How hackers can use new technique to hijack your browser sessions, access your personal data
'CyberGuy': Big Brother in the Big Apple
NYC drivers face a $15 daily congestion fee for entering the toll congestion zone south of 60th Street, monitored by license plate readers. Kurt "CyberGuy" Knutsson gives the details.
A new exploit threat lets hackers access your Google account using expired cookies that contain your login information. The exploits, which were discovered late last year, target session cookies, which only have a limited lifespan. However, they can "revive" those cookies, putting your personal information at risk.
A hacker named PRISMA first revealed they found a way to bring back expired Google session cookies. Since then, cybersecurity firm CloudSEK discovered an exploit in a program that allows users to synchronize their Google accounts across multiple devices. Now, hackers are using that exploit to steal your login and other information. Here's a breakdown of how it all unfolded and how you can protect yourself.
Google Chrome start-up page (Kurt "CyberGuy" Knutsson)
Exploiting Google's MultiLogin
As reported by BleepingComputer, certain malware strains have discovered a backdoor into Google’s authentication system. The vulnerability lies in the MultiLogin endpoint, which remains undocumented and largely unknown to the public. This clandestine gateway enables threat actors to revive expired authentication cookies, granting unauthorized access to users’ Google accounts.
Google Chrome start-up page (Kurt "CyberGuy" Knutsson)
MORE: BEWARE OF THIS MCAFEE GOOGLE CHROME AD SCAM
The role of session cookies
Before we dive deeper, let’s understand the role of session cookies. These specialized browser cookies contain authentication information. If you’ve ever experienced the convenience of returning to a site without re-entering your credentials, you’ve encountered session cookies. However, their design intentionally limits their lifespan to prevent prolonged unauthorized access.
MORE: HOW GOOGLE'S DATA CAN MAKE YOU A SUSPECT IN A CRIME YOU DIDN'T COMMIT
The Lumma and Rhadamanthys connection
In November of last year, cybercriminals associated with the Lumma and Rhadamanthys info-stealing malware strains made a bold claim: they could resurrect expired Google Authentication cookies stolen during cyberattacks. Armed with these seemingly defunct cookies, a hacker gains entry to a victim’s Google account, even if the user has logged out, reset their password, or their session has expired.
PRISMA’s revelation
The exploit’s origins trace back to a Telegram post by a threat actor known as PRISMA. In October, they unveiled their discovery: a method to restore Google authentication cookies that had reached their expiration date. This revelation set the stage for further investigation.
CloudSEK’s investigation
Enter CloudSEK, a cybersecurity firm committed to predicting and preventing cyberattacks. Their researchers took on the challenge, reverse engineering the exploit. Their findings revealed that the MultiLogin endpoint served as the linchpin for the hackers. This undocumented feature facilitates account synchronization across various Google services, making it an ideal target for malicious actors' nefarious activities.
Google Chrome start-up page (Kurt "CyberGuy" Knutsson)
MORE: GOOGLE FINALLY ADMITS DATA COLLECTION IN CHROME'S INCOGNITO MODE
Protecting against MultiLogin exploit
The exploitation of MultiLogin raises serious concerns for those of you who are Google account holders. To safeguard against this threat, consider the following steps:
1) Sign out of the affected browser: Google is aware of this issue and has taken action to secure compromised accounts. Google's recommendation is to simply sign out of the affected browser to revoke session cookies.
2) Enhanced Safe Browsing: Enable Enhanced Safe Browsing in Chrome for additional protection against malware and phishing attacks.
On your computer:
- Open Google Chrome on your computer
- Click the initial in the top-right corner of the browser window
- Tap Manage your Google Account
- Click Security on the left
- Under Enhanced Safe Browsing for your account – make sure it is turned On
On your smartphone:
- Open Google Chrome on your computer
- Click the initial in the top-right corner of the browser window
- Tap Google Account
- Click Security
- Scroll down and under Enhanced Safe Browsing for your account – make sure it is turned On
3) Regularly change passwords: Regularly change your Google password to keep your account safe from hackers. If you struggle with creating new passwords, consider using a password manager.
4) Have good antivirus software on all your devices: The best way to protect yourself from having your data breached is to have antivirus protection installed on all your devices. Choose the best option for your PC, Mac, iPhone or Android smartphone. Having good antivirus software actively running on your devices will alert you of any malware in your system, warn you against clicking on any malicious links in phishing emails and ultimately protect you from being hacked. Get my picks for the best 2024 antivirus protection winners for your Windows, Mac, Android & iOS devices.
Kurt's key takeaways
In light of the recent exploits targeting Google accounts through resurrected session cookies, it's imperative to strengthen our defenses against such cyberthreats. From the initial discovery by PRISMA to the subsequent investigations by CloudSEK, the vulnerabilities in Google's MultiLogin endpoint have now been exposed.
To protect your account, ensure you sign out of affected browsers, enable Enhanced Safe Browsing, regularly update passwords, and have good antivirus software across all your devices. By implementing these security measures, you can thwart attempts to compromise your online privacy and safeguard your digital identities.
How important do you think it is for technology companies like Google to continually update and enhance their security protocols to protect you from evolving cyberthreats? Let us know by writing us at Cyberguy.com/Contact.
For more of my tech tips & security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter.
Ask Kurt a question or let us know what stories you'd like us to cover.
Answers to the most asked CyberGuy questions:
- What is the best way to protect your Mac, Windows, iPhone and Android devices from getting hacked?
- What is the best way to stay private, secure and anonymous while browsing the web?
- How can I get rid of robocalls with apps and data-removal services?
Copyright 2024 CyberGuy.com. All rights reserved.
Kurt "CyberGuy" Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on "FOX & Friends." Got a tech question? Get Kurt’s CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.
