Tag

Session Cookies

All articles tagged with #session cookies

cybersecurity1 hour ago•3 min saved

BigBear 2.0 Phishing Service Skips MFA Across 258 Microsoft 365 Organizations

A CloudSEK report details BigBear 2.0, a phishing-as-a-service framework, bypassing MFA for 258 Microsoft 365 organizations and stealing 5,137 credentials (including 474 MFA-bypassed authentications) plus 4,148 session cookies across 3,331 victims in 40+ countries. The operation used a Evilginx2-based MITM setup with an 'offy' proxy, geo-matched residential proxies, and custom JavaScript to weaken FIDO2/WebAuthn, enabling attackers to hijack sessions after victims authenticated. The admin panel remained online while the phishing infrastructure was offline for ~three weeks. Recommendations include resetting exposed passwords, revoking active sessions, refreshing tokens, enforcing phishing-resistant FIDO2/WebAuthn, and applying Conditional Access with managed devices.

via BleepingComputer|

#cybersecurity #evilginx2 #mfa-bypass

technology26 days ago•5 min saved

Chrome adds hardware-backed session keys to curb account takeovers

Google Chrome is adding device-bound session credentials (DBSCs) that store a private key in hardware (TPM on Windows, Secure Enclave on macOS/iOS) to sign authentication challenges, making stolen session cookies useless for account takeover. Currently limited to a test rollout on Windows and macOS, the feature aims to reduce reliance on shared secrets and work alongside passkeys and 2FA; other Chromium-based browsers may adopt it as the standard progresses via the W3C.

via Ars Technica|

#authentication #chrome #dbsc

technology5 months ago•4 min saved

Chrome secures sessions by binding cookies to hardware, thwarting infostealer theft

Google Chrome 146 on Windows adds Device Bound Session Credentials (DBSC), cryptographically linking a user’s session to the device’s hardware (TPM on Windows, Secure Enclave on macOS) so stolen session cookies can’t be exploited. New short-lived cookies require possession of the hardware-bound private key, otherwise they expire quickly. macOS support is planned for a future Chrome release. The DBSC protocol, developed with Microsoft and tested with partners like Okta, aims to reduce cookie theft while preserving privacy, with implementation guidance and W3C specs available for developers.

via BleepingComputer|

#chrome #dbsc #hardware-security

technology1 year ago•1 min saved

Google Enhances Security with Passkeys and Updates to Combat Cyberattacks

Google Workspace is introducing a beta security feature called Device Bound Session Credentials (DBSC) to prevent session token theft, which has been on the rise and was exploited in attacks like the Linus Tech Tips account takeover. This feature binds session cookies to user devices, making it harder for attackers to steal login credentials through malware. Google also recommends enabling passkeys to enhance security, amid increasing cyber threats involving session hijacking.

via The Verge|

#cybersecurity #google-workspace #security-update