cyber.hendryadrian.com
Threat Research · bleepingcomputer.com

VoidStealer Uses Hardware Breakpoints to Extract Chrome’s ABE Master Key

· Original article ↗

Summary

Gen Digital reports that VoidStealer uses hardware breakpoints and a debugger to capture Chrome’s plaintext v20_master_key from browser memory, bypassing Application-Bound Encryption without privilege escalation or code injection.

Key points

  • Gen Digital says VoidStealer is the first infostealer observed in the wild using a debugger-based ABE bypass.
  • The malware starts a suspended, hidden browser process, attaches as a debugger, and waits for chrome.dll or msedge.dll to load.
  • It scans the browser DLL for a specific string and related LEA instruction, then sets hardware breakpoints on browser threads.
  • When a breakpoint triggers during startup decryption, VoidStealer reads a register pointing to the plaintext v20_master_key and extracts it with ReadProcessMemory.
  • The technique requires no privilege escalation or code injection, according to the report.
  • Gen Digital says the method likely derives from the open-source ElevationKatz project; VoidStealer introduced the bypass in version 2.0.

Article Details

Attack Vectors
  • VoidStealer starts a suspended, hidden browser process and attaches to it as a debugger.
  • It scans the loaded browser DLL for a specific string and a referencing LEA instruction, then sets hardware breakpoints on browser threads.
  • When a breakpoint triggers during startup decryption, VoidStealer reads the register containing a pointer to the plaintext v20_master_key and extracts it with ReadProcessMemory.
Defensive Notes
  • Chrome's Application-Bound Encryption keeps the master key encrypted on disk and relies on the Google Chrome Elevation Service to validate requests to decrypt it.
  • The article reports that Google implemented fixes and improvements against earlier ABE bypasses, but newer malware versions reportedly continued to succeed using other methods.

MITRE ATT&CK

T1555.003 · Credentials from Web BrowsersVoidStealer bypasses Chrome's Application-Bound Encryption to obtain the browser master key used to decrypt protected browser data.

People

Vojtěch KrejsaGen Digital threat researcher who described VoidStealer's debugger-based ABE bypass.

Malware

VoidStealerVoidStealer, an infostealer seen in the wild, bypasses Chrome’s Application-Bound Encryption (ABE) by using hardware breakpoints to extract the v20_master_key directly from browser memory.

Vendors

Gen DigitalGen Digital identified this as the first in-the-wild infostealer using a debugger-based ABE bypass, likely derived from ElevationKatz.GoogleGoogle introduced ABE in Chrome 127 to protect master keys, but previous bypasses and demonstrated tools left exploitable weaknesses.

Products

Google ChromeVoidStealer, an infostealer seen in the wild, bypasses Chrome’s Application-Bound Encryption (ABE) by using hardware breakpoints to extract the v20_master_key directly from browser memory.

Tools

ChromeKatzinvent this technique but rather adopted it from the open-source project ‘ElevationKatz,’ part of the ChromeKatz cookie-dumping toolset that demonstrates weaknesses in Chrome.ElevationKatzmaster key, and uses ReadProcessMemory to steal it, a technique likely adopted from the open-source ElevationKatz project.

Related Articles