0

Suppose a zero-access malware like TDSS/Blue pill Kernel rootkit invades. If it opens any of my logged-in sites (2FA enabled, so that they can't just go incognito or open in any other browsers or steal passwords) in my Chrome & my Google account is synced, would it be recorded? As well in Google Cloud history which I'd require the culprit to actually to go to my account cloud to delete, or low-level access can conceal or not record any remote access browsing history or any other malicious activity?

Would I see only my history/files if my PC is running virtually+TDSS, augmented "matrix" like?

Also, can login cookies be stolen & log-in from a different PC or would it stop working if used in VM or different browser version, hardware. GUID?

  • Your question is confusing. Are you asking if some process running on your system can remove logs Google has on their servers about the interactions your browser had with their servers? Or do you ask if the process can modify the local history of your activity, i.e. the one stored on your own system and not on Google's servers?. – Steffen Ullrich Dec 16 '17 at 11:41
  • Actually kinda both. on myactivity.google.com/myactivity, as well as local browser history. – Aoi. T_015 Dec 16 '17 at 11:46
  • I tried to make sense of your language but I'm still very confused. Your last question is unrelated to the main part of your question. – schroeder Dec 16 '17 at 12:03
  • oops, sorry., should I have made new question for that instead? since it just came to me, thought I'd ask since both are kinda related – Aoi. T_015 Dec 16 '17 at 12:05
2

... both. on myactivity.google.com/myactivity, as well as local browser history.

Any process with the same or better permissions as the local browser can modify the same data as the browser does. Which means that any process you start as the normal user might modify the browser history. This can be done by directly accessing the files where the browser stores the history.

As for your activity log at google: a process which hijacks the browser or uses the credentials from the browser can do anything you can also do within the browser, i.e. delete activities by using the browser interface or add new activities (by browsing sites). But it has no direct access to the data stored at Google and can thus not modify the data outside of the intended way as would be possible with the local history. If that is needed the attacker need to attack Google 's servers where these data are stored and not your system.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.