Google has officially made available Device Bound Session Credentials (DBSC) for all Windows users using Chrome v146! This is a significant development in the fight against session theft of users by theft.
With the rollout of DBSC, stolen session cookies will become pretty much valueless to attackers. The DBSC feature was in open beta format for a while before being made available to all users; a Mac version of this feature is anticipated to roll out soon.
What is session theft?
Session theft is when malware that steals information (like the following - Atomic, Lumma, or Vidar Stealer) extracts session cookies from a user’s browser. Session cookies can remain valid for a long time, so when stolen, the attacker can access the victim’s account without needing their password. Session cookies are often sold on the dark web for future use by other criminals.
How DBSC Works
DBSC associates authentication sessions with a specific device; therefore, by using spoofing-resistant hardware-backed security:
1. Windows uses TPM
2. macOS uses the Secure Enclave
After logging in, Chrome will create a unique public/private key pair which cannot be copied off of that device - this means the server will issue a session cookie (which is valid for a short period of time) only while Chrome can demonstrate ownership of the related private key.
If an attacker were able to steal the session cookies using malware, they would be completely worthless because the attacker would not be able to prove they own the private key which is bound to that device - therefore, they would simply be expired and no longer work.
If a user's device does not support secure key storage, DBSC will revert to normal session functionality but will not negatively impact the user experience.
Positive Early Results
Since the launch of this feature in beta, Google has reported a marked decrease in successful attempts to steal sessions. Google and Microsoft have collaborated on the development of DBSC with the intention of establishing it as an open standard on the web.
The design of DBSC specifically accounts for privacy in the following ways:
1. No device identifiers or attestation data are leaked
2. No cross-site tracking or finger-printing of devices is possible
3. The minimum necessary to maintain session integrity will be shared.
What This Means for Users and Organizations
To consumers, DBSC provides average users better protections from cookie stealing malware without requiring any additional steps. The use of DBSC also provides companies, and especially those leveraging Chrome Enterprise, an additional layer of protection against account compromise and lateral movement once compromised.
Recommendations
1. Upgrade Chrome to version 146 or higher for all Windows devices
2. Make sure you have automatic updates turned on, so that you get your security improvements quickly
3. Combine DBSC with other best practices to further strengthen your security: use strong, unique passwords and enable multi-factor authentication (preferably using hardware) along with keeping endpoint protection current
This rollout marks substantial advancement toward the continuous fight against session hijacking. Attackers continue to improve the malware they use to steal information, therefore the DBSC feature based on hardware security will be key as well.
Going forward, Google expects to continue expanding the capabilities of DBSC and will be building other enterprise features into the DBSC functionality.
Source : The Hacker News
