The Python-based tool is the brainchild of reverse engineer Mike Perry, who spoke about HTTPS cookie hijacking at the Defcon 16 security conference in Las Vegas in August. Though Perry has put off making the tool available to the general public, he recently posted more details explaining how the tool works on his blog, which prompted the SANS Institute to give a heads-up.

With HTTPS cookies in their metaphorical jar, cyber-crooks could potentially access online accounts. In an overview, Perry described CookieMonster as an automated tool that can be configured to steal the cookies for a specific list of domains for every client IP on the local network. The tool is also able to compromise arbitrary insecure SSL (Secure Sockets Layer) sites without the need to provide such a target list.

"Basically, [the issue] revolves around the fact that cookies have two modes: secure and insecure," Perry wrote in a blog post. "If a cookie is insecure, a browser will transmit it for plain old HTTP connections, and an active attacker can then inject a set of HTTP images for sites that they want cookies for, and the browser will happily transmit cookies for these sites unencrypted, allowing their capture."

Read the rest of this article on eWEEK.com.