5 ms·

Most of them are build without having decrypted passwords or keys for them on server, so attacker would need to get to the point where they can craft malicious

by ilyt 4y ago

Most of them are build without having decrypted passwords or keys for them on server, so attacker would need to get to the point where they can craft malicious update to the client (or exploit the client)

ihattendorf 4y ago
1. Get access to build infrastructure (e.g. via supply chain attack) 2. Inject code in build to export user's passwords to remote server after update is installed
- s3p 4y ago
  Simple, but not easy.
- throwaway821909 4y ago
  This is a good point, but on the other hand, couldn't any application be hijacked in the same way to include a keylogger/upload plaintext password DBs stored locally by browsers/etc? Somehow this hasn't happened on a mass scale that I'm aware of.
  - aborsy 4y ago
    Not exactly, because the JavaScript code can change and be delivered at ANY time. No code signature verification is involved. An offline password manager is updated a few times a year, and will go through OS repository distribution, with verification of the signature for changes. Or you can download the software from the source website and check the signature.
  - quickthrower2 4y ago
    Extension has the passwords so just need to suck them through a straw. Getting a keylogger on someones machine probably requires getting them to run an executable or a zero-day exploit.
- vgel 4y ago
  Worth noting that open-source projects where your password store is saved locally are vulnerable to the same attack.
- jiggawatts 4y ago
  This kind of thing has already happened. Chinese hackers got into the Juniper VPN source code and replaced a key pair with their own. They even updated the tests so that it would pass. This went unnoticed for years.
  - ilyt 4y ago
    Arguably it wasn't secure in the first place if it had backdoor like that.
    - selcuka 4y ago
      It doesn't have to a backdoor. A malicious employee can have access to the keys.
radicaldreamer 4y ago
Dependency exploit would be the way for 1Password etc, which are now basically wrapped web apps.
- rtpg 4y ago
  even with everything, given the norms of lock files for even the most basic of web apps, you're still at "need to roll out a client update". Now that's not to say that something can't be sneaked into other work! But the bar is a bit higher than "take over a dependency"
  - cokeandpepsi 4y ago
    that's what happend to solarwinds, it out worked pretty well for the hackers there
- postalrat 4y ago
  Only web apps have dependencies?
  - derekp7 4y ago
    Web apps are potentially re-downloaded every time you use them.

by ilyt 4y ago

ihattendorf 4y ago

1. Get access to build infrastructure (e.g. via supply chain attack) 2. Inject code in build to export user's passwords to remote server after update is installed

s3p 4y ago
Simple, but not easy.
throwaway821909 4y ago
This is a good point, but on the other hand, couldn't any application be hijacked in the same way to include a keylogger/upload plaintext password DBs stored locally by browsers/etc? Somehow this hasn't happened on a mass scale that I'm aware of.
- aborsy 4y ago
  Not exactly, because the JavaScript code can change and be delivered at ANY time. No code signature verification is involved. An offline password manager is updated a few times a year, and will go through OS repository distribution, with verification of the signature for changes. Or you can download the software from the source website and check the signature.
- quickthrower2 4y ago
  Extension has the passwords so just need to suck them through a straw. Getting a keylogger on someones machine probably requires getting them to run an executable or a zero-day exploit.
vgel 4y ago
Worth noting that open-source projects where your password store is saved locally are vulnerable to the same attack.
jiggawatts 4y ago
This kind of thing has already happened. Chinese hackers got into the Juniper VPN source code and replaced a key pair with their own. They even updated the tests so that it would pass. This went unnoticed for years.
- ilyt 4y ago
  Arguably it wasn't secure in the first place if it had backdoor like that.
  - selcuka 4y ago
    It doesn't have to a backdoor. A malicious employee can have access to the keys.

radicaldreamer 4y ago

Dependency exploit would be the way for 1Password etc, which are now basically wrapped web apps.

rtpg 4y ago
even with everything, given the norms of lock files for even the most basic of web apps, you're still at "need to roll out a client update". Now that's not to say that something can't be sneaked into other work! But the bar is a bit higher than "take over a dependency"
- cokeandpepsi 4y ago
  that's what happend to solarwinds, it out worked pretty well for the hackers there
postalrat 4y ago
Only web apps have dependencies?
- derekp7 4y ago
  Web apps are potentially re-downloaded every time you use them.