Automated password extraction attack on modern password managers. Unpublished

To encourage users to use stronger and more secure pass-words, modern web browsers offer users password man-agement services, allowing users to save previously en-tered passwords locally onto their hard drives. We present Lupin, a tool that automatically extracts these saved pass-words without the user’s knowledge. Lupin allows a net-work adversary to obtain passwords as long as the login form appears on a non-HTTPS page. Unlike existing password sniffing tools, Lupin can obtain passwords for websites users are not visiting. Furthermore, Lupin can extract passwords embedded in login forms with a destina-tion address served in HTTPS. To determine the number of websites vulnerable to our attack, we crawled the top 45,000 most popular websites from Alexa’s top website list and discovered that at least 28 % of these sites are vulnerable. To further demonstrate the feasibility of our attack, we tested Lupin under controlled conditions using one of the authors ’ computers. Lupin was able to extract passwords from 1,000 websites in less than 35 seconds. We suggest techniques for web developers to protect their web applications from attack, and we propose alternative designs for a secure password manager.