Killing Session Theft: Device Bound Session Credentials using ASP.NET Core

Infostealer malware doesn't need your password if it can steal your authentication cookie from disk or memory, and replay it on another machine. Any webserver happily accepts the stolen cookie since it was issued by the webserver itself. This type of attack bypasses WebAuthn or MFA entirely, since the cookie gets stolen after you have authenticated. Since there's no real fix against this, we can only issue cookies with a shorter lifetime to minimize the attack window. Until now. Device Bound Session Credentials (DBSC) is a W3C draft introducing a solution, by tying the session cookie to the browser or device. The browser generates a private/public key pair, storing the private key ideally in secure storage like a TPM, while the webserver only issues short-lived authentication cookies. When the cookie expires, the browser can then only refresh the cookie by signing a server-issued challenge using that private device-specific key. While this doesn't prevent cookie and session theft, it does minimize the risk since cookies go stale faster and cannot be renewed without the device's private key. During this session, I'll demonstrate how DBSC works by showing an example implementation in ASP.NET Core, adding the necessary endpoints to safely register and refresh DBSC-enabled session cookies.

Speakers

Wesley Cabus