New issue
Advanced search Search tips

Issue 869857 link

Starred by 1 user

Issue metadata

Status: WontFix
Owner: ----
Closed: Aug 1
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: ----
Type: Bug-Security



Sign in to add a comment

Security: User secrets stored by Chrome browser does not seem to be secure.

Reported by ghanashy...@gmail.com, Aug 1

Issue description

VULNERABILITY DETAILS
User's secrete stored by chrome browser in "Login Data" does not seem to be secure.

VERSION
Chrome Version: 67.0.3396.99 (Official Build) (64-bit)
Operating System: Windows 10 Enterprise 64bit

REPRODUCTION CASE
The user's password to access different services like twitter , facebook etc which is stored by chrome seem to be no more secure. "Login Data" file(sqlite db) stored under \AppData\Local\Google\Chrome\User Data\Default does not seem to be secured one.

1) Try opening the "Login Data" file from its existing location using any SQLite browser.It won't open, and  SQLite browser will prompt for password. Providing user's windows login also it will not open.

2) Copy "Login Data" file to some other location in same computer and try to open using sqlite browser application.The file gets opened and will be able to see complete schema and all user data except the password. Screen shot attached.

3) I tried reading the above data using sqlite API. Compiled a program using sqlite .c and .h and executed following sql query successfully. 

SELECT signon_realm,username_value,password_value,date_created FROM logins 

Could read all the columns specified in sql statement successfully . And tried decrypting the field "password_value" using  CryptUnprotectData() API. I could see the password in clear text. However if the program runs on same computer where "Login Data" is being created then decryption of password using Windows API CryptUnprotectData() is successful.

However it seems to be a security issue as far as user's secret is concerned.

Thanks

ghanashyam.satpathy@gmail.com





 
Google_Login_Data.png
90.7 KB View Download
Status: WontFix (was: Unconfirmed)
Summary: Security: User secrets stored by Chrome browser does not seem to be secure. (was: Security: User's secrete stored by chrome browser does not seem to be secure.)
The only attackers that could take advantage of this are physically-local attackers, which are outside Chrome's threat model:

https://chromium.googlesource.com/chromium/src/+/master/docs/security/faq.md#Why-arent-physically_local-attacks-in-Chromes-threat-model

For defense against forensic attackers, use your operating system's full disk encryption feature.
Labels: -Restrict-View-SecurityTeam allpublic
In this aspect it seems IE is not vulnerable.Any other apps like I explained having access to encrypted data by Chrome with ability of getting in clear text(decrypted) seems to be a vulnerability. And with a decision of WONTFIX from google, it seems to be generous idea to make this disclosure public and make users aware of such vulnerability.

What do you feel on this?

Thanks

Ghanashyam

Sign in to add a comment