Man-in-the-Machine: Exploiting Ill-Secured Communication Inside the Computer
summary
An unprivileged co‑user process impersonates IPC endpoints on Windows, macOS and Linux and intercepts sensitive data by binding to localhost sockets, named pipes or USB HID endpoints. RoboForm’s HTTP server responds to any client so RoboForm unprotected IPC lets an attacker pull the full password database; onepassword’s flawed key‑exchange allows WebSocket server impersonation and form‑capture; proxying USB U2F challenges achieves a 100% success rate against tested services (Facebook, GitHub). Vendors are notified; most issues are patched.
AI-written summary · about
chapters (13)
- 0:00Intro
- 0:30Traditional network threat model
- 1:06Our focus: Inter-process communication (IPC)
- 2:06Man-in-the-Machine (Mitma)
- 5:10What makes IPC vulnerable
- 7:08Standalone password managers
- 8:34Client impersonation on RoboForm
- 11:35Server impersonation on 1Password
- 12:32FIDO U2F security key
- 14:02Unauthorized access of FIDO U2F key
- 16:58Mitigation
- 18:13Conclusion
- 19:411Password - Key derivation protocol
related talks
49mInside the Information Stealer Ecosystem: From Compromise...
40mGet Rich or Get Hunted Trying: Uncovering Large Scale Fraud Operations
26mTechnical Tracks
48mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
21mSecurity is Everyone's Responsibility
34mBreaching the Perimeter via Cloud Synchronized Browser Settings
40mHacker’s Paradise: Top 10 Biggest Threats When Working From Home
42m"Vulnerabilities from a grave. Forever dead or maybe alive..."