Google Chrome adds session cookie theft protection for all users
Google has launched a new security feature, Device Bound Session Credentials (DBSC), for Chrome to protect users from session cookie theft and subsequent account takeovers. This feature cryptographically links session cookies to a device's security chip, making it significantly harder for attackers to utilize stolen cookies for unauthorized access. The rollout is being implemented across all Google accounts and Workspace users, addressing a previously exploited vulnerability.
The DBSC feature addresses a growing threat landscape where attackers have leveraged vulnerabilities in Google's OAuth API, specifically the 'MultiLogin' endpoint, to steal and reactivate expired authentication cookies. Groups like Lumma and Rhadamanthys have exploited these weaknesses to gain access to user accounts. This new mechanism fundamentally shifts the approach to security, moving from reactive detection to proactive prevention by utilizing the device's hardware security features, such as TPM and Secure Enclave, to generate and manage cryptographic keys.
Google is rolling out DBSC as a default setting for all Google Workspace customers, ensuring immediate protection. The feature’s effectiveness lies in its ability to prevent attackers from obtaining the necessary keys to decrypt and utilize stolen session cookies. This proactive measure significantly reduces the risk of account compromise, even in the presence of malware on the user's device.
While automated pentesting tools remain valuable, this update focuses on bolstering the security of Google's ecosystem by directly addressing the exploitation of stolen session cookies. Google’s recommendations regarding malware removal and Enhanced Safe Browsing remain relevant as a secondary layer of defense.