# Fighting cookie theft using device bound sessions

DevFeed: [Fighting cookie theft using device bound sessions](<https://devfeed.tech/articles/fighting-cookie-theft-using-device-bound-sessions-4181.md>)

Original publisher: [Read original article](<https://blog.chromium.org/2024/04/fighting-cookie-theft-using-device.html>)

Author: Chromium Blog (noreply@blogger.com)

Published: 2024-04-02T16:06:00Z

Content type: article

Language: en

Sources: [Chromium Blog](<https://devfeed.tech/sources/chromium-blog.md>)

Topics: [Docro Hijacker](<https://devfeed.tech/topics/docro-hijacker.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [Chrome](<https://devfeed.tech/topics/chrome.md>), [Web](<https://devfeed.tech/topics/web.md>), [Social engineering](<https://devfeed.tech/topics/social-engineering.md>), [API](<https://devfeed.tech/topics/api.md>), [GitHub](<https://devfeed.tech/topics/github.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [browser](<https://devfeed.tech/tags/browser.md>), [chrome](<https://devfeed.tech/tags/chrome.md>), [github](<https://devfeed.tech/tags/github.md>), [malware](<https://devfeed.tech/tags/malware.md>), [none](<https://devfeed.tech/tags/none.md>), [on-device](<https://devfeed.tech/tags/on-device.md>), [open](<https://devfeed.tech/tags/open.md>), [privacy](<https://devfeed.tech/tags/privacy.md>), [social-engineering](<https://devfeed.tech/tags/social-engineering.md>), [web](<https://devfeed.tech/tags/web.md>)

## AI overview

The article explains how cookie-stealing malware extracts authentication cookies from browsers, allowing attackers to bypass protections such as two-factor authentication. It presents Device Bound Session Credentials (DBSC), an open web capability that binds authentication sessions to a device so stolen cookies become less useful and on-device detection and cleanup become more effective.

## Source excerpt

Cookies - small files created by sites you visit - are fundamental to the modern web. They make your online experience easier by saving browsing information, so that sites can do things like keep you signed in and remember your site preferences. Due to their powerful utility, cookies are also a lucrative target for attackers. Many users across the web are victimized by cookie theft malware that gives attackers access to their web accounts. Operators of Malware-as-a-Service (MaaS) frequently use social engineering to spread cookie theft malware. These operators even convince users to bypass multiple warnings in order to land the malware on their device. The malware then typically exfiltrates all authentication cookies from browsers on the device to remote servers, enabling the attackers to curate and sell the compromised accounts. Cookie theft like this happens after login, so it bypasses two-factor authentication and any other login-time reputation checks. It's also difficult to mitigate via anti-virus software since the stolen cookies continue to work even after the malware is detected and removed. And because of the way cookies and operating systems interact, primarily on desktop operating systems, Chrome and other browsers cannot protect them against malware that has the same level of access as the browser itself. To address this problem, we're prototyping a new web capability called Device Bound Session Credentials (DBSC) that will help keep users more secure against cookie theft. The project is being developed in the open at github.com/WICG/dbsc with the goal of becoming an open web standard. By binding authentication sessions to the device, DBSC aims to disrupt the cookie theft industry since exfiltrating these cookies will no longer have any value. We think this will substantially reduce the success rate of cookie theft malware. Attackers would be forced to act locally on the device, which makes on-device detection and cleanup more effective, both for anti-vi