In its place steal money directly from your bank account or some cryptocurrenciesTHE hackers can target logins and passwords that you use to connect to different online services. A way to get into them while leaving fewer traces. To prevent someone from guessing your passwords, you’ve gotten into the habit of storing them in a password manager. randomly generated And stored securely.
Unfortunately, no matter how protected they are, these programs are not foolproof. We remember that LastPass suffered two major cyber attacks, after which the hackers parted with the equivalent of 4.2 million euros. As if that wasn’t enough, researchersInternational Institute of Information Technologies discovered a new type of attack called. Automatic Spill. Affecting Password managers on Androidoccurs right now the app automatically completes the login information.
AutoSpill attack steals usernames and passwords saved in certain administrators
To understand, you need to know that most Android apps use it. Web View For view web content. For example, this allows you to see a service’s home page directly in the app rather than being redirected in the browser. Android password managers also use WebView to autofill credentials. This is where there is a flaw and it can even be exploited. without hacker injecting JavaScript code to execute certain commands.
AutoSpill takes advantage of the fact that Android doesn’t (or can’t) fully define Who is responsible for the security of the data? It passes during autocompletion. A fake app displaying a login page could steal information if hacked without the user realizing.
The teams tested Google Smart Lock, dashlane, 1Password, Last Pass, To go past, Keepass2Android And Goalkeeper. Alone Google Smart Lock and Dashlane are not vulnerable to Autofill Without javascript injection. If it exists, everyone is affected. Spokespeople for 1Password, LastPass, Keeper Security and Google stated that they are either working on a fix or already have security measures in place against such attacks.
Source : beeping computer
