Skip to content

Hijacking Trust: Weaponizing Stolen Cookies and Tokens - BRKSEC-2132#

Cisco Live US 2026 (Las Vegas) digest Program Core pick Las Vegas · 31 May – 4 June 2026

Abstract

Stefan Duernberger (Cisco)

  • Why: Session/token theft is the dominant real-world auth attack vector, and this session covers the modern defensive stack — passkeys, token binding, shared signals — directly on this PM's identity interests.
  • What: How stolen cookies and tokens are weaponized, and the countermeasures: passkeys (FIDO/WebAuthn), OAuth 2.0 and OIDC flows, Google's Device-Bound Session Credentials (DBSC), Cisco Duo Passport, and the Shared Signals and Events (SSE) framework (from abstract only).
  • How: Walks implementation of each mechanism and how they combine in a Zero Trust architecture to kill replayable bearer credentials.
  • Where applicable: Standards-based and broadly applicable (DBSC is a browser standard-in-progress, SSE is OpenID Foundation work); the Duo Passport portion is product-specific.