What is session hijacking?¶

Session hijacking occurs when someone gains unauthorised use of an active authenticated session.

Avoid the dangerous assumption¶

The dangerous assumption is that session hijacking always means an offender visibly takes over the victim’s screen.

It may happen by stealing, replaying or otherwise abusing session material without controlling the device directly.

Possible routes include:

• malware stealing browser cookies
• interception of session data
• compromise of the browser profile
• remote control of the device
• abuse of weak session management
• use of copied application tokens.

Evidence may include:

• the same session appearing from different devices or locations
• account activity without a normal login
• unexpected changes within an existing session
• session identifiers associated with unfamiliar infrastructure
• malware or browser-theft artefacts
• provider alerts relating to token or session use.

Investigators should establish what the service means by “session”. Some providers record browser sessions, device sessions, application sessions or token families differently.

Do not assume that geographic change proves hijacking. VPNs, mobile networks, corporate proxies and cloud services can alter apparent location.

Likewise, the same account may legitimately be active on several devices.

Correlate the session with device, time, user-agent, application, authentication and account-action records.

Session hijacking may explain how an offender acted without knowing the password or satisfying multi-factor authentication again.

It does not identify who stole or used the session.

The account holder may also have left a device unlocked or shared access, which creates a different evidential picture.

Operational takeaway¶

Look for unauthorised use of an already authenticated session and correlate session identifiers, devices, locations and account actions before concluding hijacking occurred.