Slashdot Mirror
Web Trackers Exploit Flaw In Browser Login Managers To Steal Usernames (bleepingcomputer.com)
An anonymous reader writes: Princeton privacy experts are warning that advertising and analytics firms can secretly extract site usernames from browsers using hidden login fields and tie non-authenticated users visiting a site with their profiles or emails on that domain. This type of abusive behavior is possible because of a design flaw in the login managers included with all browsers. Experts say that web trackers can embed hidden login forms on sites where the tracking scripts are loaded. Because of the way the login managers work, the browser will fill these fields with the user's login information, such as username and passwords.
The trick is an old one, known for more than a decade but until now it's only been used by hackers trying to collect login information during XSS (cross-site scripting) attacks. Princeton researchers say they recently found two web tracking services that utilize hidden login forms to collect login information. The two services are Adthink (audienceinsights.net) and OnAudience (behavioralengine.com), and Princeton researchers said they identified scripts from these two that collected login info on 1,110 sites found on the Alexa Top 1 Million sites list. A demo page has been created to show how the tracking works.
The trick is an old one, known for more than a decade but until now it's only been used by hackers trying to collect login information during XSS (cross-site scripting) attacks. Princeton researchers say they recently found two web tracking services that utilize hidden login forms to collect login information. The two services are Adthink (audienceinsights.net) and OnAudience (behavioralengine.com), and Princeton researchers said they identified scripts from these two that collected login info on 1,110 sites found on the Alexa Top 1 Million sites list. A demo page has been created to show how the tracking works.
I remember reading about this years ago, and was under the impression that this had been fixed by browsers filling the form fields in the UI, but not in the DOM, until the user explicitly selected one of the fields in the same form. There are still some sneaky things you can do (for example, have a 1px by 1px form field so the user submits more information than they think they are submitting), but you can't just grab the data from the form until the user interacts with some part of it.
I am TheRaven on Soylent News
My crystal ball tells me we'll hear about a surefire way to block those ad services in no later than 10 postings, 20 tops.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
I just tested and it does not work with Lastpass (on Chrome)
So are advertisers. They have no morals, just like marketing graduates...
Corporatism != Free Market
Go to Kinkos, laminate and hang it in your all.
I do not believe in karma. "Funny"=-6. Do good and forbid evil. Yours, Oft-Offtopic Flamebaiting Troll.
This is simply outright what is colloquially known as "hacking". Which is why the CFAA needs to be applied. Why haven't these researchers told their AG?
After all, when normal users find a unsecured database by some corporation and access it, they get sued too. Same standard here applies, and this time the culprits even use a documented security hole, meaning the crime is wholly willful.
for the win! :)
Seems to prevent it from working. But another browser (Safari on OS X) which doesn’t block scripts by default gave up the credentials.
So I guess the solution is NoScript or the equivalent.
#DeleteChrome
Doesn't effect 1Password on Firefox, unless you actively tell it to populate the web page.
Jesus fuck, this shit is long.
I remember reading about this years ago, and was under the impression that this had been fixed by browsers filling the form fields in the UI, but not in the DOM, until the user explicitly selected one of the fields in the same form.
That's the case in Firefox :
- you need to click on either the username or password field to get a pull-down menu that gives you information about the login, and gives you a selection of passwords saved in the manager.
Also, with most browsers you get extensions like Block Origin, AdBlock Plus, etc. which are going to block most common advertisers.
And extensions such as Privacy Badger which is going to block most common tracker.
And specifically in Firefox (because it requires to either have the new additional extensions that they've added to web extensions to enable this kind of software in the latest firefox, or to have the XUL API in the long term support version) you can also have NoScript, which is going to block all non-explicitely-authorised JavaScript (so tracker missed by the blacklists of UBO, ADP, etc. are blocked anyway), and provides additional alerts against cross site scripting (XSS).
Remember: just as you never fuck without condom, you never surf without your security extensions.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
The worst part is that browser development is mainly financed by advertisers. When the other side is against you, that's bad. But when you have the enemy implanted in your home, you've lost.
Yes, Firefox. I believe them to have the best intentions (as opposed to the other browser makers, don't tell me that Chrome or Safari or what's-Microsoft's-browser-called-this-week cater more to you or me than to their maker!), but their world view might be slightly... skewed.
Blame your incompetent webmaster for the website miss configuration and lack of CORS headers.
pi-hole that shit.
Silence is a state of mime.
-1, so didn't see it.
are the CEO's arrested yet?
company assets seized?
if not, when will this happen?
enable chrome://flags/#fill-on-account-select
More and more, the only defense is don't use it and don't have it.
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
So I wonder how the companies can justify this? I can't think of any compelling legal reason to get users' login information.
In 2017-almost-2018?
Why? Haven't we learned this lesson by now? Seriously, why would you let your computer load web trackers? What's in it for you?
0.0.0.0 audienceinsights.net
0.0.0.0 behavioralengine.com
I just tried it with Chrome 63.0.3239.108; it retrieved the username immediately.
You can't stop a bad website from leaking the information you trust them with. they are responsible for the scripts they use on their sites.
In the mean time, a password box should prevent javascript from reading it's value until javascript sets a value. Just follow the same behavior of style properties in DOM not matching their CSS until set by javascript. That would reduce password leaking for badly secured websites.
Anything else shouldn't be done. it's the website's fault. the browser can't protect them from themselves completely.
We've needed better efforts for authentication for a long time; we need some new standards. certificate logins for example... signed by each website, kept secret on the browser pw manager; never completely disclosed.
> a design flaw in the login managers included with all browsers.
That annoying prompt that asks you whether you want the browser to remember the login name and password, or auto-fill forms? I never allow any browser to do that. Ever.
I also don't use any browser plugin-based password manager. It's been well established that new exploits are being found in browsers all the time (all of them), therefore running your password manager in the same process space as the browser itself means you're always just one buffer overflow away from getting your data accessed in some unintentional way. Even if the plugin itself is pretty much bullet-proof.
I do use a password manager. But it's not connected to a browser in any way, shape or form.
Fortunately, we haven’t found password theft on the 50,000 sites that we analyzed. Instead, we found tracking scripts embedded by the first party abusing the same technique to extract emails addresses for building tracking identifiers.
Why would the first party need to steal my email address / username? I just used it to log in to their site!
.:Semper Absurda:.
I don't think Firefox is vulnerable to this because it requires you to click in the field to fill your credentials first.
So, let's get down to the real reason for your post....who would win in a fatal 4 death match, God vs Jesus vs Alex Jones vs the poster.
Place your bets, mines on Alex jones.
using a horrifyingly deformed, homemade version of firefox, with some code from 3.0.17 (last somewhat normal version imo) and backported security patches here.
the test site sorta kinda works.. after enabling the external test site in the requestpolicy and allowing its encryption cert to be used manually and allowing it to run inline js
Wake me up when this thing is possible without js. If it's js and SSL dependent, who cares.
I'll just add this as yet another reason to use an ad blocker, a JavaScript blocker and not use a login manager.
"Grab them by the pussy" -- President of the United States of America
BORING.