New issue
Advanced search Search tips

Issue 864334 link

Starred by 1 user
Status: Duplicate
Merged: issue 126398
Owner: ----
Closed: Jul 17
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: ----
Type: Bug-Security



Sign in to add a comment

Security - passwords phishing

Reported by dar...@gmail.com, Jul 17 
This template is ONLY for reporting security bugs. If you are reporting a
Download Protection Bypass bug, please use the "Security - Download
Protection" template. For all other reports, please use a different
template.

Please READ THIS FAQ before filing a bug: https://chromium.googlesource.com
/chromium/src/+/master/docs/security/faq.md

Please see the following link for instructions on filing security bugs:
https://www.chromium.org/Home/chromium-security/reporting-security-bugs

NOTE: Security bugs are normally made public once a fix has been widely
deployed.

VULNERABILITY DETAILS
I work for a big multinational and we recently were migrated to provider to handle our stock portfolio. by coincidence I just come around with a potential security issue, which enables anyone to obtain a password quickly given the case one can access someone else system just for a few moments. This vulnerability is particular relevant to enterprise customers where users usually leave their systems unattended and without attention for long periods of time.
There are no needs for high hacking skills or installation of any 3rd party apps.
With the full consent of two of colleagues, I verified one can indeed obtain their passwords easily from chrome. I believe other explorers have the same issue.
I would like someone to contact me so I can provide more details.

VERSION
Chrome Version: [Version 67.0.3396.99 (Official Build) (32-bit)]
Operating System: [Windows10 Version1709 Build 16299.492]

REPRODUCTION CASE
Please include a demonstration of the security bug, such as an attached
HTML or binary file that reproduces the bug when loaded in Chrome. PLEASE
make the file as small as possible and remove any content not required to
demonstrate the bug.

FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION
Type of crash: [tab, browser, etc.]
Crash State: [see link above: stack trace *with symbols*, registers,
exception record]
Client ID (if relevant): [see link above]

Comment 1 by dominickn@chromium.org, Jul 17

Status: WontFix (was: Unconfirmed)
Hi,

Thanks for the report. Being able to physically access someone else's machine is something Chrome cannot protect you against. An attacker with physical access can simply take the hard drive out of the machine if they wish.

See https://chromium.googlesource.com/chromium/src/+/master/docs/security/faq.md#Why-arent-physically_local-attacks-in-Chromes-threat-model for more details.

Comment 2 by dar...@gmail.com, Jul 18 

Thanks for your fast answer - apparently you dont understand the issue so ill be more explicit.

Accessing someones machine for a short period of time, while unlocked is easily within an Enterprise environment. It will pass completely unnoticed while taking a hard disk, most likely will be noticed and reported immateriality.

Allow me to provide you with a real example (attached in PDF)
Go to a some HTML site for which Chrome has previously saved the password.
Right clock somewhere in the page and select Inspect from the menu.
Place the cursor over the Password field. From the code replace "type=password" to "type=text"-> then the stored password will be revealed.

Regards
Dario
password.pdf
836 KB Download

Comment 3 by tsepez@chromium.org, Jul 18

Mergedinto: 126398
Status: Duplicate (was: WontFix)
Apparently you don't understand the issue, so I'll be more explicit.  No matter how common, accessing someones machine for a short period of time while unlocked is inherently unsafe and must not be allowed to happen, period, and there is nothing that chrome -- or any app -- can do to provide a reliable guarantee of safety in this case.

See https://chromium.googlesource.com/chromium/src/+/master/docs/security/faq.md#what-about-unmasking-of-passwords-with-the-developer-tools for the case about developer tools.
Project Member

Comment 4 by sheriffbot@chromium.org, Oct 23

Labels: -Restrict-View-SecurityTeam allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
►

Sign in to add a comment