Steve Gibson (136:17)
Pretty much all of the tech press picked up on the August 9th DEFCON 33 presentation by the Czech security researcher Merrick Toth. Many of our listeners wrote to make sure I was aware of it and to inquire what I thought about it. This is understandable of course, particularly if anyone saw some of the unwarranted hysteria online that mostly appears to be from weenies hoping to grab some attention for themselves by overblowing the importance of this researcher's findings. For example, a sample comment that was actually posted into the Bit Warden community forum said just saw this DOM based extension click jacking your password manager data at risk. Essentially a malicious script can steal all your passwords by hiding behind a fake capture window. Well, okay. Essentially nothing that's nonsense, but it sure makes for an intention getting posting and the fact that there is a kernel of truth hiding in there somewhere caused our listeners to wonder where the hysteria should end and warranted concern should begin. Okay, now the truth is that web browser based vulnerabilities which involve causing a user's click to do something other than they expect, generically known as click jacking because you click and your actions get jacked, have been around since browsers first became scriptable. Unfortunately, these attacks are more or less innate and intrinsic and are difficult if not impossible to prevent as long as we have browsers from which we ask and expect so much. At this point in time, the Twit network has two browser based password manager sponsors, Bitwarden and 1Password. Since both of these password managers were name checked during Merrick's DEFCON presentation, along with nine others. Since we've been recommending their use to our listeners, and since the you know, those listeners have specifically asked me what they should think about all this, I've explained what's going on in the context of these two of the 11 password managers that Merrick mentioned last Thursday. Responding to the concern raised by this what the 1Password site posted a response under their heading Dom Based Extension Clickjacking and in that page's tip call out they wrote your information in one Password is always encrypted and protected. Clickjacking does not expose all your 1Password data or export all all your vault contents, and no web page can directly access your information without interaction with the browser's extension autofill element. At most, a malicious or compromised web page could trick you into auto filling one matching item per click. Not everything in your account. An attacker who exploits clickjacking to fill a login item cannot view the filled in information unless the attacker has also compromised the website configured in the item's auto fill settings. Okay, so that's what they said, and that's a hundred percent correct. And note that this applies equally to Bit Warden because this is the way our browser extensions operate. And this was clearly meant to counter the you know all your base are belong to us nonsense that's been circulating about this online in the past several weeks. I also like the way one Password ended that page with their summary conclusions because I thought it was exactly correct. Here's what they said. They said 1Password operates within the same visual space as the web pages you visit. This means that a malicious web page can attempt to overlay or mimic the extension's interface in ways that make detection difficult. That is visual detection by the user. While there are strategies to detect or mitigate some of these attempts, each comes with limitations and there is no comprehensive technical fix. Some proposed technical fixes are not effective against all browsers, and others break expected behavior for legitimate sites. Through in depth testing, we found that no single mitigation was comprehensive. Attackers may use common web features in a malicious manner and therefore easily evade detection. Several of these techniques can coexist with otherwise well behaved web pages, making strict enforcement risky with the potential to impact usability. And again, as I noted earlier, this is less about the fault of any particular password manager than it is about the fact that what we want today's websites to do that is so comprehensive and sophisticated that the visual distinction between the site's content and an add on's content, which is after all also being served from the same browser, can easily be confused, especially when it's deliberate deception. Okay, so what is all this about? Stepping back from this a bit, last Tuesday the guys at Socket Security posted a very fair minded explainer which was titled Researcher Exposes Zero Day Clickjacking Vulnerabilities in Major Password Managers. With their tease, Hacker demonstrates how easy it is to steal data from popular password managers. So here's what Socket wrote, they said at DEFCON 33 check Republic based security researcher Merrick Toth unveiled a series of unpatched zero day clickjacking security vulnerabilities impacting the browser based plugins for a wide range of password managers, including 1Password bit, warden, dashlane, icloud passwords, even icloud passwords keeper, lastpass, log me once, Nordpass, Proton Pass and Roboform Post disclosure Several password managers remain vulnerable and exploitable to these vulnerabilities today, including 1Password bit, Warden, iCloud passwords, LastPass and LogMe once. LogMe once never responded to the researchers contact attempts. 1Password and LastPass flag these vulnerabilities as informative. Practically speaking, these vulnerabilities are unlikely to be patched without pressure from these vendors customers okay, now let me first update that information since it was written. Bit warden posted 2025. 8.1 is rolling out this week to address malicious websites trying to use this type of attack and will be available for everyone soon. Probably is now. I haven't checked and 1Password has updated writing as of August 20, 2025. The 8.11.7.2 password browser extension update was submitted to all browser stores for review. The actual availability of each updated extension will vary based on the various browsers, vendors and their review process and then update on August 22nd. 8.11 is seen as 8.11.7 in Apple's app stores. Note iOS users will need to update their mobile app to the 8.11.7 version if using Safari on Mobile. Okay, so the Tube browser based password managers that are sponsors of the network both responded with updates. I'll explain why they did this in a minute, socket said. Many of us in the audience during this talk at meaning DEFCON 33 were unsettled at these findings and the lack of rapid response by password manager vendors to adequately address these issues. At the end, he writes, I overheard one attendee say, well, time to disable our browser based password manager across our org. Another humorously said time to become a hermit in the woods. Needless to say, the audience was shocked. We collectively place so much trust in our password managers and it was surprising how easily they could be subverted. Well, shouldn't have been that surprising, but okay, they write Merrick's disclosed vulnerabilities enable hackers to steal sensitive data within password manager such as credit card details, names and addresses, and phone numbers if a victim visits a malicious website. Furthermore, if a vulnerable website storing your password manager credentials has a cross site scripting vulnerability or a sub domain takeover and we've talked about that before, where you're at a subdomain and the password manager is only covering the root domain, he said that hackers can exploit it to steal login credentials, usernames and passwords, two factor authentication codes and pass keys. Although I'll just note that stealing passkeys won't help them. Okay, so let's take this all a bit apart. Socket wrote that this vulnerability would, quote enable hackers to steal sensitive data within password managers such as credit card details, names, addresses and phone numbers if a victim visits a malicious website. Okay, the way users typically have their password managers configured is that when they visit a page containing a purchase form for example, to fill in, the password manager will notice those fields and may prompt the user about whether they would like them to be filled in. Those fields might be the user's name and address and a credit card number. So it's not as if all that information isn't readily available to any site we might visit. It is, and we want it to be. What Merrick cleverly figured out how to do was to, once again, because we've seen this before, hide the fact that all of that was going on while tricking the user into clicking on something else. Like, you know, the ubiquitous we use cookies here banner so A malicious website would hide the fill in form and present the banner so that when the user thought they were acknowledging the site's use of cookies, they were actually clicking to give permission to their password manager to fill in the form. Thus their name and address and credit card number could be captured by that malicious site. Okay, now if this might all seem rather familiar for our longtime listeners, that's because it should be congratulations on your memory. You've been paying attention many years ago. And Leo, I know you'll remember this because I remember you like making a point of like holy crap, we we covered a closely related hack which placed the form fields off screen using negative or very positive screen coordinates.
