论文标题
重新访问商业密码经理中的安全漏洞
Revisiting Security Vulnerabilities in Commercial Password Managers
论文作者
论文摘要
在这项工作中，我们分析了五个流行的商业密码管理器，以了解安全漏洞。我们的分析是双重的。首先，我们通过对学术和非学术资源进行全面审查来编译先前披露的漏洞清单，并针对所有先前披露的漏洞测试每个密码经理。我们发现固定和持续存在的漏洞的混合图片。然后，我们对所考虑的密码管理器进行系统的功能测试，并找到四个新漏洞。值得注意的是，我们确定的新漏洞之一允许恶意应用程序将合法的应用模仿我们测试的五个广泛使用的密码管理器中的两个，因此窃取了目标服务的用户密码。我们实施了概念验证攻击，以在现实生活中显示这种脆弱性的可行性。最后，我们报告并反思了我们负责披露新发现的漏洞的经验。
In this work we analyse five popular commercial password managers for security vulnerabilities. Our analysis is twofold. First, we compile a list of previously disclosed vulnerabilities through a comprehensive review of the academic and non-academic sources and test each password manager against all the previously disclosed vulnerabilities. We find a mixed picture of fixed and persisting vulnerabilities. Then we carry out systematic functionality tests on the considered password managers and find four new vulnerabilities. Notably, one of the new vulnerabilities we identified allows a malicious app to impersonate a legitimate app to two out of five widely-used password managers we tested and as a result steal the user's password for the targeted service. We implement a proof-of-concept attack to show the feasibility of this vulnerability in a real-life scenario. Finally, we report and reflect on our experience of responsible disclosure of the newly discovered vulnerabilities to the corresponding password manager vendors.
