Detection of logged-on users based on browser storage data
The disclosed techniques detect when a browser user remains logged-on to a website. Knowing that a browser user remains logged-on improves posture management in the face of cyberattacks. Visibility of the attack surface improves, and insight on how to reduce attack exposure is obtained. Furthermore, knowledge of when a web browser user was logged-on to a particular website may assist in post-hoc investigation of security incidents. In some configurations, local browser storage is scanned for key-value pairs that indicate a user remains logged-on. A key that matches a particular pattern and which includes a user identifier may indicate that a user remains logged-on. Additionally, or alternatively, specific keys may be associated with values that contain the identifier of a logged-on user. A security operation may be performed to warn a responsible party or to mitigate the vulnerability.
1 . A method comprising:
opening a database file that backs a key-value store for a web browser without invoking a browser storage API;
scanning the database file for a key-value pair that indicates that a user remains logged-on to a website;
extracting a user ID from the key-value pair; and
generating a security operation indicating that the user remains logged-on to the website.
2 . The method of claim 1 , wherein the database file is scanned for the key-value pair in response to a determination that the web browser maintains a cookie for the website.
3 . The method of claim 1 , wherein the database file is opened and scanned while the web browser is closed.
4 . The method of claim 1 , wherein the key-value pair indicates that the user remains logged-on to the website based on a determination that a key of the key-value pair includes a predefined string pattern.
5 . The method of claim 1 , wherein the key-value pair indicates that the user remains logged-on to the website by including the user ID in a key of the key-value pair.
6 . The method of claim 1 , wherein the key-value pair indicates that the user remains logged-on to the website by including a predefined string pattern in a key of the key-value pair.
7 . The method of claim 6 , wherein the user ID is extracted from a value of the key-value pair.
8 . A system comprising:
a processing unit; and
a computer-readable storage medium having computer-executable instructions stored thereupon, which, when executed by the processing unit, cause the processing unit to:
identify a cookie associated with a target website;
open a database file that backs a key-value store for a web browser without invoking a browser storage API;
scan the database file for a key-value pair that indicates that a user remains logged-on to the target website;
extract a user ID from the key-value pair; and
generate a security operation indicating that the user remains logged-on to the target website.
9 . The system of claim 8 , wherein key-value store is implemented with a log-structured merge-tree.
10 . The system of claim 8 , wherein the database file is opened and scanned periodically.
11 . The system of claim 8 , wherein the database file is opened and scanned in response to receiving an indication of a security threat.
12 . The system of claim 8 , wherein the database file is opened and scanned in response to a determination that the user has been idle for at least a defined period of time.
13 . The system of claim 8 , wherein the database is scanned in part by enumerating keys of key-value pairs associated with the target website.
14 . The system of claim 8 , wherein the security operation includes an attack path that includes use of the cookie associated with the target website.
15 . A computer-readable storage medium having encoded thereon computer-readable instructions that when executed by a processing unit causes a system to:
identify a cookie that stores a login credential for a target website;
open a database file that backs a key-value store for a web browser without invoking a browser storage API, wherein the database file includes key-value pairs associated with multiple domains;
scan the database file to identify a key-value pair indicating that the login credentials stored in the cookie are usable to gain access to the target website;
extract a user ID from the key-value pair; and
perform a security operation based on the identified user ID.
16 . The computer-readable storage medium of claim 15 , wherein the security operation logs out the user from the target website.
17 . The computer-readable storage medium of claim 15 , wherein the computer-readable instructions further cause the system to:
extract a tenant identifier from the key-value pair.
18 . The computer-readable storage medium of claim 15 , wherein the user ID is extracted from a data exchange format stored in a value of the key-value pair.
19 . The computer-readable storage medium of claim 15 , wherein the target website comprises an authentication service.
20 . The computer-readable storage medium of claim 15 , wherein the database file does not contain cookies.