Google Chrome Implements Device Bound Session Credentials to Combat Cookie Theft

Google has launched Device Bound Session Credentials (DBSC) in Chrome 146 for Windows, aimed at preventing session cookie theft by infostealer malware. This security feature, which will extend to macOS in a future release, cryptographically binds session cookies to specific hardware, utilizing security chips like the Trusted Platform Module (TPM) and Secure Enclave. By generating unique public/private key pairs that cannot be exported, DBSC ensures that any exfiltrated session cookies quickly expire, rendering them useless to attackers. The DBSC protocol was developed in collaboration with Microsoft and tested with various web platforms, showing a notable decline in session theft incidents. Infostealer malware, such as LummaC2, has become increasingly sophisticated in harvesting session cookies, allowing unauthorized access to user accounts without passwords. The proactive nature of DBSC marks a significant shift from traditional reactive security measures. Google emphasizes that this approach mitigates the risks associated with session theft more effectively than previous methods.

Key Points: • DBSC protects session cookies by binding them to specific hardware, preventing theft. • Infostealer malware like LummaC2 exploits session cookies to access accounts without passwords. • The protocol has shown a decline in session theft incidents during its testing phase.