Technology

58141 readers

4769 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago

MODERATORS

300

Password-stealing Chrome extension smuggled on to Web Store; Researchers Demonstrated that Password-stealing Extensions are Still Possible with Manifest V3 (www.malwarebytes.com)

submitted 1 year ago* (last edited 1 year ago) by [email protected] to c/technology

18 comments fedilink hide all child comments

Summary

Researchers at the University of Wisconsin–Madison have demonstrated that Chrome browser extensions can steal passwords from text input fields, even if the extension is compliant with Chrome's latest security and privacy standard, Manifest V3.
They created a proof-of-concept browser extension that could steal passwords and put it through the Chrome Web Store review process.
The attack works by exploiting the fact that extensions have full and unfettered access to the Document Object Model (DOM) of every web page you visit. The DOM is a representation of a web page in computer memory that can be accessed and changed, allowing the page to be modified on-the-fly.
The researchers found that most of the top 10,000 websites are vulnerable to this attack, including Google, Facebook, Gmail, Cloudflare, and Amazon.
They also analyzed the extensions already on the Chrome Web Store and found that 12.5% of them had the necessary permissions to exploit the password input field vulnerabilities.
The researchers offer two potential fixes: A "bolt on" remedy for vulnerable sites and a "built in" remedy for browsers.
The bolt on is a JavaScript library that can be added to websites to prevent unwanted access to password fields.
The built in remedy suggests changing Chrome to alert users whenever any JavaScript function accesses any password fields.

Possible Takeaways / Other Details

Google have improved security in the Manifest V3 standard, but it's still possible to sneak in a password stealing extension into the webstore.
Some/all of the standard's security improvements may have also been adopted by Microsoft Edge, and Mozilla Firefox.
It is important to be aware of the risks associated with using browsers' extensions. Only install extensions from trusted sources and carefully review the permissions that they request.

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 6 points 1 year ago (2 children)

They only require permission to write to the password field, they don't necessarily need to read passwords. Although it does change the work flow for some users.

[–] pastcoma 5 points 1 year ago

Many password managers use a “save new” or “update” login credentials feature that watches for newly used passwords and asks if you’d like to save the credentials used.

That’s going to go away if you remove the read access. That said, maybe that’s not such a bad thing. Plenty of people will dislike losing that feature, however.

[–] [email protected] 3 points 1 year ago* (last edited 1 year ago) (1 children)

And it could work how it does on Android or similar where the browser has suggestions you can select to fill the field. Originally was for accessibility but it also works for password manger suggestions or any other sutofill. The extension would offer the suggestions to the browser and only the browser would read and actually do the input.

[–] pastcoma 1 points 1 year ago

I’m actually game for that idea, it would also make the browser responsible for parsing the many formats of html people use for structuring their input fields.