Keeper password manager: Ο γνωστός ερευνητής ασφάλειας της Google Tavis Ormandy, ανακάλυψε μια νέα vulnerability affecting Microsoft Windows users.
This time around, the bug is in the Keeper password manager application that comes preinstalled in some versions of Windows 10. Ormandy states that discovered a similar vulnerability in August of 2016.
Although this bug is not a security flaw in Windows or another Microsoft product, it may expose sensitive Windows user details as attackers could steal their passwords stored in the Keeper password manager.
X X X X X X X X X X X X X X X X posted a demo to prove the vulnerability, explaining that it "allows any website to steal any password".
Microsoft, on the other hand, said it knew the issue and said it was preparing to update the application.
"We know the report for this third party application and its developer will release updates to protect our customers," said a company spokesman.
The Keeper password manager app company identified the flaw and immediately released an update to version 11.4.4. THE extension της εφαρμογής για τους browsers Edge, Chrome και Firefox ενημερώνεται αυτόματα.
The Keeper developer reports that the flaw can only be exploited if someone can lead the user to a specially designed page that can take advantage of the flaw.
“This potential vulnerability requires a Keeper user to open a malicious website while logged into the program's extension browsing. It then falsifies the user's details using a technique “clickjacking” to be able to run code with user privileges in the browser extension.
Although the flaw does not exist in the Windows operating system itself, it once again raises questions about Microsoft's strategy to promote third-party software. It is currently not known which computers the Keeper is preinstalled with and what agreement.
The good thing is that everyone can disable the app.
