There are a number of problems with the security model of 1Password that results in the local security model being disabled, as well as a number of security, sandboxing and virtualization features.

1Password works by creating a WebSocket server on localhost, and then the browser extension connects to ws://127.0.0.1:6263/4 and requests passwords without any authentication other than the Origin header. Naturally, users can lie about the Origin, so when a client connects to the WebSocket port the server uses GetExtendedTcpTable() and then searches for a matching client. This is similar to running netstat to see who owns a socket.

When a match is found, 1Password attempts to OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_DUP_HANDLE | PROCESS_VM_READ) the process id to verify that it's owned by the right user. If that succeeds, they query the image filename and use WinVerifyTrust() and ImageEnumerateCertificates() to check if the image was signed by a known browser vendor.

There are a number of problems with this approach.

Firstly, OpenProcess() succeeding does not imply that the process is trusted. Any unprivileged user can attach a NULL or empty DACL to a process, something like this:

    InitializeSecurityDescriptor(&Descriptor, SECURITY_DESCRIPTOR_REVISION);
    SetSecurityDescriptorDacl(&Descriptor, TRUE, NULL, FALSE);

    Attributes.nLength              = sizeof(SECURITY_ATTRIBUTES);
    Attributes.bInheritHandle       = TRUE;
    Attributes.lpSecurityDescriptor = &Descriptor;
    StartupInfo.cb                  = sizeof(STARTUPINFO);

    CreateProcess("TEST.EXE",
                  "TEST.EXE",
                  &Attributes,
                  NULL,
                  TRUE,
                  0,
                  NULL,
                  NULL,
                  &StartupInfo,
                  &ProcessInfo));


That will permit anyone else to OpenProcess() it. The trust verification on imagefiles is inherently vulnerable to TOCTOU, and therefore any user can dump the passwords of any other user. I've attached two examples, allowopen.c that will create a process with an empty DACL and testopen.c that does the same authentication that 1Password does for testing.

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.

 

allowopen.c 1.2 KB View Download

testopen.c 402 bytes View Download