Chrome Protection: App-Bound Encryption For Cookies Added

Ensuring a safe browsing experience for its users, Google has announced that it’s adding a new app-bound encryption layer to Chrome. As per media reports, the added layer will help prevent information-stealing malware from grabbing cookies. In this article, we’ll cover the app-bound encryption layer in detail and see how it ensures protection. Let’s begin!

Google’s App-Bound Encryption Layer

The app-bound encryption layer from Google is an improvement pertaining to the data protection API (DPAPI). Reports claim that the encryption layer basically encrypts the identity of an application, which ensures that other apps on the system can not access it. Providing further details, Will Harris from the Chrome security team has stated that:

“On Windows, Chrome uses the Data Protection API (DPAPI), which protects the data at rest from other users on the system or cold boot attacks. However, the DPAPI does not protect against malicious applications able to execute code as the logged in user – which info-stealers take advantage of. ”

As a result of the layer, the service now operates with system privilege. What this essentially means is that threat actors would now need to gain access to the privilege to inject code into Chrome. It’s worth mentioning here that such an initiative from hackers could previously have been carried out by tricking users into running a malicious app.

Practices For Increased Security

As far as increasing security with the additional encryption layer is concerned, it’s essential to know that the method binds the encryption key to the machine. With such a protocol, it will not function if a Chrome profile roams among multiple machines.

That said, organizations that support roaming should follow the best practices and configure accordingly. It’s worth mentioning here that the update recently went live last week. The app-bound encryption layer currently offers protection only for cookies.

However, Google does have intentions of expanding the protection to passwords, payment data, and other persistent authentication tokens. Commenting on the effectiveness of the technique, Will Harris has said that:

“App-bound encryption increases the cost of data theft to attackers and also makes their actions far noisier on the system. It helps defenders draw a clear line in the sand for what is acceptable behavior for other apps on the system.”

The encryption layer is a development that has surfaced alongside other initiatives aimed at making the browsing experience more secure. Some of these initiatives include Safe Browsing, Device Bound Session Credentials (DBSC), and automated scans that are initiated when suspicious downloads are triggered.

Such initiatives are a major step toward lowering the risk of exposure to online threats and can help both individual and organizational users improve their security posture.

Conclusion

Google’s new app-bound encryption layer marks a significant leap in Chrome’s security, protecting cookies from info-stealing malware. By binding encryption keys to the machine and enhancing system privileges, this update, along with other security initiatives, ensures a safer browsing experience, reinforcing the fight against online threats.

Given that online threats are becoming more technologically sophisticated, using proactive security measures in a bid to safeguard against them is essential.

The sources for this piece include articles in The Hacker News and Bleeping Computer.