On Getting Hacked

Lookup Dom-based clickjacking. It will "autofill" the field but on submission it sends the data to an attacker.

"The new technique detailed by Tóth essentially involves using a malicious script to manipulate UI elements in a web page that browser extensions inject into the DOM -- for example, auto-fill prompts, by making them invisible by setting their opacity to zero.

The research specifically focused on 11 popular password manager browser add-ons, ranging from 1Password to iCloud Passwords, all of which have been found to be susceptible to DOM-based extension clickjacking. Collectively, these extensions have millions of users."

""All password managers filled credentials not only to the 'main' domain, but also to all subdomains," Tóth explained. "An attacker could easily find XSS or other vulnerabilities and steal the user's stored credentials with a single click (10 out of 11), including TOTP (9 out of 11). In some scenarios, passkey authentication could also be exploited (8 out of 11).""

More info: https://marektoth.com/blog/dom-based-extension-clickjacking/

Originally discussed at DEFCON 33

> I went on looking for one of those browser extensions that made it easier to read. [...] I had to find the perfect one, with the cleanest user interface, the best features, the most convenient, across all cases and needs.

Examining the supply chain of those extensions and whether they were open-source and reputable should have been part of the evaluation process!

Also surely there is no reason to install any "dark reader" extension aside from the canonical Dark Reader...? https://github.com/darkreader/darkreader I thought this one was very well-known. I still wouldn't recommend _using_ it, you remain at risk of upstream's supply chain being compromised, but it's at least not malicious by default.

Firefox has dark mode built into its reader view feature which works on most websites, I'd imagine Chrome can do something similar. I greatly prefer and recommend this over installing an extension.

The DM came from an old gaming friend of mine that actually was a developer. I’d known him for years and had playtested for him before - though it was years prior. Literally nothing about it seemed fishy.

As soon as the game “crashed on load” and Discord took its focus, I realized what had happened. I managed to change my Discord password, revoke all session tokens, and lock them out while they were buying things from the Discord store. Then I went through, changed my critical passwords, froze all the cards that are in my Bitwarden vault except one with a very low limit I kept alive as a canary, and started my post-mortem.

Turns out the malware did in fact attempt to exfil my Bitwarden vault. Thankfully, I have it configured to remain locked always and to require a security token to use, so they didn’t get anything unencrypted.

Between my initial response, analysis, dealing with changing passwords, and wiping my desktop out of an abundance of caution, I lost a total of about 12 hours. The attacker managed to buy about $60 of stuff on Discord before I shut them down there. Oh, and I got extortion messages from various accounts claiming to be them for months.

One thing that did surprise me was that while I was revoking access, they were trying to convince me they had all my credentials. They sent a screenshot logged in to my Autodesk account, of all things. That freaked me out, but I quickly realized that that particular email/password had been leaked and that the attacker was using it to try to convince me they had much more damaging information than they really did.

> The new technique detailed by Tóth essentially involves using a malicious script to manipulate UI elements in a web page that browser extensions inject into the DOM -- for example, auto-fill prompts, by making them invisible by setting their opacity to zero

The website is compromised, all bets are off at that point. Of course a password manager, regardless of how good it is, won't defeat the website itself being hacked before you enter your credentials.

That's not a "hijack of autofill", it's a "attacker can put whatever they want in the frontend", and nothing will protect users against that.

And even if that is an potential issue, using it as an argument why someone shouldn't use a password manager, feels like completely missing the larger picture here.