Info-stealers can steal cookies for permanent access to your Google account
Hackers have found a way to gain unauthorized access to Google accounts, bypassing any multi-factor authentication (MFA) the user may have set up. To do this they steal authentication cookies and then extend their lifespan. It doesn’t even help if the owner of the account changes their password.
Since the discovery of the exploit, numerous white and black hat security researchers have looked into and discussed the issue. As a result, the exploit is now built into various information stealers.
Cookies are used to track users across websites and remember information about their visit. Authentication cookies are in essence pieces of data that the browser sends to a site to identify the user and check whether they are logged in. Usually these cookies have an expiration date after which the user will be asked to log in.
Persistent cookies enable a continuous access to Google services, even after the user resets their password. This exploit allows the generation of persistent Google cookies by using a Google Application Programming Interface (API) designed for synchronizing accounts across different Google services to bring back to life expired authentication cookies.
A Google account provides access to Google services like Gmail, Google Calendar, and Google Maps, but also Google Ads and YouTube.
In a statement Google responded:
However, some info stealers have
You must be registered for see links
already been updated to counter Google’s fraud detection measures.Sources familiar with this issue have told
You must be registered for see links
that Google believes the API is working as intended and and that no vulnerability is being exploited by the malware, which implies that Google isn’t working on a more permanent fix for this problem.Review devices
To check whether someone has accessed your account, you can view which computers, phones, or other devices that were signed in to your Google Account recently.- Go to your Google Account.
- On the left navigation panel, select Security .
- On the Your devices panel, select Manage all devices.
- You’ll see devices where you’re currently signed in to your Google Account or have been in the last few weeks. For more details, select a device or a session.
- Devices or sessions where you’re signed out will have a “Signed out” indication.
- If multiple sessions appear for the same device type, they might all be on one device or multiple devices. Review their details, and if you’re not sure all the sessions are from your devices, sign out on them.
Remediate
If you think your account has been compromised, you will have to sign out of all browsers to invalidate the current session tokens and then reset your password. Next you will need to sign back in to generate new tokens. Only this stops the unauthorized access because it invalidates the old tokens.The steps outlined below are for administrators who manage Google Accounts for a company, school, or other group. As an administrator, you can sign a user out of a managed Google Account, such as Google Workspace or Cloud Identity.
To reset a user’s sign-in cookies:
-
You must be registered for see linksto your Google Admin console. Sign in using an administrator account, not your current account.
- In the Admin console, go to Menu > Directory > Users.
- In the Users list, find the user. If you need help, go to
You must be registered for see links.
- Click the user’s name to open the user’s account page.
- Click Security > Sign-in cookies > Reset.
From: MalwarebyteLabs
Last edited by a moderator:
From that point on, you will not be asked for a password which also makes life easier as... it's your PC and that is how it should be. Since the account is locked to specific devices, even if someone steals your cookies they can't be used since the account authentication can see it is not your PC. Google uses a FIDO key which is also resistant to phishing and offers way higher protection and is only comparable to hardware USB keys.
