I cookie senza il flag di sicurezza possono essere rubati, anche se si accede solo tramite HTTPS?

Sì.

HTTPS previene gli attacchi MITM. Prendere in considerazione:

1) visiti link che rilascia un cookie sul tuo browser

2) quindi visiti link ma inserzioni MITM

<div style='visibility:hidden'>
   <iframe src='http://secure.example.com/'></iframe>
<div>

3) MITM annusa i cookie dalla richiesta sull'iframe

O anche se navighi (deliberatamente) da link a link quindi l'autore dell'attacco non ha nemmeno bisogno di iniettare codice HTML per annusare il cookie.

E poi c'è anche la possibilità della fissazione della sessione - dove anche se il cookie eliminato dal link ha il set di bandiere sicure, cioè no utilizzare se restituisce un ID di sessione ricevuto in un cookie non sicuro (nuovamente impostato tramite MITM).

Accetto con @symcbean, inoltre qui c'è una tecnica di fissaggio sessione interessante:

It’s been known for a long time that HTTP can set cookies that can be read in HTTPS space because cookies don’t follow the same origin policy in the way that JavaScript does. More importantly, HTTP cookies can overwrite HTTPS cookies, even if the cookies are marked as secure. I started thinking of a form of session fixation during our research that uses this to the attacker’s advantage. Let’s assume the attacker wants to get access to a user’s account that’s over SSL/TLS. Now let’s assume the website sets a session cookie prior to authentication and after authentication the site marks the cookie as valid for whatever username/password combo it receives.

First, the attacker goes to the website before the victim gets there so he can get a session cookie. Then, if the victim is still in HTTP for the same domain the attacker can set a cookie that will replay to the HTTPS website. So the attacker sets the same cookie that he just received into the victim’s browser. Once the victim authenticates, the cookie that the attacker gave the victim (and knows) is now valid for the victim’s account. Now if the victim was already authenticated or had already gotten a session token, no big deal. The attacker overwrites the cookie, which at worst logs the user out. Once the victim re-authenticates, voila - session fixation. Now all the attacker has to do is replay the same cookie in his own browser and he’s in the user’s account.

Articolo originale