested domain.
• DNS Servers should not run any services that are not needed. Extraneous services running on the DNS Server can make the DNS Cache Poisoning attack easier.
• Use a good firewall which can detect DNS Cache Poisoning.
• Update firmware and software with most recent security patches, so that security vulnerabilities are lesser.
• Time period of each DNS entry should be short in DNS Cache, so that an entry does not stay longer. This will reduce the chances of using a poisoned DNS cache.
• The most effective prevention mechanism of DNS Cache Poisoning is to use DNSSEC or Domain Name System Security Extensions. In DNSSEC, responses from DNS Servers are validated with digital signatures and cryptographic keys. As it will not be possible for attackers to duplicate cryptographic keys, it will be very difficult for attackers to introduce fraudulent DNS Servers to poison the DNS cache with malicious responses.

This was another article to make you aware of DNS Cache Poisoning. Hope you liked it.

What is DNS Hijacking ?

If not redirected, please click here https://www.thesecuritybuddy.com/securing-dns/what-is-dns-hijacking/

When we want to visit a website, we simply type the URL of the website in the address bar of the browser and the webpage loads. We do not need to memorize the IP address of the website. This process is called Domain Name Resolution. And, the servers responsible for this are called DNS Servers.

How Domain Name Resolution Works

When we type a URL of a website in the address bar of the browser, our computer contacts the Domain Name Servers or DNS Servers to resolve the IP address of the website. These DNS Servers are coordinated by ICANN or Internet Corporation for Assigned Names and Numbers. Normally, our computer uses a DNS Server which is used by our ISP or Internet Service Provider.

So, our computer makes a DNS query with the URL to the DNS Server and the corresponding DNS Server responds with proper IP address. And, using this IP address our browser opens the website in the browser.

What is DNS Hijacking

Our computer opens a website using the IP address that the DNS Server has returned. In case of DNS Hijacking, an attacker changes the DNS settings in a computer, so that, whenever the computer makes a DNS query to resolve some IP address, a rogue DNS Server controlled by the attacker is contacted instead of the actual DNS Server used by our ISP. This normally happens when the computer is infected by a malware like DNSChanger Trojan. The malware infects a computer and then changes the DNS settings, replacing the authentic DNS Server with a malicious one.

As a result, the victim computer obtains a malicious IP address of attacker's website, instead of the intended IP address and the browser ends up opening the malicious website.

Purpose of DNS Hijacking

An attacker may have many nefarious purposes behind DNS Hijacking. One such purppose may be Pharming, in which lots of innocent traffic is forwarded to a website to generate advertising revenue illegitimately. For example, you may type facebook.com and end up being a website full of pop-ups and advertisements and controlled by hackers to generate monetary revenues.

Another purpose may be Phishing. In that case, the attacker may create a website that looks like a legitimate website and asks for actual username and password. The attackers can use those credentials for hacking the account and doing other malicious activities.

And, the other purpose may be spreading malware. If a malicious website opens up, it can easily spread malware even on just visiting the website, using Drive-By Download.

Prevention Mechanisms

There are a couple of steps that we can take to prevent DNS Hijacking.

• Keep your Operating Systems updated with recent patches. Most of the cases, malware infects a computer exploiting the security vulnerabilities of Operating Systems. Normally, the more updated an Operating System is, the less vulnerabilities it has.
• Keep your browser or other commonly used software updated with recent patches, so that they have less security vulnerabilities.
• Keep your computer updated with an anti-malware program from a trusted source.
• Do not download any software from any untrusted sources. They are very likely to contain malware.
• Use a good firewall. Though hardware based firewall is the best, but in case you do not have it, you can turn on router firewall.
• In case you are a victim of DNS Hijacking, do not panic ! Recovering from DNS Hijacking is fairly simple. Look into your DNS Settings and check whether it contains any suspicious looking blacklisted DNS Servers. If yes, simply change the DNS Settings as per your ISP's guidelines and remove the malware with a good anti-malware program.

So, beware of the recent threats so that you can protect yourself better and stay safe, stay secured.

LastPass Phishing Attack

If not redirected, please click here https://www.thesecuritybuddy.com/malware-prevention/lastpass-phishing-attack/

LastPass Phishing Attack is a Phishing attack which became widely known in early 2016 and affected many users of LastPass Password Manager. Sensitive passwords of lots of users were compromised and it gave a wake up call to all the security experts.

In this LastPass Phishing Attack, an attacker typically displays a notification in the victim's computer saying the victim's session in LastPass has been expired and he needs to re-login. On clicking on the notification, a login screen appears which is same as LastPass' login screen, but actually is that of the attacker's website.

If the victim ends up giving his actual password in the login screen, it directly goes to the attacker. Using the password, the attacker can now login to the victim's account and do malicious activities impersonating the victim.

LastPass Phishing attack was first notified by Sean Cassidy, who is a CTO of Praesido Inc. In his blog, Cassidy termed it as LostPass Attack.

How is the LastPass Phishing Attack perpetrated ?

In LastPass Phishing Attack, the attacker exploits XSS or Cross Site Scripting vulnerability of LastPass website to perpetrate the attack.

The attacker first uses social engineering to trick the victim to click on a malicious link. It may be a link sent through attachment of an email, or any link indicating some interesting pictures or videos.

The link actually contains a script stored in the attacker's website. On clicking on the link, the script exploits logout CSRF of the LastPass website and logs out the victim from the LastPass website.

Then it displays a malicious notification in the browser viewport saying the victim's session has expired and the victim needs to re-login.

On clicking on the notification a login screen appears which looks similar to that of LastPass website. Cassidy says in his blog that this malicious login screen looks completely similar to the login screen of the LastPass website and there is no way the victim can realize it is actually a nefarious login screen that belongs to the attacker's website.

Now, the victim is tricked to provide his actual login and password in the fraudulent login screen.

At this point, the attacker's server will collect the credentials and verify it using LastPass' APIs. If the credentials do not match, the victim is redirected to login screen again, saying “Invalid Password.”

Once the attacker has correct credentials, i.e. the username, password and two-factor token applicable for two-factor authentication, he can login to LastPass website using the same credentials and impersonate the victim.

At this point, the attacker can change the option for two-factor authentication, password and do other nefarious activities.

Mitigation for LastPass Phishing Attack

We can take at least a couple of steps to protect us from the attack.

• Educating oneself of this attack is an effective way to protect oneself.
• Ignore the notifications of expired session of LastPass, if you get any.
• Disable mobile-login to safeguard you better.
• Log all login failures and check them.
• Inform others of this potential attack.

So, be informed about all recent threats, so that you can protect yourself better and stay safe, stay secured.

What is an HTTPS Bicycle Attack ?

If not redirected, please click here https://www.thesecuritybuddy.com/vulnerabilities/what-is-https-bicycle-attack/

An HTTPS Bicycle Attack is an attack in which the attacker can capture HTTPS traffic of a user and exploit the TLS packets to deduce sensitive information like length of password, GPS location or IPv4 address range of the user.

The attack was first discovered by security researcher Guido Vranken and released on December 30, 2015.

How can an attacker deduce sensitive information like password length from the captured HTTPS traffic ?

When sensitive data is transferred between two hosts over unsecured network, it mostly uses TLS connection. The sensitive data sent by the user is encrypted using secret key and then transferred to the server. Normally, decrypting the sensitive data without the secret key is extremely difficult.

But, for HTTPS traffic, the plaintext HTTP headers included in each and every packet can be exploited by the attacker. The attacker can use Side Channel Information and deduce length of particular components transferred in that particular request.

At this point, if the attacker already has prior information of length of some of the components out of the combined components, he can subtract the length of known components from the length of combined components and deduce the length of the sensitive data.

To give an example, suppose the attacker wants to deduce length of a user's password for a particular target website. The attacker can capture the encrypted TLS packets sent during the authentication requests.

At the same time, he may collect information on the browser the user is using. The attacker can do it easily by perpetrating a direct attack to the user, since insecure HTTP request easily reveals the User-agent string.

Now, the attacker can replicate browser requests to the target website using the same browser as the user and deduce length of the requests to various pages on the target site. And, from the encrypted TLS payload of the browser requests in the packet capture, extract the length of the payloads.

The attacker can now compare the Pearson correlation coefficient for the plain texts and encrypted request. And, on comparing the results, he may deduce which encrypted request is for which page in the website.

Now, the attacker has information on which encrypted TLS request is for login page. From this, the attacker can subtract the length of known headers the user's browser has sent. He can also deduce the length of possible cookies, that are static enough in length.

Now, for a authentication request, normally the username and passwords are sent together. At this point, if the attacker already knows the username of the user, he may subtract that length from the remaining components and deduce the length of the user's password.

How can an attacker deduce actual passwords from length of passwords ?

Suppose, the attacker could deduce that a particular user's password is of length 8. Now, one option is to use brute force approach and try to login in the target website with all passwords comprised of 8 characters and numerals. If the password strength is weak enough, the attacker can deduce the actual password.

Another option is using Dictionary Attack. Often, users create passwords using dictionary words. So, if the attacker can try to login with all dictionary words with 8 characters, he will easily deduce the actual password.

The attacker may also use some other information specific to the user and try with a set of specific passwords of length 8, and deduce the password easily.

What all sensitive data can be deduced using HTTPS Bicycle Attack ?

Many sensitive data can be deduced using HTTPS Bicycle Attack. Even, TLS packets which have been captured long ago can be exploited to deduce sensitive data. Some of the sensitive data that can be deduced by HTTPS Bicycle Attack includes :

• Length of passwords can be deduced from which the actual password may get revealed.
• Small differences in the length of encrypted GPS co-ordinates can be used to estimate the location on the world map for a particular encrypted coordinate.
• Differences in length of encrypted IPv4 addresses can reveal specific IP address range, which can later be used to deduce the actual IP address.

What is the mitigation of HTTPS Bicycle Attack ?

There are a couple of steps that can be taken to mitigate the attack.

• The user can use a strong password comprised of a mixture of special characters, numerals and random characters and make it difficult for the attacker to deduce the actual password even though the attacker knows the length of the password.
• Two-step authentication, that uses password as well as some other information like One Time Password etc to authenticate the user can mitigate the attack.
• HTTPS Bicycle Attack is done on TLS that uses stream ciphers, because there is a 1:1 relation between input plaintext and encrypted output for stream ciphers. If one byte is added to the plaintext, one byte will be added to the output. So, it makes much easier for the attacker to deduce the length of sensitive data. So, turning off support of TLS stream ciphers may be a good option to mitigate this attack.
• Using the latest version of TLS (version 1.2) can prevent this attack.
• Sensitive information transferred can be hashed upto a fixed length so that the attacker cannot deduce information on length of sensitive data.

What is TCP Sequence Prediction Attack ?

If not redirected, please click here https://www.thesecuritybuddy.com/vulnerabilities/what-is-tcp-sequence-prediction-attack/

What is TCP Sequence Prediction Attack ?

TCP protocol is a connection-oriented protocol. When two hosts communicate with each other using TCP protocol, they first establish a connection between them. And then, the transfer of data packets begin. A data packet is sent by the sender, the receiver receives it and sends an acknowledgement. The sender gets the acknowledgement and transfers the next data packet.

When data packets are transferred over the TCP connection, usually each packet contains a sequence number. This sequence number helps in keeping track of data packets received and acknowledged.

Sometimes, attackers exploit this concept of sequence numbers of TCP packets and perpetrate attacks for malicious purposes. This type of attacks are called TCP Sequence Prediction Attacks.

Purpose of TCP Sequence Prediction Attack

Suppose, two hosts A and B are communicating to each other using a TCP connection. An attacker can perpetrate this attack to inject a counterfeit data packet to host A, impersonating to be host B. So, host A will think the data packets are coming from trusted host B, though they are actually coming from the attacker. The attacker can even close the connection to host A prematurely or do other mischiefs hiding his own identity.

Why is sequence number prediction done for TCP Packets ?

Suppose, host A and host B are communicating with each other using a TCP connection. An attacker is listening to their communication. If the attacker wants to send a counterfeit data packet to host A impersonating to be host B, he cannot simply send it to host A, using host B's identity. Because, each data packet has a sequence number, which is checked in every packet transfer. So, the attacker has to predict that sequence number and include that in the counterfeit data packet as well. And, hence the sequence number prediction.

How are TCP Sequence Prediction Attacks performed ?

The attacker typically follows these steps to perpetrate the TCP Sequence Attack.

• Suppose, host A and host B are communicating with each other using TCP connection. The attacker is listening to the conversation and wants to send counterfeit packets to host A, impersonating to be host B.
• The attacker tracks the sequence number of each data packet. He predicts the sequence number that the counterfeit data packet should have and makes the packet.
• The attacker starts sending those packets to host A, spoofing the IP address of the victim host B.
• At this point, host B may send the actual packet to host A. And, that would create confusion to host A, as it will receive both the packets.
• So, to avoid that, the attacker performs a DoS attack to host B at the same time. As a result, host B cannot send the intended data packets to host A. And, instead the attacker can easily impersonate to be host B.
• Now, the attacker can introduce counterfeit data packets to host A impersonating host B, close the TCP connection prematurely or do other mischief.

How to prevent TCP Sequence Prediction Attack ?

There are a few prevention mechanisms that can be taken.

• Instead of a predicted sequence number, a random sequence number can be used to track the data packets. In that way, it will be difficult for the attacker to predict the sequence number and perpetrate the attack.
• Instead of a sequence number, other information like time-stamps, timing differences or information from lower protocol layers can be used in the data packets. This can prove much difficult for the attackers to guess and perform such attacks.
• We can configure the router or firewall not to allow packets to come in from external sources with having an internal IP address. Though this may not completely fix the attacks, but it can prevent the attacks to a great extent.

So, be informed about the most common threats and stay safe, stay secured.

What is a Remote Access Trojan or RAT ?

If not redirected, please click here https://www.thesecuritybuddy.com/malware-prevention/how-to-prevent-remote-access-trojan-or-rat/

A Remote Access Trojan or RAT Trojan is a malware that infects a remote computer and allows a remote attacker to control the computer for malicious purposes. It is typically installed in a computer secretly, without the user's knowledge and hides its operation from the security software installed in the computer.

Normally, these RAT Trojans infect a computer through clicking on a malicious link, internet downloads or Peer-to-Peer File Sharing software. They disguise as a legitimate program or file. After infecting a computer, a file or stub is opened in victim's computer and the attacker gets control of the computer. Normally, the file may not create much suspicion. On clicking on it, it may just show an error message indicating it did not open.

How does a RAT give unauthorized access of a computer to the attacker

RAT is a malware program. So, like other malware programs it infects a computer using trickery. It usually disguises itself as something desirable and harmless and convinces the innocent user to install it.

RAT may come as an email attachment or it can get installed in a computer along with some other software, may be with an attractive video game from an untrusted source or may even be with a rogue anti-malware program, which fraudulently indicates that the computer already has lots of other malware and convinces the user to install it.

After infecting the computer, the RAT malware connects back to the attacker remotely. And, as the malware program has remote administrative capability, it gives complete unauthorized access of the computer to the attacker.

The attacker is now free to control the computer from a remote location and exploit it for malicious purposes.


   

What all actions can RAT Trojans perform ?

Once infecting the computer, RAT Trojans can do the following :

• Block mouses and keyboards
• Change the desktop wallpaper
• Upload or download or destroy files and other data
• Increase clock rate of the system and destroy hardware
• Infect the computer with more malware
• Use the computing resources of the computer to perform illegitimate actions like DoS attacks
• Format drives
• Spy on the user and steal sensitive data like passwords and credit card numbers
• Change browser's settings
• Install other malicious software silently
• Install Keyloggers
• Control mouse and keyboard
• Use microphone or webcam connected with the computer to record sounds or videos
• Capture screens to steal sensitive data
• Shutdown or restart computer unwantedly
• Control the task manager in the computer

One popular example of RAT Trojan is Back Orifice. It targeted Microsoft Windows computers and infected lots of computers to control those computers and steal sensitive data.

How to prevent RAT Trojans ?

We can take a couple of steps to prevent these RAT Trojans.

• Do not click on suspicious links.
• Download and install software from trusted sources only.
• Keep your computer updated with a trusted anti-malware program.
• Keep your browser and other commonly used software updated with recent patches. Most of the cases, these malware infect a computer exploiting security vulnerabilities of commonly used software. Recent patches help us to resolve those vulnerabilities.
• Keep your Operating System updated with recent patches, for the same reason as mentioned above.

So, be informed about all security threats so that you can protect your computer in a better way and stay safe, stay protected.

JSON Hijacking or JavaScript Hijacking

If not redirected, please click here https://www.thesecuritybuddy.com/vulnerabilities/what-is-json-hijacking-or-javascript-hijacking/

In JSON Hijacking or JavaScript Hijacking, an attacker exploits vulnerabilities in a browser and attacks a system that uses JSON or JavaScript Object Notation as a transport mechanism between the server and the client and steals sensitive data.

In this attack, the attacker accesses JSON data from applications that return sensitive data using JSON arrrays in a GET request.

How is JSON Hijacking attack done ?

When a user authenticates himself in a web server, the session is maintained with a HTTP cookie. And the cookie is placed in the user's computer. And later, when the browser sends any request to the webserver, the information in the cookies is used. In JSON Hijacking attack, the attacker tricks the user to send malicious request to the webserver and reveal sensitive data.

The following steps lead to a JSON Hijacking attack :

• The user authenticates to a web application and HTTP cookies are placed in his computer.
• The user clicks on a link that the attacker has already sent him. The link contains a script in the attacker's website. The attacker may use social engineering to convince the user to click on the link. For example, the attacker may send the user an email asking the user to click on the link to see some interesting pictures or videos.
• The user clicks on the link and the script starts executing.
• The attacker's website responds with an HTML containing JavaScript and a script tag.
• The browser sees the script tag and makes another GET request to the vulnerable web application, and the browser uses the cookies placed in the user's computer.
• Now, the attacker has tricked the victim's browser to issue a request for the JSON containing sensitive data using the authentication cookies.
• This loads the JSON array as JavaScript and the attacker gets access to sensitive data.

What are the countermeasures for JSON Hijacking attack ?

There are some prevention mechanisms that can be taken to mitigate the attacks.

• In JavaScript, use .innerText instead of .innerHTML. This will automatically encode the text. Use .innerHTML only when you are displaying HTML.
• Do not use eval function. It is very much vulnerable.
• Do not rely on client logic to ensure security.
• Avoid writing serialization code.
• Avoid building XML dynamically. Use an encoding library to make attributes and element data safe.
• Use SSL/TLS and encrypt on the server, not on the client side code.
• Always return JSON with an object on outside.
  For example : {"result": [{"object": "inside an array"}]}
• Use framework to build XML, do not build XML by hand.

For more information on prevention mechanisms : https://www.owasp.org/index.php/OWASP_AJAX_Security_Guidelines