Draining Your Credentials From Popular MacOS Password Managers
summary
Five popular macOS password managers are tested and all yield credentials: native MacPass accepts plugins via disabled library validation so a malicious plugin dumps the vault; Keeper from the App Store lacks no hardened runtime allowing a loaded keylogger; an Electron-based manager exposes fuses and a custom debug hook used by the open-source Electronis tool to steal passwords; KeePassXC’s browser-extension key is recoverable from local storage; LastPass’ extension is exfiltrated via a selenium-controlled browser. All demos are implemented as PoC plugins/scripts and work reliably.
AI-written summary · about
chapters (11)
- 0:00Introduction to talk
- 1:52MacOS security isolation
- 10:08System Integrity Protection
- 18:37Password manager targets
- 22:54Exploiting MacPass
- 27:17Keeper vulnerability
- 30:04NordPass electron flaws
- 32:13KeepassXC browser extension
- 35:02LastPass plugin attack
- 37:11Summary and recommendations
- 38:56Q&A session
related talks
24mThe Emperor’s New Password Manager
53mEven The Lastpass Will Be Stolen, Deal With It!
35mAutoSpill: Zero Effort Credential Stealing from Mobile Password Managers
06mOur future without passwords
26mHow password managers are built for Privacy and Security
47mThe state of passwordless auth on the web
49mInside the Information Stealer Ecosystem: From Compromise...
45mmacOS application isolation and its exploitation