ITM is an open framework - Submit your contributions now.

Insider Threat Matrix™

  • ID: DT058
  • Created: 12th June 2024
  • Updated: 19th July 2024
  • Platforms: Windows, Linux, MacOS
  • Contributor: The ITM Team

Chrome Browser Login Data

Google's Chrome browser stores some login data of accessed websites, that can provide the URLs and usernames used for authentication.

 

On Windows, this information is stored in the following location:

C:\Users\[Username]\AppData\Local\Google\Chrome\User Data\Default\Login Data.

 

This file is a database file and can be opened in software such as DB Browser For SQLite. The ‘logins’ and ‘stats’ tables are of immediate interest to understand saved login data.

 

The passwords are not visible as they are encrypted. However, the encryption key is stored locally and can be used to decrypt saved passwords. The key is stored in the file C:\Users\[Username]\AppData\Local\Google\Chrome\User Data\Local State, which can be read with any text editor, such as Notepad, and searching for the “encrypted_key” value. The tool decrypt_chrome_password.py (referenced) can decrypt the AES-encrypted passwords to plaintext.

Sections

ID Name Description
IF010Exfiltration via Email

A subject uses electronic mail to exfiltrate data.

IF008Inappropriate Web Browsing

A subject accesses web content that is deemed inappropriate by the organization.

IF018Sharing on AI Chatbot Platforms

A subject interacts with a public Artificial Intelligence (AI) chatbot (such as ChatGPT and xAI Grok), leading to the intentional or unintentional sharing of sensitive information.

IF010.001Exfiltration via Corporate Email

A subject exfiltrates information using their corporate-issued mailbox, either via software or webmail. They will access the conversation at a later date to retrieve information on a different system.

IF010.002Exfiltration via Personal Email

A subject exfiltrates information using a mailbox they own or have access to, either via software or webmail. They will access the conversation at a later date to retrieve information on a different system.

IF008.001Lawful Pornography

A subject accesses lawful pornographic material from an organization device, contravening internal policies on acceptable use of organization equipment.

IF008.002Unlawful Pornography

A subject accesses unlawful pornographic material from a organization device, contravening internal policies on acceptable use of organization equipment and potentially, the law.

IF008.003Terrorist Content

A subject accesses, possesses and/or distributes materials that advocate, promote, or incite unlawful acts of violence intended to further political, ideological or religious aims (terrorism).

IF008.004Extremist Content

A person accesses, possesses, or distributes materials that advocate, promote, or incite extreme ideological, political, or religious views, often encouraging violence or promoting prejudice against individuals or groups.

IF008.005Gambling

A subject accesses or participates in online gambling from a corporate device, contravening internal policies on acceptable use of company equipment.

IF008.006Inappropriate Usage of Social Media

A subject misuses social media platforms to engage in activities that violate organizational policies, compromise security, disclose confidential information, or damage the organization’s reputation. This includes sharing sensitive data, making unauthorized statements, engaging in harassment or bullying, or undertaking any actions that could risk the organization’s digital security or public image.

IF008.007Gaming

A subject accesses or participates in web-based online gaming from a corporate device, contravening internal policies on acceptable use of company equipment.

IF008.008Other Inappropriate Content

A subject accesses other inappropriate web content from a corporate device, contravening internal policies on acceptable use of company equipment.

ME006.006Code Repositories

A subject can access websites used to access or manage code repositories.

IF018.001Exfiltration via AI Chatbot Platform History

A subject intentionally submits sensitive information when interacting with a public Artificial Intelligence (AI) chatbot (such as ChatGPT and xAI Grok). They will access the conversation at a later date to retrieve information on a different system.

IF018.002Reckless Sharing on AI Chatbot Platforms

A subject recklessly interacts with a public Artificial Intelligence (AI) chatbot (such as ChatGPT and xAI Grok), leading to the inadvertent sharing of sensitive information. The submission of sensitive information to public AI platforms risks exposure due to potential inadequate data handling or security practices. Although some platforms are designed not to retain specific personal data, the reckless disclosure could expose the information to unauthorized access and potential misuse, violating data privacy regulations and leading to a loss of competitive advantage through the exposure of proprietary information.