Chrome Rolls Out Device-Bound Session Credentials to Protect Google Accounts
Summary
Google says Chrome’s DBSC feature is generally available and rolling out to Google account users. It binds session cookies to device hardware keys, making stolen cookies less useful for account takeover.
Key points
- Google says Device Bound Session Credentials (DBSC) is generally available and rolling out to Workspace customers, Workspace Individual subscribers, and users with personal Google accounts.
- DBSC cryptographically binds session cookies to the device used to authenticate, using security hardware such as a Windows TPM or Apple Secure Enclave.
- Google says stolen cookies cannot be used without access to the device-bound cryptographic keys, reducing the risk of session theft and account takeover.
- DBSC will be enabled by default for Google Workspace customers, and administrators cannot disable it.
- The article says Lumma and Rhadamanthys operations have claimed they could restore expired stolen Google authentication cookies; it does not independently verify those claims.
- Google previously advised removing malware from affected devices and enabling Chrome Enhanced Safe Browsing to help defend against phishing and malware.
Article Details
- Event Type
- Google Chrome's Device Bound Session Credentials (DBSC) feature has become generally available and is rolling out to users.
- Impact
- DBSC binds session cookies to cryptographic keys held by a user's device security hardware, making stolen cookies less useful for account takeover. Google says the feature reduces the risk of session theft even when malware is present. It is enabled by default for Google Workspace customers, and administrators cannot disable it.
MITRE ATT&CK
Malware
LummaThe feature makes stolen cookies far less useful to attackers, including groups behind Lumma and Rhadamanthys, because the required cryptographic keys stay tied to the device’s security hardware.RhadamanthysThe feature makes stolen cookies far less useful to attackers, including groups behind Lumma and Rhadamanthys, because the required cryptographic keys stay tied to the device’s security hardware.
Vendors
Products
Google ChromeGoogle says Chrome Device Bound Session Credentials (DBSC) is now generally available and rolling out to protect Google accounts from takeover by binding session cookies to a specific device.Google WorkspaceDBSC is enabled by default for Google Workspace customers and cannot be disabled by administrators.