Sen. Tom Cotton Introduces 'Woke Tax' on Top Universities - It's a Bad Idea

Riley Gaines Demolishes Third-Place Female Athelete Who Praised Transgender 'Winners'

In recent years‚ password managers have become a popular way to store and protect all of our passwords in a single place. Until tech companies can fully eliminate the need for passwords as we know them‚ these apps are often the best way to keep track of the dozens or even hundreds of passwords you have to remember. But as convenient as they are‚ there are still risks to using them‚ as researchers from IIIT Hyderabad showed by developing a new attack. In a presentation at Black Hat Europe 2023‚ researchers from Hyderabad's International Institute of Information Technology showed how they were able to steal saved credentials from password managers using a novel attack that they call AutoSpill. As the researchers explain‚ many Android apps use WebView controls to load a webpage within a mobile app. These controls are often used to open hyperlinks or login pages. It turns out many of the top password managers on Android use WebView to automatically fill in users' passwords when they load a login page for Apple‚ Facebook‚ Google‚ and other platforms. AutoSpill is able to take advantage of this process to steal data. "AutoSpill violates Android's secure autofill process‚" the researchers explained. "We found that the majority of top Android PMs were vulnerable to AutoSpill; even without JavaScript injections. With JavaScript injections enabled‚ all of them were found vulnerable." BleepingComputer expounded on their report‚ noting that Android fails to enforce or define any responsibility for the secure handling of the auto-filled data. As a result‚ the data can leak out‚ or a rogue app can capture the data with relative ease. The researchers used AutoSpill on popular password managers on devices running Android 10‚ Android 11‚ and Android 12. 1Password‚ LastPass‚ Enpass‚ Keeper‚ and Keepass2Android were all susceptible to the attacks. The researchers were also able to infiltrate Google Smart Lock and DashLane‚ but they had to enable JavaScript injections. The researchers say they disclosed their findings to the app developers as well as the Android security team. They note that Google and several password manager apps accepted their work as a valid issue and began working on fixes. Several of the developers also responded to BleepingComputer's request for comment about the findings. Here's what Pedro Canahuati‚ CTO of 1Password‚ said: Many people have become accustomed to using autofill to quickly and easily enter their credentials. Through a malicious app installed on the user's device‚ a hacker could lead a user to unintentionally autofill their credentials. AutoSpill highlights this problem.  Keeping our customers’ most important data safe is our utmost priority at 1Password. A fix for AutoSpill has been identified and is currently being worked on.  While the fix will further strengthen our security posture‚ 1Password’s autofill function has been designed to require the user to take explicit action. The update will provide additional protection by preventing native fields from being filled with credentials that are only intended for Android’s WebView. Even if this vulnerability no longer plagues more recent versions of Android or the apps in question‚ it's yet another reminder to be diligent about mobile security. Don't Miss: Was Amazon hacked? Here’s why users are panicking about Amazon Lockers The post Your favorite Android password manager is leaking data appeared first on BGR. Today's Top Deals Today’s deals: $4 smart plugs‚ $249 iPad‚ $99 Beats Solo3 headphones‚ $23 Amazon Echo Dot‚ more Amazon gift card deals‚ offers &; coupons 2023: Get $390+ free Trending Right Now: 8 Apple TV+ comedies to add to your watch list iOS 17.2 is now available with these 18 new features Was Amazon hacked? Here’s why users are panicking about Amazon Lockers

The Colorado Cattlemen's Association and the Gunnison County Stockgrowers Association have initiated legal proceedings against the U.S. Fish and Wildlife Service and Colorado Parks and Wildlife in response to the impending reintroduction of gray...

Abortion providers received nearly $2 billion in federal funding during the COVID-19 pandemic‚ according to a new report from the Government Accountability Office (GAO).

The National Archives and Records Administration informed House Oversight Committee Chairman James Comer‚ R-Ky.‚ that it is in the process of providing unredacted access Joe Biden emails totaling 62‚610 pages from his time as vice president in the Obama...

U.S. Customs and Border Protection (CBP) reportedly is turning to advance technology to help it manage the crisis at the southern border.Last week‚ the agency awarded a contract to Virginia-based Pangiam Intermediate Holdings‚ a leader in facial recognition and advanced...

New Hampshire Gov. Chris Sununu endorsed Republican presidential candidate Nikki Haley on Tuesday‚ six weeks before the state's pivotal first-in-the-nation primary. Sununu appeared with Haley during a campaign town hall at a ski area in Manchester. "This is an opportunity for ...

In the Chicago suburbs of Cicero and Rosemont‚ authorities have taken measures against buses transporting illegal migrants from El Paso‚ Texas‚ the Washington Examiner reported Tuesday.

LONDON — Legendary film director Tim Burton announced another upcoming film starring actors Johnny Depp and Helena Bonham Carter where everyone is pale and weird.