0
1
If you are running Windows 10 on your PC, then there are chances that your computer contains a pre-installed 3rd-party password manager app that lets attackers steal all your credentials remotely.
Starting from Windows 10 Anniversary Update (Version 1607), Microsoft added a new feature called Content Delivery Manager that silently installs new « suggested apps » without asking for users’ permission.
According to a blog post published Friday on Chromium Blog, Google Project Zero researcher Tavis Ormandy said he found a pre-installed famous password manager, called « Keeper, » on his freshly installed Windows 10 system which he downloaded directly from the Microsoft Developer Network.
Ormandy was not the only one who noticed the Keeper Password Manager. Some Reddit users complained about the hidden password manager about six months ago, one of which reported Keeper being installed on a virtual machine created with Windows 10 Pro.
Critical Flaw In Keeper Password Manager
Knowing that a third-party password manager now comes installed by default on Windows 10, Ormandy started testing the software and took no longer to discover a critical vulnerability that leads to « complete compromise of Keeper security, allowing any website to steal any password. »
« I don’t want to hear about how even a password manager with a trivial remote root that shares all your passwords with every website is better than nothing. People really tell me this, » Ormandy tweeted.
The security vulnerability in the Keeper Password Manager was almost identical to the one Ormandy discovered and reported in the non-bundled version of the same Keeper plugin in August 2016 that enabled malicious websites to steal passwords.
« I checked and, they’re doing the same thing again with this version. I think I’m being generous considering this a new issue that qualifies for a ninety day disclosure, as I literally just changed the selectors and the same attack works, » Ormandy said.
To explain the severity of the bug, Ormandy also provided a working proof-of-concept (PoC) exploit that steals a user’s Twitter password if it is stored in the Keeper app.
To read the original article :
https://thehackernews.com/2017/12/windows-10-password-manager.html
