Slashdot Mirror
Web Trackers Exploit Flaw In Browser Login Managers To Steal Usernames (bleepingcomputer.com)
An anonymous reader writes: Princeton privacy experts are warning that advertising and analytics firms can secretly extract site usernames from browsers using hidden login fields and tie non-authenticated users visiting a site with their profiles or emails on that domain. This type of abusive behavior is possible because of a design flaw in the login managers included with all browsers. Experts say that web trackers can embed hidden login forms on sites where the tracking scripts are loaded. Because of the way the login managers work, the browser will fill these fields with the user's login information, such as username and passwords.
The trick is an old one, known for more than a decade but until now it's only been used by hackers trying to collect login information during XSS (cross-site scripting) attacks. Princeton researchers say they recently found two web tracking services that utilize hidden login forms to collect login information. The two services are Adthink (audienceinsights.net) and OnAudience (behavioralengine.com), and Princeton researchers said they identified scripts from these two that collected login info on 1,110 sites found on the Alexa Top 1 Million sites list. A demo page has been created to show how the tracking works.
The trick is an old one, known for more than a decade but until now it's only been used by hackers trying to collect login information during XSS (cross-site scripting) attacks. Princeton researchers say they recently found two web tracking services that utilize hidden login forms to collect login information. The two services are Adthink (audienceinsights.net) and OnAudience (behavioralengine.com), and Princeton researchers said they identified scripts from these two that collected login info on 1,110 sites found on the Alexa Top 1 Million sites list. A demo page has been created to show how the tracking works.
I remember reading about this years ago, and was under the impression that this had been fixed by browsers filling the form fields in the UI, but not in the DOM, until the user explicitly selected one of the fields in the same form. There are still some sneaky things you can do (for example, have a 1px by 1px form field so the user submits more information than they think they are submitting), but you can't just grab the data from the form until the user interacts with some part of it.
I am TheRaven on Soylent News
My crystal ball tells me we'll hear about a surefire way to block those ad services in no later than 10 postings, 20 tops.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
I just tested and it does not work with Lastpass (on Chrome)
So are advertisers. They have no morals, just like marketing graduates...
Corporatism != Free Market
Go to Kinkos, laminate and hang it in your all.
I do not believe in karma. "Funny"=-6. Do good and forbid evil. Yours, Oft-Offtopic Flamebaiting Troll.
This is simply outright what is colloquially known as "hacking". Which is why the CFAA needs to be applied. Why haven't these researchers told their AG?
After all, when normal users find a unsecured database by some corporation and access it, they get sued too. Same standard here applies, and this time the culprits even use a documented security hole, meaning the crime is wholly willful.
for the win! :)
Seems to prevent it from working. But another browser (Safari on OS X) which doesn’t block scripts by default gave up the credentials.
So I guess the solution is NoScript or the equivalent.
#DeleteChrome
I remember reading about this years ago, and was under the impression that this had been fixed by browsers filling the form fields in the UI, but not in the DOM, until the user explicitly selected one of the fields in the same form.
That's the case in Firefox :
- you need to click on either the username or password field to get a pull-down menu that gives you information about the login, and gives you a selection of passwords saved in the manager.
Also, with most browsers you get extensions like Block Origin, AdBlock Plus, etc. which are going to block most common advertisers.
And extensions such as Privacy Badger which is going to block most common tracker.
And specifically in Firefox (because it requires to either have the new additional extensions that they've added to web extensions to enable this kind of software in the latest firefox, or to have the XUL API in the long term support version) you can also have NoScript, which is going to block all non-explicitely-authorised JavaScript (so tracker missed by the blacklists of UBO, ADP, etc. are blocked anyway), and provides additional alerts against cross site scripting (XSS).
Remember: just as you never fuck without condom, you never surf without your security extensions.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
unless you actively tell it to populate the web page.
So, like, wiggle your leg at the same time you tell it to populate the web page?
pi-hole that shit.
Silence is a state of mime.
are the CEO's arrested yet?
company assets seized?
if not, when will this happen?
More and more, the only defense is don't use it and don't have it.
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
So I wonder how the companies can justify this? I can't think of any compelling legal reason to get users' login information.
0.0.0.0 audienceinsights.net
0.0.0.0 behavioralengine.com
I just tried it with Chrome 63.0.3239.108; it retrieved the username immediately.
The problem is when you accidentally miss click and the dam thing then remembers your password. Then you have to mess about making it forget that you put a password in.
Fortunately, we haven’t found password theft on the 50,000 sites that we analyzed. Instead, we found tracking scripts embedded by the first party abusing the same technique to extract emails addresses for building tracking identifiers.
Why would the first party need to steal my email address / username? I just used it to log in to their site!
.:Semper Absurda:.
I don't think Firefox is vulnerable to this because it requires you to click in the field to fill your credentials first.
I'll just add this as yet another reason to use an ad blocker, a JavaScript blocker and not use a login manager.
"Grab them by the pussy" -- President of the United States of America
BORING.