Slashdot Mirror
Password Managers Can Be Tricked Into Believing That Malicious Android Apps Are Legitimate (zdnet.com)
A new academic study published today reveals that Android-based password managers have a hard time distinguishing between legitimate and fake applications, leading to easy phishing scenarios. From a report: The study looked at how password managers work on modern versions of the Android OS, and which of the OS features attackers can abuse to collect user credentials via phishing attacks carried out via fake, lookalike apps. What the research team found was that password managers, initially developed for desktop browsers, aren't as secure as their desktop versions. The problem comes from the fact that mobile password managers have a hard time associating a user's stored website credentials with a mobile application and then creating a link between that website and an official app.
[...] Researchers say they tested the way five Android password managers create internal maps (connections) between a locally installed app and legitimate internet sites and found that four of the five were vulnerable to abuse. Android versions of password managers from Keeper, Dashlane, LastPass, and 1Password were found to be vulnerable and have prompted the user to auto-fill credentials on fake apps during tests. Researchers found that Google's Smart Lock app did not fall for this fake package name trick, and the reason was because it used a system named Digital Asset Links to authenticate and connect apps to a particular online service.
[...] Researchers say they tested the way five Android password managers create internal maps (connections) between a locally installed app and legitimate internet sites and found that four of the five were vulnerable to abuse. Android versions of password managers from Keeper, Dashlane, LastPass, and 1Password were found to be vulnerable and have prompted the user to auto-fill credentials on fake apps during tests. Researchers found that Google's Smart Lock app did not fall for this fake package name trick, and the reason was because it used a system named Digital Asset Links to authenticate and connect apps to a particular online service.
This is why I just use the same password for everything. It's much easier to remember, and more secure since I don't have to write it down or store it anywhere.
It's still better than iOS password managers: Which forget passwords for sites Apple doesn't want you logging into. In fact, don't use passwords. iTunes is all you'll ever need!
It's curious that there's no mention at all of KeePass and its Android integration apps like the one I use, KeePass2Android. It uses an alternative keyboard to manually inject usernames and passwords, so is it vulnerable to the same trickery?
This is why I use APK's host files thing!
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
The user is the one who was tricked into installing the fake app. Personally, I don't think that apps and websites should be sharing passwords. If I download a new app, I expect to have to type in the password the first time I use it. But even requiring the user to type in the password doesn't fix the problem they are talking about which is when the user thinks it's the real app and willingly gives the app their password either from a password manager or manually.
Never install more than is absolutely necessary. I've only installed a couple apps that are vital (like a decent email app) and nothing else. With my reduced attack surface and less distractions, I'm generally happier.
I use an offline computer and USB printer to maintain my passwords -- the printed passwords include a special character which represents a memorized mini-password
Thanks, App Guy!
Kavanaugh set up gang/train rapes, with his bud Mike Judge spiking the punch to get the lonely/single girls too drunk to know what happened, let alone consent.
as legitimate justices, presidents, and congressional rape-resentatives...
For people who regard Android as suspect, and while chafing at the restrictions of Apple's "walled garden," we still use it because it is simply more secure, despite occasional problems. HOWEVER, whenever there *IS* a security problem, error, oversight, or let's call it what it is, a fuckup, committed by Apple, Android boosters, (or at least, those among them who tend to be assholes,) go NUTS and take to sites like this one, slashdot, and laugh about how we're all idiots for buying Apple products, especially as they often cost more than competitors, because of the benefits they provide, such as overall better security and user experience, most of the time.
My question is this. Is it our turn to laugh at, well, NOT ALL Android fanboys, but the ones who take to places like this and mock Apple, Inc. product users whenever there's a problem in Appletania, is now our time to point and laugh?
SERIOUSLY THOUGH...
This is not the reason I don't use Android, or any product running on Android. Nothing really against the Linux kernel it runs on, but the rest of the OS around it is, in my experience, a sloppy, inconsistent, grotesque, pain in the ass KLUDGE of cobbled together crap that suffers from problems like this all the time, and all the perceived disadvantages you have to put up with using an Apple, or specifically an iOS device, iPhones, iPads, etc., you'll get just the same when you use Android, though the reputation for "openness" that you might mistakenly think makes Android "open" is false, or at least distorted or exaggerated. The fact that Android was bough-out/taken over by Google, (which people maybe were okay with because, you know, "don't be evil",) has made Android basically Google's iOS. Except instead of a company bilking you for overpriced hardware to cover all the background stuff like free software updates, maintaining available storage and data access through iCloud, etc., Google has to make that same money, (and they make LOTS) selling your information, selling YOU, in essence, to their advertisers.
I will pay Google the following backwards compliment: at least they were honest about becoming evil, when they ditched their motto. Android is the fruit of this poisoned tree that is Google, where you think you're getting the handset at cost, (or the software on it, anyway,) and paying what you pay for the device ONLY to cover the cost+profit of the actual company that made the device, such as LG or Samsung, etc., and not much if any money is getting kicked back to Google, (or "Alphabet," as they're pretending they're calling themselves now, almost certainly for nefarious, if not outright evil purposes). The reality though, is that Google is making money off you using Android devices, and it's a devil's bargain.
Our reign has gone on long enough. Indeed. Summon the meteors.
I know. We should be able to accuse anyone of anything and destroy their lives! It's up to the accused to prove they didn't do anything if they want to have a clear name.
You people are insane.
The only password manager to work securely is one run by the OS maker, who use an undocumented API. This sounds very shades of the mid-90's.
Your ad here. Ask me how!
My question is this. Is it our turn to laugh at, well, NOT ALL Android fanboys, but the ones who take to places like this and mock Apple, Inc. product users whenever there's a problem in Appletania, is now our time to point and laugh?
You can always do that.
My question is this. Is it our turn to laugh at, well, NOT ALL Android fanboys, but the ones who take to places like this and mock Apple, Inc. product users whenever there's a problem in Appletania, is now our time to point and laugh?
You can always do that.
Thanks. :)
Our reign has gone on long enough. Indeed. Summon the meteors.