Summary

  • Researchers at the University of Wisconsin–Madison have demonstrated that Chrome browser extensions can steal passwords from text input fields, even if the extension is compliant with Chrome’s latest security and privacy standard, Manifest V3.

  • They created a proof-of-concept browser extension that could steal passwords and put it through the Chrome Web Store review process.

  • The attack works by exploiting the fact that extensions have full and unfettered access to the Document Object Model (DOM) of every web page you visit. The DOM is a representation of a web page in computer memory that can be accessed and changed, allowing the page to be modified on-the-fly.

  • The researchers found that most of the top 10,000 websites are vulnerable to this attack, including Google, Facebook, Gmail, Cloudflare, and Amazon.

  • They also analyzed the extensions already on the Chrome Web Store and found that 12.5% of them had the necessary permissions to exploit the password input field vulnerabilities.

  • The researchers offer two potential fixes: A “bolt on” remedy for vulnerable sites and a “built in” remedy for browsers.

  • The bolt on is a JavaScript library that can be added to websites to prevent unwanted access to password fields.

  • The built in remedy suggests changing Chrome to alert users whenever any JavaScript function accesses any password fields.

Possible Takeaways / Other Details

  • Google have improved security in the Manifest V3 standard, but it’s still possible to sneak in a password stealing extension into the webstore.

  • Some/all of the standard’s security improvements may have also been adopted by Microsoft Edge, and Mozilla Firefox.

  • It is important to be aware of the risks associated with using browsers’ extensions. Only install extensions from trusted sources and carefully review the permissions that they request.

  • Bappity
    link
    fedilink
    English
    849 months ago

    it’s almost like they didn’t do it for security and just to make adblocking harder

  • @pastcoma@lemmy.world
    link
    fedilink
    English
    179 months ago

    I’m not sure password managers like Last Pass or 1 Password could actually function without access to the DOM.

    • @mathemachristian@lemm.ee
      link
      fedilink
      English
      309 months ago

      Most extensions won’t work without access to the DOM, since most extension need to interact with the webpage displayed. I mean what’s the point of being a browser extension if you can’t interact with the web page. The suggestion is to alert when a password field is accessed, maybe an extra permission an extension needs to access the value of a password field. Most extensions don’t need to, for example “dark reader” does not need to know any input field or text node value. So if it suddenly asked for permissions to read my password that would be very suspicious.

      • NekuSoul
        link
        fedilink
        English
        8
        edit-2
        9 months ago

        The problem then becomes that extensions are still in control of everything else on the website: A malicious extension could simply hide or move the input field away and then create a new one in its place.

        Personally, I don’t see how one could make extensions secure without severely crippling their functionality or turning it into a game of cat and mouse.

        • @mathemachristian@lemm.ee
          link
          fedilink
          English
          4
          edit-2
          9 months ago

          If an extension is blocked by the browser from accessing the value of any input field, text node content and recording keystrokes how can it then manipulate pages in a way that grants access to passwords?

          The extension designer would have to actually create functionality which plausibly needs those permissions granted. Which would put a big dent in the “hello, if you want to monetize your extension put this code in it” type of scammers trying to gain access to that information via an extension that helps you zoom into images or whatever

          • NekuSoul
            link
            fedilink
            English
            19 months ago

            Then they could recreate their own input field by recreating their own “totally-not-an-input-field” with a canvas element and a bit of JS. Or, if that also gets blocked, just straight up redirect the user to a phishing site by replacing the login button or some other means. Plenty of people probably wouldn’t notice in time.

            • @mathemachristian@lemm.ee
              link
              fedilink
              English
              09 months ago

              That’s a whole lot of effort compared to how they are able to phish now, which is launder their code by paying some (perhaps unsuspecting) extension developer to include an external dependency in their well-established extension.

              Such effort as you’re describing would be harder to pull off, easier to spot and limit the victim pool significantly all at the same time.

              • @MotoAsh@lemmy.world
                link
                fedilink
                English
                4
                edit-2
                9 months ago

                The methods they described are very common hacking techniques once a site is compromised. They are not difficult nor more work than you’d expect, not out of the realm of normal work for a hacker with a site they can tweak.

    • @StudioLE@programming.dev
      link
      fedilink
      English
      69 months ago

      They only require permission to write to the password field, they don’t necessarily need to read passwords. Although it does change the work flow for some users.

      • @pastcoma@lemmy.world
        link
        fedilink
        English
        59 months ago

        Many password managers use a “save new” or “update” login credentials feature that watches for newly used passwords and asks if you’d like to save the credentials used.

        That’s going to go away if you remove the read access. That said, maybe that’s not such a bad thing. Plenty of people will dislike losing that feature, however.

      • @XTornado@lemmy.ml
        link
        fedilink
        English
        3
        edit-2
        9 months ago

        And it could work how it does on Android or similar where the browser has suggestions you can select to fill the field. Originally was for accessibility but it also works for password manger suggestions or any other sutofill. The extension would offer the suggestions to the browser and only the browser would read and actually do the input.

        • @pastcoma@lemmy.world
          link
          fedilink
          English
          19 months ago

          I’m actually game for that idea, it would also make the browser responsible for parsing the many formats of html people use for structuring their input fields.

    • @Diabolo96@lemmy.dbzer0.com
      link
      fedilink
      English
      16
      edit-2
      9 months ago

      This site is bogus. How the hell ublock origin and adblock Plus have the same score ? They should at least have a trusted add-ons based on if it’s open source or being recommended by reputable sites. I mean, Firefox audit some extensions and have a recommended tab. Use it and say recommended by Mozilla or something ?

    • @Raisin8659OP
      link
      English
      49 months ago

      Thanks. This could be a useful tool, but the scoring seems a bit “beta” at the moment. Still like the Recommended flair for Firefox better.

  • Excel
    link
    fedilink
    English
    69 months ago

    Of course they can. Everyone knows that password managers exist.