Google: device-bound sessions
Google announced Device Bound Session Credentials (DBSC), which binds a session to a key on the device that cannot be exported, to make stolen cookies worthless and remove the payoff from selling them. Google Chromium
The proof of identity a site leaves in the browser after sign-in to recognise the user, standing in for the password.
Once a user has signed in, the site does not ask for the password on every request; it checks the session identifier in the browser. According to OWASP, once a session is established the session ID is temporarily equivalent to the strongest authentication method the application uses; capturing it lets an attacker fully impersonate the user. OWASP
According to MITRE ATT&CK, authentication cookies can stay valid for a long time even when the application is not actively used; an attacker who obtains the cookie can import it into their own browser and act as the user for as long as the session remains active. MITRE ATT&CK
According to Google, because cookie theft happens after sign-in it bypasses two-step verification and other sign-in checks; stolen cookies keep working even after the malware is removed. Google Chromium
The user enters their password and, if required, a second-factor code; the site writes a session cookie to the browser. OWASP
An infostealer reads the browser’s cookie database and sends it out with the rest of the data. MITRE ATT&CK
The attacker loads the cookie into their own browser; the site takes them for the user. MITRE ATT&CK
Google announced Device Bound Session Credentials (DBSC), which binds a session to a key on the device that cannot be exported, to make stolen cookies worthless and remove the payoff from selling them. Google Chromium
We use cookies to ensure proper operation of our website, analyze usage, and deliver relevant content and advertisements. You can manage your preferences at any time. Cookie Policy