cyber.hendryadrian.com
Security News · bleepingcomputer.com

Vercel Rolls Out Device-Bound Sessions to Prevent Stolen Cookie Reuse

· Original article ↗

Summary

Vercel is gradually rolling out device-bound session credentials that use a TPM-stored key to prevent stolen cookies from being reused on another device. It also launched a beta code-review feature that flags security issues.

Key points

  • Device Bound Session Credentials (DBSC) binds Vercel platform login sessions to a device using a private key stored in its TPM.
  • Vercel says the key signs the session cookie and cannot be retrieved, preventing a stolen cookie from being reused on another device.
  • DBSC currently works in Chrome on macOS and Windows; Vercel is rolling it out gradually while addressing OAuth app edge cases.
  • Vercel is separately rolling out DPoP protection for the Vercel CLI.
  • Security Review, in public beta for Pro and Enterprise teams, scans code changes on each push to connected GitHub repositories when enabled.
  • Security Review can flag missing authorization checks and exposed secrets; Vercel Agent may validate and commit fixes if permissions allow.

Article Details

Event Type
Vercel security feature rollout and public-beta launch
Impact
Vercel is gradually enabling Device Bound Session Credentials (DBSC), which binds a login session to a private key stored in the user's device TPM to prevent a stolen session cookie from being reused on another device. DBSC currently works with Chrome on macOS and Windows; Vercel says the gradual rollout will help address OAuth edge cases. Vercel is also rolling out DPoP for its CLI. Its Security Review feature, in public beta for Pro and Enterprise teams, scans code changes pushed to connected GitHub repositories for issues such as missing authorization checks and exposed secrets; Vercel Agent can validate and commit fixes when permissions allow. Separately, Vercel reported that an April breach affected a subset of customers and exposed environment variables not marked as sensitive after an attacker accessed internal systems through an employee's Google Workspace account at Context.ai.

MITRE ATT&CK

T1539 · Steal Web Session CookieThe article describes information-stealer malware stealing browser session cookies, the behavior DBSC is intended to mitigate.

People

Malte UblVercel's CTO announced DBSC and explained how its device-bound private key protects session cookies; he also said Vercel's security team had used Security Review internally before its broader release.

Vendors

GoogleIn April, Vercel suffered a security breach impacting a subset of customers, in which attackers gained access to its systems by compromising an employee's Google Workspace account at Context.ai.VercelVercel rolls out new protection against stolen session cookie attacks

Products

Google ChromeVercel's DBSC rollout also complements Chrome's App-Bound Encryption, which makes it harder for infostealer malware to extract browser cookies.Google WorkspaceIn April, Vercel suffered a security breach impacting a subset of customers, in which attackers gained access to its systems by compromising an employee's Google Workspace account at Context.ai.Security ReviewSecurity Review also landsVercel AgentEarlier this week, Vercel launched Security Review in public beta for Pro and Enterprise teams, adding a feature to Vercel Agent that scans code changes on every push to connected GitHub repositories once enabled.Vercel CLISeparately, Vercel is rolling out a similar protective technology called DPoP for the Vercel CLI.

Related Articles