Chrome binds sessions to the device, making stolen cookies useless

Session theft usually happens when infostealer malware extracts existing session cookies from a browser, or waits for the user to log in to new accounts, then exfiltrates the tokens to an attacker-controlled server. Families such as LummaC2 have become increasingly effective at this. Google now reports that Device Bound Session Credentials (DBSC) is reaching general availability for Windows users on Chrome 146, with macOS following in an upcoming release. DBSC binds a session cryptographically to a specific device using hardware-backed security, the TPM on Windows and the Secure Enclave on macOS, generating a key pair that cannot be exported. New short-lived session cookies are only issued when Chrome proves possession of the private key. Cookies that are stolen anyway expire quickly and become useless.

What this means for your organisation

Stolen session cookies are one of the few techniques that walk straight past multi-factor authentication, because the user has already authenticated. This is how a great many account compromises actually begin. DBSC is therefore one of the more meaningful controls to arrive in a while, but it only works where the browser, the hardware and the service all support it. The benefit arrives gradually, and depends on your client estate being current.

Berigo recommends

• Ensure Chrome updates automatically and that the TPM is enabled across your Windows machines.
• Ask the vendors behind your most important cloud services when they plan to support DBSC.
• Keep treating infostealer detections as account compromise incidents, not just malware cleanup.
• Continue monitoring for unexpected sessions and logins from unknown devices while the technology rolls out.

Source

• security.googleblog.com