AutoSpill

Zero Effort Credential Stealing from Mobile Password Managers
Ankit Gangwal, Shubham Singh, Abhijeet Srivastava
IIIT Hyderabad, IN

Disclaimer: All logos, photos, etc. used in this presentation are the property of their respective copyright owners and are used here for educational purposes only. #BHEU @BlackHatEvents

Introduction

2

#BHEU

@BlackHatEvents

Introduction

InternetInformation Age

3

#BHEU

@BlackHatEvents

Introduction
Connect the world

4

#BHEU

@BlackHatEvents

Introduction
Become the world

5

#BHEU

@BlackHatEvents

Introduction
Connecting to the Internet

Different devices6#BHEU@BlackHatEvents

Introduction
Desktop vs. mobile

Desktop43%

Mobile57%

Worldwide device market share - 2023
7
Data source: https://gs.statcounter.com/platform-market-share/desktop-mobile-tablet/worldwide/#monthly-202301-202311-bar#BHEU@BlackHatEvents

Introduction
Desktop vs. mobile

Mobile65%

Desktop
35%

Worldwide Internet traffic share - Q1 2023
Data source: https://www.similarweb.com/platforms/

8

#BHEU

@BlackHatEvents

Introduction
Mobile devices

65

63
59.54

60
55.78
55%

51.12
50

52.4

52.6

52.2

2018

2019

2020

48.33

4540
35

38.43

2015

2016

2017

2021

2022

2023

Worldwide mobile Internet traffic trend
9
Data source: https://www.statista.com/statistics/277125/share-of-website-traffic-coming-from-mobile-devices/#BHEU@BlackHatEvents

Introduction
The big shift - Oh my!

10

#BHEU

@BlackHatEvents

Introduction
The big shift - Oh my!

11

#BHEU

@BlackHatEvents

Introduction
The big shift - Oh my!

12

#BHEU

@BlackHatEvents

Introduction
The big shift - Oh my!

13

#BHEU

@BlackHatEvents

Introduction
The big shift - Oh my!

14

#BHEU

@BlackHatEvents

Introduction
The big shift - Oh my!

15

#BHEU

@BlackHatEvents

Introduction

PASSWORD
MANAGERS16#BHEU@BlackHatEvents

Introduction

Log in with

17

#BHEU

@BlackHatEvents

Introduction

Log in with

18

#BHEU

@BlackHatEvents

BackgroundPassword Managers (PMs)Store & manage
Choose stronger passwords
Automatically fill (autofill)
Userxxxx

19

#BHEU

@BlackHatEvents

BackgroundPMs are becoming increasingly commonComputers as well as mobile devices (e.g., smartphones) [1, 2][1] Sean Oesch, Anuj Gautam, and Scott Ruoti, “The Emperor’s New Autofill Framework: A Security Analysis of Autofill on iOS and Android,” In Annual Computer
Security Applications Conference. 996-1010, 2021.
[2] Sean Oesch and Scott Ruoti, “That was then, this is Now: A Security Evaluation of Password Generation, Storage, and Autofill in Browser-based Password#BHEU @BlackHatEvents
20
Managers,” In USENIX Security Symposium. 2165-2182, 2020.

BackgroundPMs on computers
Generally, implemented as browser extension

21

#BHEU

@BlackHatEvents

BackgroundPMs on computers
Generally, implemented as browser extension
Handles everything

Storing, rendering, prompting, autofilling

22

#BHEU

@BlackHatEvents

BackgroundPMs on computers
Generally, implemented as browser extension
Handles everything

Storing, rendering, prompting, autofilling

Autofill ceremony involves only two parties

23

#BHEU

@BlackHatEvents

BackgroundPMs on mobile OSes (e.g., Android)
System-wide autofill frameworks & sandboxing
Autofill ceremony involves at least three parties

24

#BHEU

@BlackHatEvents

BackgroundPMs on mobile OSes (e.g., Android)
System-wide autofill frameworks & sandboxing
Autofill ceremony involves at least three parties

25

#BHEU

@BlackHatEvents

BackgroundPMs on mobile OSes (e.g., Android)
System-wide autofill frameworks & sandboxing
Autofill ceremony involves at least three parties

26#BHEU@BlackHatEvents

BackgroundPMs on mobile OSes (e.g., Android)
System-wide autofill frameworks & sandboxing
Autofill ceremony involves at least three parties

27

#BHEU

@BlackHatEvents

BackgroundPMs on mobile OSes (e.g., Android)
System-wide autofill frameworks & sandboxing
Autofill ceremony involves at least three parties

28

#BHEU

@BlackHatEvents

Background
Mobile OSes have developed WebView controls
Act as a minimalistic browser
Empower an app to render web content within itself
Prevents redirection to main browser app

29

#BHEU

@BlackHatEvents

Background
Mobile OSes have developed WebView controls
Act as a minimalistic browser
Empower an app to render web content within itself
Prevents redirection to main browser app

30

#BHEU

@BlackHatEvents

AutoSpill

31

#BHEU

@BlackHatEvents

AutoSpill
PM is invoked to fill fields in an app

32

#BHEU

@BlackHatEvents

AutoSpill
PM is invoked to fill fields in an app

33

#BHEU

@BlackHatEvents

AutoSpill
PM is invoked to fill fields in a WebView

34

#BHEU

@BlackHatEvents

AutoSpill
PM is invoked to fill fields in a WebView

35

#BHEU

@BlackHatEvents

AutoSpill
PM is invoked to fill fields in a WebView
Example 1“Login with Apple/Facebook/Google/etc.” buttons
36

#BHEU

@BlackHatEvents

AutoSpill
PM is invoked to fill fields in a WebView
Example 2

Logging in OneDrive app, which supports 3rd party authentication
37

#BHEU

@BlackHatEvents

AutoSpill
PM is invoked to fill fields in a WebView
Example 2

Logging in OneDrive app, which supports 3rd party authentication
38

#BHEU

@BlackHatEvents

AutoSpill
PM is invoked to fill fields in a WebView
Example 2

Logging in OneDrive app, which supports 3rd party authentication
39

#BHEU

@BlackHatEvents

AutoSpill
Credential leakage from HW to HA = AutoSpill

Violation of secure autofill process
Responsibility for leakage is stranded between PM and Android
40

#BHEU

@BlackHatEvents

AutoSpill
Credential leakage from HW to HA = AutoSpill

A real-world credential AutoSpill from Facebook page
41

#BHEU

@BlackHatEvents

AutoSpill
Biggest benefit (rather risk!) of AutoSpill+ Phishing is not required

1. Benign app with input fields
2. Invokes HW
3. Code for processing+ No malicious code in app

Reside on official app store

42

#BHEU

@BlackHatEvents

AutoSpill - Investigation
Created a custom autofill service
Information exchanged during autofill ceremony

43

#BHEU

@BlackHatEvents

AutoSpill - Investigation
Created a custom autofill service
Information exchanged during autofill ceremony
1. Autofill request from Android to autofill service
AssistStructure [3][3] AssistStructure, https://developer.android.com/reference/android/app/assist/AssistStructure
44

#BHEU

@BlackHatEvents

AutoSpill - Investigation
Created a custom autofill service
Information exchanged during autofill ceremony
1. Autofill request from Android to autofill service
2. Processing and response from autofill service
AssistStructure [3]Datasets [4][3] AssistStructure, https://developer.android.com/reference/android/app/assist/AssistStructure
45[4] Datasets, https://developer.android.com/reference/android/service/autofill/Dataset#BHEU@BlackHatEvents

AutoSpill - Investigation
1. Autofill request fromAndroid to autofill service

46

#BHEU

@BlackHatEvents

AutoSpill - Investigation
1. Autofill request fromAndroid to autofill service

47

#BHEU

@BlackHatEvents

AutoSpill - Investigation
2. Request processing and response from autofill service

48

#BHEU

@BlackHatEvents

AutoSpill - Investigation
2. Request processing and response from autofill service

49

#BHEU

@BlackHatEvents

AutoSpill - Investigation
2. Request processing and response from autofill service

50

#BHEU

@BlackHatEvents

AutoSpill - Investigation

Report51#BHEU@BlackHatEvents

AutoSpill - Investigation

Report+ Always renders NativeView data
- Even for requests from a WebView- Creates confusion for autofill service

52

#BHEU

@BlackHatEvents

AutoSpill - Investigation

Report+ Always renders NativeView data
- Even for requests from a WebView- Creates confusion for autofill service+ Parses entire AssistStructure- No track of parent view’s WebDomain- Identifies incorrect target input fields
53

#BHEU

@BlackHatEvents

AutoSpill - Investigation

Report54#BHEU@BlackHatEventsResults
PMs consideredPM
Google Smart Lock
DashLane
1Password
LastPass
EnpassKeepass2Android
KeeperVersionPM’s autofill approach
13.30.8.26.arm64 OpenYOLO
6.2221.3-arm64-v8a OpenYOLO
7.9.4 Autofill Framework
5.11.0.9519 Autofill Framework
6.8.2.666 Autofill Framework
1.09c-r0 Autofill Framework
16.4.3.1048 Autofill Framework

Configurations of devices used
Model
Poco F1
Samsung Galaxy Tab S6 Lite
Samsung Galaxy A52

TypeSmartphone
TabletSmartphone

Android version
Android 10Android 11Android 1255

Android security patch
December 2020
January 2022
April 2022
#BHEU

@BlackHatEventsResults
Without JavaScript support
Native fields present in HAPM2

1

1

1

Bothusername,password
✓✓
✗
U+P
U+P
U+P
U+P

Only
username
✓
✓✗
UUUU

Only
password
✓✓PP
PP
P

Only
none
✓
✓
UUUUU

Google Smart Lock
Dashlane
1Password
LastPassEnpass
Keepass2Android
Keeper✓: No AutoSpill, safe✗: Autofilling not working at all
U: AutoSpills username
P: AutoSpills password
U+P: AutoSpills both username and password

56

JavaScript
injection

Disabled#BHEU@BlackHatEventsResults
With JavaScript support
Native fields present in HAPM

211

1

Bothusername,password
U+PU+P
✗
U+P
U+P
U+P
U+P

Only
username
U/P
U/P
✗U/P
U/P
U/P
U/P

Only
password
U/P
U/P
U/P
U/P
U/P
U/PU/P

Only
none
U/P
U/P
U/P
U/P
U/PU/PU/P

Google Smart Lock
Dashlane
1Password
LastPass
EnpassKeepass2Android
Keeper✗: Autofilling not working at all.
U+P: HA accessed and stole both username and password
U/P: HA accessed both username and password, stole credential of choice.

57

JavaScript
injection

Enabled#BHEU@BlackHatEvents

Video time!

58

#BHEU

@BlackHatEvents

Countermeasures

59

#BHEU

@BlackHatEvents

Countermeasures
AssistStructure data for request-triggering view only
No excessinformation!

60

#BHEU

@BlackHatEvents

Countermeasures
AssistStructure data for request-triggering view only
Non-null WebDomain into HTML elements
No excessinformation!

61

#BHEU

@BlackHatEvents

Countermeasures
AssistStructure data for request-triggering view only
Non-null WebDomain into HTML elements
No excessinformation!

Keep a track of parent view’s WebDomain
No excessprocessing!

62

#BHEU

@BlackHatEvents

Countermeasures
AssistStructure data for request-triggering view only
Non-null WebDomain into HTML elements
No excessinformation!

Keep a track of parent view’s WebDomain
No excessprocessing!

Run-time AutoFillId from AssistStructure to
Identify & process request-triggering field
Supply values back only for request-triggering view
63

#BHEU

@BlackHatEvents

Black Hat Sound Bytes• PMs work under the constraints of Android’s app sandboxing• Excess information (from Android) and excess processing (byPMs) lead to credential AutoSpill• Android and PM developers must work together to fix AutoSpill

64

#BHEU

@BlackHatEvents

Image credits
Evil image by Freepik - Flaticon, www.flaticon.com/free-icons/evil
Markus Spiske, Coding, www.pexels.com/photo/technology-computer-desktop-programming-113850
Worldwide image by Prosymbols Premium - Flaticon, www.flaticon.com/free-icons/worldwide
Internet image by Stickers - Flaticon, www.flaticon.com/free-stickers/internet
Devices image by Freepik - Flaticon, www.flaticon.com/free-icons/devicesRouting image by Iconjam - Flaticon, www.flaticon.com/free-icons/routing
Conveyor-belt image by Freepik - Flaticon, www.flaticon.com/free-icons/conveyor-beltTraffic control image by Freepik - Flaticon, www.flaticon.com/free-icons/traffic-control
iPhone image by Freepik - Flaticon, www.flaticon.com/free-icons/iphone
iPad image by Freepik - Flaticon, www.flaticon.com/free-icons/ipad
iMac image by Freepik - Flaticon, www.flaticon.com/free-icons/computer
Ecommerce images by Eucalyp - Flaticon, www.flaticon.com/free-icons/ecommerce
Login image by bearicons - Flaticon, www.flaticon.com/free-icons/login
Filistic, iOS icon pack, www.etsy.com/listing/1343526218/ios-16-app-icon-pack-with-100-aesthetic
Checklist image by Freepik - Flaticon, www.flaticon.com/free-icons/checklist
Pain image by Smashicons - Flaticon, www.flaticon.com/free-icons/pain
Password image by Smashicons - Flaticon, www.flaticon.com/free-icons/password
Center focus image by Freepik - Flaticon, www.flaticon.com/free-icons/center-focus
Wikimedia Commons, Android, commons.wikimedia.org/wiki/File:Android_robot.svg
Database image by Freepik - Flaticon, www.flaticon.com/free-icons/database
Selection image by Freepik - Flaticon, www.flaticon.com/free-icons/selectLogin image by srip - Flaticon, www.flaticon.com/free-icons/login
Form image by Freepik - Flaticon, www.flaticon.com/free-icons/form
Phone image by juicy_fish - Flaticon, www.flaticon.com/free-icons/cell-phone
Desktop image by Vichanon Chaimsuk - Flaticon, www.flaticon.com/free-icons/login
Puzzle image by riajulislam - Flaticon, www.flaticon.com/free-icons/puzzle
Webpage image by Eucalyp - Flaticon, www.flaticon.com/free-icons/webpage
Mobile image by amonrat rungreangfangsai - Flaticon, www.flaticon.com/free-icons/application
Playstore image by justicon - Flaticon, www.flaticon.com/free-icons/playstore
Sandbox image by juicy_fish - Flaticon, www.flaticon.com/free-icons/sandbox
Oil-spill image by nawicon - Flaticon, www.flaticon.com/free-icons/oil-spill
Wikimedia Commons, Mad scientist, commons.wikimedia.org/wiki/File:Mad_scientist_transparent_background.svg
Investigation image by Dewi Sari - Flaticon, www.flaticon.com/free-icons/investigation
Lazy Owl, "The lucifer effect: Why good people turn bad?" www.youtube.com/watch?v=1RwhkZFDYmY
Wikimedia Commons, Popcorn, commons.wikimedia.org/wiki/File:Popcorn.svg
Thank you image by Freepik - Flaticon, www.flaticon.com/free-icons/thank-you
65
QA image by Freepik - Flaticon, www.flaticon.com/free-icons/qa#BHEU@BlackHatEvents

AutoSpill attack by:
Ankit Gangwal (gangwal@iiit.ac.in)
Shubham SinghAbhijeet Srivastava

66

#BHEU

@BlackHatEvents