Google has announced new 2FA bypass protection for some Chrome users.
getty
While two-factor authentication is a highly recommended additional layer of login protection for your accounts, it is not invulnerable to attack. Indeed, Microsoft has confirmed that a widespread 2FA bypass attack is ongoing right now. The good news is that Google has announced that its new Device Bound Session Credentials protection has entered public availability for people using the Chrome 146 browser on Windows. DBSC helps to prevent what is known as session cookie theft, the method by which most 2FA bypass attacks operate, by cryptographically binding authentication sessions to your device. On Windows, this is achieved by the Trusted Platform Module which employs hardware-backed security measures. Here’s what you need to know.
ForbesAngry Hacker Drops Microsoft Zero-Day Exploit, 1 Billion Users Warned
You might be surprised to learn that an astonishing 94 billion stolen browser cookies are available to users of the dark web. Although the exact current number is unknown, it was reported last year that at least 17 billon session cookies were stolen in 2024 alone. And that’s a problem, a mighty big one.
Here’s the shocking truth: attackers don’t actually need your 2FA code to gain access to your accounts, if they have that session cookie instead. The data contained within a session cookie includes a flag that says 2FA has already been completed, meaning that as long as you have the cookie, then that session will be authenticated. Threat actors will employ attacker-in-the-middle techniques to capture a session cookie after a victim has completed the initial password login and 2FA verification.
Google wants to stop that. A new announcement from Benjamin Ackerman, a Chrome product manager at Google, has now confirmed that its Device Bound Session Credentials protection is “now entering public availability for Windows users on Chrome 146, and expanding to macOS in an upcoming Chrome release.”
The results of session cookie theft, largely driven by infostealer malware families, are often bundled, traded, or sold among threat actors, Ackerman warned. “Crucially,” Ackerman continued, “once sophisticated malware has gained access to a machine, it can read the local files and memory where browsers store authentication cookies.” This results in there being no really reliable method of preventing such cookie exfiltration by software alone. Until now, that is, Google said.
ForbesGoogle Issues Critical Update Alert For 3.5 Billion Chrome UsersBy Davey Winder“DBSC fundamentally changes the web's capability to defend against this threat by shifting the paradigm from reactive detection to proactive prevention,” the announcement claimed, “ensuring that successfully exfiltrated cookies cannot be used to access users’ accounts.”
It does this by binding authentication sessions, cryptographically, to a specific device using the Windows TPM to generate a unique public/private key pair that cannot be exported from the machine. Because attackers cannot steal the corresponding private key to the server, in the possession of Chrome, Ackerman explained, “any exfiltrated cookies quickly expire and become useless to those attackers.”
If you are a web developer looking to protect users against session theft, you can refer to the Google developer guide for implementation details.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。