Get a demo

Alert Status:  High

Affected Solution: Any Web Application that Creates Cookies for Authentication

Browser cookies enable web applications to store user authentication information, so a user can stay signed in instead of having to supply their username and password every time they navigate to a new page on a website. 

If someone were able to extract the right browser cookies, they could authenticate as another user in a separate web browser session on another system. In short, they could use the cookie to bypass authentication via MFA. (This is analogous to the Pass the Hash attack in Active Directory.) 

The CISA (Cybersecurity and Infrastructure Security Agency) and New Jersey Cybersecurity and Communications Integration Cell (NJCCIC) have released an announcement regarding this attack, providing the necessary recommendations for mitigation:

https://www.cisa.gov/news-events/analysis-reports/ar21-013a
https://www.cyber.nj.gov/garden_state_cyber_threat_highlight/pass-the-cookie-attacks-gain-traction

What should you do? 

Pass-the-cookie attacks can occur at any time once a user’s machine has been compromised. User credentials are also not required as the cookies already store this information to access web applications the user regularly visits. We recommend the following to mitigate risk imposed from these attacks:

  • Restrict access to the cloud to authorized devices protected by ActZero only; this will prevent risk imposed by BYOD users which do not have a corporate EDR solution implemented on their device
  • Follow best practices for zero trust within Azure: Azure Zero-Trust 
  • Implement mandatory requirement of devices to join the AD domain to ensure protection from ActZero which can block cookie theft
  • Implement conditional based policies to restrict access to resources to authorized geolocations only: Conditional Access Policy
  • Configure Azure session management to disable persistence of browser cookies when browser sessions close
  • Disable legacy protocols such as POP3 which allows older mail clients to send and receive email using your email server; disabling these protocols will prevent stolen credentials from being used to access mailboxes outside your corporate network 

What is the risk?

Once a user’s machine has been compromised, the attacker has direct access to dump the stored browser cookies and steal the user’s credentials saved for accessing web applications. The usage of Mimikatz can easily execute this action by dumping this data. Once obtained, the attacker can then inspect the stolen session to identify the targeted web application, then it’s just a matter of inserting the browser cookies into the browser application on the attacker’s system, thereby granting access and bypassing MFA altogether.

In the event of a suspected breach, please call the ActZero 24x7 Breach number at 1-855-917-4981. 
Topic:

Related Resources

Cybersecurity Industry Threat Intelligence Ransomware Data Protection

Ransomware: The Persistent Cyber Threat and How to Combat It

Ransomware attacks are a growing concern, especially for schools and small businesses. The latest CrowdStrike 2024 Global Threat Report reveals a staggering 75% year-over-year increase in cloud environment intrusions, showing that ransomware isn’t just sticking around — it's evolving. Schools and
         
Cybersecurity Industry Threat Intelligence Data Protection

Hygiene Tip: Shut Down Attackers Harvesting Cached Browser Credentials

Recently, ActZero learned that ransomware actors are harvesting credentials from browsers during their attack. In recent attack chains our threat researchers have seen that, once the attacker gains a foothold, they are using Living-off-the-Land (LoTL) attacks to harvest the cached credentials from
         
Threat Intelligence Security Takes a Village

Top 5 Data Breaches and How to Prevent Them

You only need to look at the news today to understand that cyberattacks are on the rise. In fact, since the start of the pandemic, cybercrime has increased dramatically. And specific kinds of cyberattacks, such as ransomware, have become particularly problematic. Some estimates have ransomware
         
Cybersecurity Industry Threat Intelligence Ransomware

Ransomware Alert: Hackers Love a Long Weekend Too

Ransomware is a vicious malware designed to deny users or organizations access to their systems. If successful, the threat actor demands a ransom, holding business assets hostage until fulfilled. The company receives a decryption key to regain access if they disburse payment.
         
Cybersecurity Industry Threat Intelligence

4 Ways to Stop Ransomware on the Endpoint

With the global rise in ransomware, multinationals and SMBs believe it is not a matter of if but when an attack will occur. Several companies expect requests for ransom payments (despite warnings from the FBI), while others are convinced their current technology or processes will prevent, or enable
         
Cybersecurity Industry Threat Intelligence

The 5 Most Gruesome Cyber Threats

         
Threat Intelligence

Threat Modeling: A Guide for Small to Midsize Enterprises

In the non-stop battle to keep your organization secure, there are three vital commodities most IT and security teams seem to never have enough of — time, resources, and money. With a sundry of risks and vulnerabilities to track and remediate, how can a team focus their efforts for maximum impact,
         
Cybersecurity Industry Threat Intelligence

Early Detection of Exchange Zero Day? Hindsight Indicators

In hindsight, it should have been easy to find the needle in the haystack of haystacks...
         
Cybersecurity Industry Threat Intelligence Managed Detection and Response Data Protection

Zero Ransom Initiative

Our goal as a company is to get our customers to zero... zero breaches, zero threats, zero vulnerabilities, zero inadequate cybersecurity controls. We’ve committed to achieve this by continually investing to outpace the adversary across our technology, people and processes. Today, I’m excited to
         
Security Hygiene Cybersecurity Industry Threat Intelligence Managed Detection and Response Security Takes a Village

Combating a Rise in Ransomware: A Roundtable Discussion

Addressing ransomware has never been more of a top priority for senior IT leaders than it is today. Ransomware can be devastating to both individuals and organizations, and many organizations have been put in a position to pay millions of dollars to recover their data and deal with the implications
         

Curious about how ActZero can evolve your cybersecurity strategy?

Get a demo Contact Us