Cybersecurity experts have unveiled a technique that exploits the Chrome DevTools Protocol (CDP) within active Google Chrome or Microsoft Edge processes on Windows. This method allows attackers to access cookies, stored data, and authenticated sessions in these browsers.
Post-Exploitation Technique Details
This approach requires the attacker to have prior code execution capabilities on a Windows system, bypassing the need to exploit any inherent vulnerabilities in Chrome or Edge. It is significant in post-compromise scenarios rather than being a remotely exploitable flaw.
According to SpecterOps, defenders could identify process injection targeting chrome.exe and msedge.exe through Sysmon Event IDs 8 and 10. These events are crucial for detecting suspicious activities related to browser processes.
Chrome’s Response to Increasing Threats
Google has observed a rise in attacks using Chrome’s Remote Debugging to extract cookies since the introduction of App-Bound Encryption. In response, Chrome version 136 altered its remote debugging behavior to ignore certain switches unless a non-standard data directory is used, ensuring data protection with different encryption keys.
SpecterOps reports that the CDP-Enable-BOF takes an alternative approach by activating the debugging server from within an existing browser process, exposing the browser’s context via a requested CDP port.
Browser Takeover and Detection
Once a browser endpoint is accessible, SpecterOps’ CDP-Toolkit can interact with or automate the browser’s internal surfaces. Key post-exploitation workflows include cookie collection, browser data retrieval, saved-password recovery, and browser takeover through interactive screencasting or proxying requests.
Google’s Device Bound Session Credentials, introduced with Chrome 146, aim to prevent stolen cookies from being reused on different devices. However, operating within the authenticated browser context can bypass these protections.
Version-Specific Considerations
Microsoft’s Sysmon documentation highlights Event ID 8 for code injection detection and Event ID 10 for process access logging. These events are pivotal for filtering out expected activities from suspicious ones.
The public BOF currently supports Chrome 147.0.7727.102 and Edge 147.0.3912.98, with later versions requiring new signature derivations for continued compatibility. The disclosure follows the reveal of AmnesiaStealer, a threat targeting macOS with similar capabilities.
In conclusion, while the potential for session hijacking in Windows browsers via Chrome DevTools is significant, understanding detection methods and updates to browser security protocols is crucial in mitigating such threats.
