Google Chrome Tests DBSC Against Cookie Theft: Cyber Threat Explainer & Legal Remedies in India

Google has commenced public beta testing of Device Bound Session Credentials (DBSC) in Google Chrome—a security standard designed to eliminate one of the most prevalent attack vectors in modern cybercrime: cookie-stealing attacks (also known as session hijacking).

While multi-factor authentication (MFA) has dramatically improved account security across enterprise and consumer services, cybercriminals have pivoted toward post-authentication exploits. By stealing authentication session cookies, attackers bypass passwords, SMS OTPs, and authenticator apps entirely.

At APS Law, we frequently counsel corporate and individual clients dealing with unauthorized access, corporate data exfiltration, and financial fraud stemming from account takeover. Here is an explainer of the threat, the mechanics of DBSC, and the legal remedies available to victims under Indian cyber law.

---

Understanding the Threat: What is Cookie Stealing?

When a user logs into a web service—such as an enterprise portal, an email client, or a net-banking dashboard—the server authenticates the credentials and issues a session cookie. This cookie resides in the local browser cache and serves as a temporary digital pass, sparing the user from entering credentials on every subsequent action.

The Rise of "Infostealer" Malware

Cyber syndicates deploy malware strains such as RedLine, Lumma, and Raccoon Stealer through phishing campaigns, malvertising, or trojanized software downloads. Once inside a host machine, these infostealers silently scan local directories, extract active session cookies from the browser, and exfiltrate them to command-and-control (C2) servers.

Because the session cookie reflects an already authenticated state, the attacker can import it into their own browser. The server recognizes the cookie as valid, granting the intruder access without triggering MFA prompts or requiring user passwords.

How Google's DBSC Solves This

Device Bound Session Credentials (DBSC) fundamentally shift how cookies operate:

• Hardware Binding: DBSC ties the session to a public/private cryptographic key pair generated via the user device's hardware chip (such as a Trusted Platform Module or TPM).
• Local Proof of Possession: The browser periodically signs a proof-of-possession challenge proving it still controls the private key, which never leaves the physical device.
• Neutralizing Stolen Cookies: If an infostealer extracts the cookie and transmits it to a remote hacker, the cookie is useless on the attacker's machine because the accompanying hardware-bound private key is absent.

While DBSC represents a major technological leap, full implementation across web servers will take time. Until then, cookie-stealing remains a severe threat under Indian legal frameworks.

---

Indian Legal Remedies: The IT Act & BNS, 2023

Victims of session hijacking often assume that because no physical device was stolen and no password was cracked, there is no actionable legal recourse. In Indian jurisprudence, unauthorized extraction of authentication tokens and session hijacking constitute explicit criminal offences and civil wrongs.

1. Offences Under the Information Technology Act, 2000

• Section 43 (Civil Liability for System Contamination & Data Extraction): Unauthorized downloading, copying, or extraction of session data or cookies from a computer resource triggers civil liability. Victims can pursue financial compensation before the State Adjudicating Officer.
• Section 66 (Computer Related Offences): If any act referred to in Section 43 is done dishonestly or fraudulently, it constitutes a cognizable criminal offence punishable with imprisonment for up to three years or a fine up to five lakh rupees.
• Section 66C (Identity Theft): Using another person’s unique identification feature—which judicially includes session tokens, digital authentication credentials, and passwords—attracts imprisonment up to three years.
• Section 66D (Cheating by Personation Using Computer Resource): When an intruder uses a stolen session cookie to impersonate the legitimate account holder and siphon funds or obtain sensitive data, Section 66D applies directly.

2. Offences Under the Bharatiya Nyaya Sanhita, 2023 (BNS)

Following the criminal law reforms replacing the Indian Penal Code:

• Section 318 of BNS (Cheating): Fraudulent inducement causing wrongful loss or harm.
• Section 319 of BNS (Cheating by Personation): Impersonating the account holder through electronic means to deceive web applications, financial entities, or counterparties.
• Section 303 & Section 316 of BNS (Theft and Criminal Breach of Trust): Where stolen session credentials are used to misappropriate digital assets or proprietary business records.

3. Evidentiary Standards Under the Bharatiya Sakshya Adhiniyam, 2023 (BSA)

To prosecute session theft or claim financial damages, electronic evidence must be preserved scrupulously. Under Section 61 and Section 63 of the Bharatiya Sakshya Adhiniyam, 2023 (which replace the erstwhile Section 65B of the Indian Evidence Act), electronic records—including server access logs, browser history dumps, IP connection logs, and forensic disk images—require proper certification and custody tracking to remain admissible in court.

---

Immediate Steps for Victims in Mumbai, Thane, and Mira Road

If you discover an active session hijacking incident—such as unexplained emails sent from your account, unauthorized fund transfers, or session terminations:

Technical Mitigation

1. Terminate All Active Sessions: Immediately access your account settings from an uncompromised device and select "Log out of all devices" or "Revoke all active sessions." This invalidates all extant session tokens on the server side.
2. Clear Cache & Reset Credentials: Clear browser storage and change master passwords for sensitive accounts.
3. Isolate Affected Endpoints: Disconnect the compromised computer from the local network to prevent lateral movement of malware.

Reporting to Law Enforcement

Victims located in the Mumbai Metropolitan Region (MMR) have structured avenues for legal redress:

• The National Cyber Crime Reporting Portal: Lodge an immediate complaint at cybercrime.gov.in or dial the national financial cyber fraud helpline 1930 (crucial within the "golden hour" if funds were drained).
• Mumbai Cyber Police Stations: Depending on your jurisdiction, report to the specialized Regional Cyber Police Stations in Mumbai:
  • BKC Cyber Police Station (handles complex enterprise and high-value cybercrimes).
  • Regional Cyber Police Stations: South (Colaba), Central (Worli), East (Chembur), West (Bandra), and North (Kandivali).
• Thane & MBVV Commissionerates:
  • Residents in Thane can approach the Thane Cyber Crime Cell at the Police Commissionerate, Court Naka.
  • Residents in Mira Road and Bhayandar fall under the Mira-Bhayandar Vasai-Virar (MBVV) Police Commissionerate, which houses a dedicated Cyber Crime Cell at Kashimira.
• Adjudicating Officer Application: For civil compensation under Section 46 of the IT Act, a petition can be filed before the Adjudicating Officer (Information Technology) for Maharashtra, typically chaired by the Principal Secretary (IT) at Mantralaya, Mumbai.

---

Frequently Asked Questions (FAQs)

1. How does cookie theft bypass Two-Factor Authentication (2FA)?

Two-factor authentication is required only during the initial authentication phase to generate a trusted session. Once authenticated, the server issues a session cookie so you do not have to perform 2FA on every page refresh. If an attacker steals that valid session cookie, they submit it to the server as proof of prior authentication, bypassing the login portal and its 2FA requirement altogether.

2. Can our company be liable under Indian law if an employee's session cookie is stolen?

Yes. Under the Digital Personal Data Protection Act, 2023 (DPDPA), data fiduciaries must implement reasonable security safeguards to prevent personal data breaches. Furthermore, Section 43A of the IT Act mandates that bodies corporate possessing sensitive personal data must maintain reasonable security practices. Failure to prevent predictable token-theft attacks due to lax endpoint security can expose the entity to regulatory penalties and compensation claims.

3. What electronic evidence is required to prove session hijacking?

Critical evidence includes web server access logs indicating sudden IP address or User-Agent anomalies during an active session, forensic memory or disk images showing infostealer malware, firewall egress logs, and email alerts for suspicious log-ins. Under Section 63 of the Bharatiya Sakshya Adhiniyam, 2023, these electronic records must be accompanied by an evidentiary certificate.

4. What is the difference between filing an FIR and an application under Section 46 of the IT Act?

An FIR lodged at a Cyber Police Station (under the BNS and IT Act penal sections) initiates criminal proceedings aimed at arresting and prosecuting the perpetrator. In contrast, an application under Section 46 of the IT Act is an administrative/civil claim heard by the IT Secretary (Adjudicating Officer) focusing on financial compensation for the victim from parties responsible for unauthorized access or negligence.

---

Legal Support for Cyber Incidents

Navigating the legal aftermath of session hijacking, unauthorized account access, or corporate data breaches requires prompt technical preservation and targeted legal action. APS Law advises corporations, professionals, and individuals across Mumbai, Thane, and Mira Road on cyber dispute resolution, regulatory notifications, electronic evidence compliance, and proceedings before police authorities and the IT Adjudicating Officer.

To discuss a cybersecurity incident or schedule a consultation, contact APS Law.