Chrome Will Protect Accounts from Session Cookie Theft

Google has added a feature to the Chrome browser that, in experts' assessment, could seriously complicate one of today's most popular methods of account hijacking — the theft of session cookies. The technology is called device-bound session credentials (DBSC).

Why It Was Needed

Session cookies are unique strings that a site stores in the browser after a successful login, so that it doesn't have to ask for the password on every page. As two-factor authentication, passkeys and similar measures have spread, simply stealing a password has stopped being effective: a single “shared secret” is no longer enough.

In response, attackers switched to stealing the session cookies themselves — using infostealers and adversary-in-the-middle attacks. A stolen cookie need only be pasted into the attacker's own browser to gain the same access as the legitimate owner — at least for a while.

How DBSC Works

DBSC stores a unique encryption key in a hardware “vault” built into the device: on Windows this is the TPM module, on macOS and iOS it's the Secure Enclave, and other platforms have their own equivalents. Once a site has set a session cookie, the browser is required to send a version of it signed with the key from that store.

The point is that extracting the private key from a TPM or Secure Enclave is impossible. As researcher Scott Helme, founder of Report URI, explains, an attacker can still steal the cookie but won't be able to answer the DBSC challenge, because it has to be signed with the private key, which stays on the device. The scheme mirrors the logic of passkeys: the server stores the user's public key and sends a challenge along with the session cookie, and the response is accepted only if it is signed with the private key from the hardware store.

Not Quite a Silver Bullet

For now DBSC is supported only in Chrome version 147 for Windows and 150 for macOS, and even then it's enabled for a limited group of users — evidently Google is testing the feature before a mass rollout. You can check whether the protection is working through the developer tools: on the Application tab, a “device bound sessions” entry appears when you log in to a supporting site.

Whether DBSC will be implemented in other Chromium-based browsers is not yet known, but it's considered likely. The technology is being developed as a W3C draft standard. That said, the developers themselves add a caveat: if an attacker interferes with the browser's operation at the moment the session is being registered, they can bind it to a TPM under their own control or to keys that aren't hardware-protected at all. So DBSC noticeably raises the bar, but it is not a universal cure for account hijacking.

Source: Ars Technica