Keeper password manager: Google security researcher Tavis Ormandy has discovered a new vulnerability that affects Microsoft Windows users.
This time around, the bug is in the Keeper password manager application that comes preinstalled in some versions of Windows 10. Ormandy states that discovered a similar vulnerability in August of 2016.
Although this bug is not a security flaw in Windows or another Microsoft product, it may expose sensitive Windows user details as attackers could steal their passwords stored in the Keeper password manager.
X X X X X X X X X X X X X X X X posted a demo to prove the vulnerability, explaining that it "allows any website to steal any password".
Microsoft, on the other hand, said it knew the issue and said it was preparing to update the application.
"We are aware of the report about this third-party app and its developer will be releasing updates to protect our customers," a spokesperson said. companys.
The Keeper password manager app company spotted the flaw and immediately released an updated one version in version 11.4.4. The application extension for Edge, Chrome and Firefox browsers is updated automatically.
The Keeper developer reports that the flaw can only be exploited if someone can lead the user to a specially designed page that can take advantage of the flaw.
"This potential vulnerability requires a Keeper user to open a malicious website while logged in to the browser extension. It then falsifies the user data using a "clickjacking" technique so that it can run code with user rights in the browser extension.
Although the defect does not exist in itself operating system of Windows, once again raises questions about Microsoft's strategy to promote third-party software. It is currently unknown on which computers Keeper is pre-installed and under what agreement.
The good thing is that everyone can disable the app.
