full-disclosure - How to take advantage of Chrome autofill feature to get sensitive information

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 31 Oct 2013 14:15:50 +0000
From: "vulns@...aths.com" <vulns@...aths.com>
To: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: How to take advantage of Chrome autofill feature
 to get sensitive information

At the end of 2010, Google introduced autofill in Chrome, a feature that may be a security problem for its users. Chrome's autofill allows to store postal addresses (divided in some other data like name, surname, telephone, postal code...) and credit card (divided in cardholder name, number and expiration date). For a form to take advantage of autofill feature, input fields has to be properly identified so Chrome knows what values go with them. There is a weakness that may allow an attacker to take advantage of this characteristic to obtain private information like an address or credit card data  without the user noticing anything.

As a precaution, Chrome only fills up credit card number with autofill under https pages. This is not a problem for the attacker, since he just have to operate uner a SSL connection. Another precaution that Chrome takes, is to forbid "hidden" tag in autocomplete inputs. Chrome also avoids to fill up Autofill inputs if there is a div tag with visibility set to "hidden".

So a formula would be to take advantage of the scroll property, rising up the layer some pixels so the inputs used to steal information are unseen. In this case, the "decoy" form would be created by using this specially crafted "div", so we get to hide inside it all these inputs and the browser will not show them (but will autofill them):

<form action="recolector.php" method="post">
    <div style="overflow:hidden;height:35px;">
            Nombre  <input id="cn" autocomplete="cc-name" ><br><br>
            <input id="cc" autocomplete="cc-number" >
            <input id="ce" autocomplete="cc-exp" >
            <input id="c5" autocomplete="cc-exp" maxlength="5">
            <input id="cg" autocomplete="cc-given-name">
            <input id="ca" autocomplete="cc-additional-name">
            <input id="cf" autocomplete="cc-family-name">

...

</div>

Chrome will fill up all that information without the user noticing anything. This weakness has been detected by Ricardo Mart?n from Eleven Paths (ricardo.martin@...aths.com). Full samples and detailed explanation is here: http://blog.elevenpaths.com/2013/10/how-to-take-advantage-of-chrome.html

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/