A new exploit threat lets hackers access your Google account using expired cookies that contain your login information. The exploits, which were discovered late last year, target session cookies, which only have a limited lifespan. However, they can “revive” those cookies, putting your personal information at risk.
A hacker named PRISMA first revealed they found a way to bring back expired Google session cookies. Since then, cybersecurity firm CloudSEK discovered an exploit in a program that allows users to synchronize their Google accounts across multiple devices. Now, hackers are using that exploit to steal your login and other information. Here’s a breakdown of how it all unfolded and how you can protect yourself.
Exploiting Google’s MultiLogin
As reported by BleepingComputer, certain malware strains have discovered a backdoor into Google’s authentication system. The vulnerability lies in the MultiLogin endpoint, which remains undocumented and largely unknown to the public. This clandestine gateway enables threat actors to revive expired authentication cookies, granting unauthorized access to users’ Google accounts.
MORE: BEWARE OF THIS MCAFEE GOOGLE CHROME AD SCAM
The role of session cookies
Before we dive deeper, let’s understand the role of session cookies. These specialized browser cookies contain authentication information. If you’ve ever experienced the convenience of returning to a site without re-entering your credentials, you’ve encountered session cookies. However, their design intentionally limits their lifespan to prevent prolonged unauthorized access.
MORE: HOW GOOGLE’S DATA CAN MAKE YOU A SUSPECT IN A CRIME YOU DIDN’T COMMIT
The Lumma and Rhadamanthys connection
In November of last year, cybercriminals associated with the Lumma and Rhadamanthys info-stealing malware strains made a bold claim: they could resurrect expired Google Authentication cookies stolen during cyberattacks. Armed with these seemingly defunct cookies, a hacker gains entry to a victim’s Google account, even if the user has logged out, reset their password, or their session has expired.
PRISMA’s revelation
The exploit’s origins trace back to a Telegram post by a threat actor known as PRISMA. In October, they unveiled their discovery: a method to restore Google authentication cookies that had reached their expiration date. This revelation set the stage for further investigation.
CloudSEK’s investigation
Enter CloudSEK, a cybersecurity firm committed to predicting and preventing cyber attacks. Their researchers took on the challenge, reverse engineering the exploit. Their findings revealed that the MultiLogin endpoint served as the linchpin for the hackers. This undocumented feature facilitates account synchronization across various Google services, making it an ideal target for malicious actors nefarious activities.
MORE: GOOGLE FINALLY ADMITS DATA COLLECTION IN CHROME’S INCOGNITO MODE
Protecting against MultiLogin exploit
The exploitation of MultiLogin raises serious concerns for those of you who are Google account holders. To safeguard against this threat, consider the following steps:
1) Sign out of the affected browser: Google is aware of this issue and has taken action to secure compromised accounts. Google’s recommendation is to simply sign out of the affected browser to revoke session cookies.
2) Enhanced Safe Browsing: Enable Enhanced Safe Browsing in Chrome for additional protection against malware and phishing attacks.
On your computer:
-
- Open Google Chrome on your computer
- Click the initial in the top-right corner of the browser window
- Tap Manage your Google Account
- Click Security on the left
- Under Enhanced Safe Browsing for your account – make sure it is turned On
On your smartphone:
-
- Open Google Chrome on your computer
- Click the initial in the top-right corner of the browser window
- Tap Google Account
- Click Security
- Scroll down and under Enhanced Safe Browsing for your account – make sure it is turned On
3) Regularly change passwords: Regularly change your Google password to keep your account safe from hackers. If you struggle with creating new passwords, consider using a password manager.
4) Have good antivirus software on all your devices: The best way to protect yourself from having your data breached is to have antivirus protection installed on all your devices. Choose the best option for your PC, Mac, iPhone, or Android smartphone. Having good antivirus software actively running on your devices will alert you of any malware in your system, warn you against clicking on any malicious links in phishing emails, and ultimately protect you from being hacked.
Special for CyberGuy Readers: My #1 pick is TotalAV, and you can get a limited-time deal for CyberGuy readers: $19 your first year (80% off) for the TotalAV Antivirus Pro package.
Kurt’s key takeaways
In light of the recent exploits targeting Google accounts through resurrected session cookies, it’s imperative to strengthen our defenses against such cyber threats. From the initial discovery by PRISMA to the subsequent investigations by CloudSEK, the vulnerabilities in Google’s MultiLogin endpoint have now been exposed.
To protect your account, ensure you sign out of affected browsers, enable Enhanced Safe Browsing, regularly update passwords, and have a good antivirus software across all your devices. By implementing these security measures, you can thwart attempts to compromise your online privacy and safeguard your digital identities.
How important do you think it is for technology companies like Google to continually update and enhance their security protocols to protect you from evolving cyber threats? Let us know in the comments below.
FOR MORE OF MY SECURITY ALERTS, SUBSCRIBE TO MY FREE CYBERGUY REPORT NEWSLETTER HERE
Copyright 2024 CyberGuy.com. All rights reserved. CyberGuy.com articles and content may contain affiliate links that earn a commission when purchases are made.