<- Back
Comments (119)
- gruezThis feels like a case of "It rather involved being on the other side of this airtight hatchway"[1]. If you can read arbitrary process memory, you're probably also in a position to just dump out the passwords by pretending to be the user in question.> If an attacker gains administrative access on a terminal server, they can access the memory of all logged‑on user processes.If an attacker has administrative access, they can also attach a debugger to every chrome process and force it to decrypt all the passwords. The only difference this really makes is in coldboot attacks, but even then it's still not clear whether it makes the attacker's job slightly easier, or allows an attack that's otherwise not possible.[1] https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31...
- ylkFor reference, this is how Google says Chrome stores passwords encrypted in memory and uses an elevated service to prevent other processes from impersonating Chrome and gaining access to the plain text passwords: https://security.googleblog.com/2024/07/improving-security-o...
- kleiba2Does this tool access an Edge instance running on the same machine? Couldn't you then just simply export all saved passwords anyway?https://support.microsoft.com/en-us/topic/export-passwords-i...
- nubinetworkYeah, you can probably do the same thing to pam on linux... just attach gdb to openssh or your getty login process.
- dkenyserAnyone have a link to the source code for this .exe? Would love to see _how_ it's extracting them.
- myHNAccount123
- aslihanaCorrect me if I am wrong but chrome is-at least was- keeping passwords as raw text in Windows too. I got friend's forgotten password from Chrome on 2021 version
- notepad0x90mixed feelings on this, edge is supposed to store creds via DPAPI to the most part. you should also really not use password saving feature on edge (or any browser), it exposes you to a lot more threats that you need.But.. saved passwords are not the same thing as "secrets" the browser uses. It has to be able to provide plain text passwords to websites. This is a really bad feature browsers should just not have to begin with, but they do, and I don't see a better way to use this.In the past, they used to store the passwords in sqlite dbs, but now they've moved away from that at least.From an attack perspective, there maybe some instances where you can dump memory, but you can't attach a debugger to the process without getting caught. so it does make a little bit of a difference there, but microsoft will probably tell you this isn't a security boundary that's being crossed. They can store it via DPAPI in lsass, and if lsass isolation is enabled (only on physical computers, default on win11) even SYSTEM privilege won't get you the credentials.But what's the idea here, you have access to the browser, but you can't visit the site the password is saved for to make it "in use" and in plain text, so you can dump the password? I mean, even if you don't have access to the desktop, you can just start msedge.exe with the URL for the site as an argument and trigger the password retrieval.Edge has done a lot to improve credential security, even DPAPI's existence itself is huge. If your research has meat, that's great but I don't see it here.This feels like some "researcher" hyping themselves up to me, but I could be wrong.Also, I really despise how they posted this on twitter, not even considering the political landmine there, I can't see the comments or threads on there without logging in. I can't visit the site on mobile without being redirected to download the app. I just wanted to mention that if you use X as a security professional in this day and age, my opinion of you drops by like 50% immediately. I don't care if you use bluesky, vk, telegram, discord,facebook, threads or whatever else, twitter is the worst place for you to share your work and you should know better.
- zx8080The only important question is: does Chrome store passwords in the same way as Edge?
- mfroTo be fair, 'loads into memory' and 'stores' are not the same thing.
- LunicLynxYou are absolutely right, having copilot does not help at all here.
- timedudeThat's kinda stupid. The passwords could get swapped to disk in the swap file in plaintext when memory is low by the OS.
- matofEdge is built by a company not focusing on user data-protection, so no surprise here. At least Brave and Firefox are usable and actual competitors, but have a business model based on user security rather than data.
- FuriouslyAdriftA reminder that Edge is just Chromium plus some Microsoft hooks for automated SSO.
- jmclnxIn this day and time Microsoft should really know better. But I have seen this, and worse, happen over and over again in some fortune 500 companies with ERP and in-house systems.I would think this is a local vulnerability assuming Windows works as other OSs.
- busterarmFor anyone that thinks this is an Edge-specific dunk, Chrome does not hash your passwords and they are cleartext in memory while Chrome is running (which for most users is always).
- anonundefined
- WolfeReaderPlease use a dedicated password manager, instead of a browser-based one. KeePass is likely the best going forward.
- fsfloverI don't understand, who are all these people who care about security and at the same time are using Microsoft Edge. Could someone enlighten me? Does it have some specific features that somebody needs?
- thumbsup-_-Its Microsoft doing Microsoft things
- jdlygaMy brain stores all my passwords in memory in clear text too
- mghackerladyWhy wouldn't it? What else would you expect from the p̶e̶o̶p̶l̶e̶ masochists who subjected us to internet explorer
- OptionOfTI think in general one should not assume anything in Edge is done correctly. Microsoft Edge is the place where things get tried out my Microsoft, that's why it changes so fast. It has a built-in updater that is not tied to Windows update, and as such they can iterate incredibly fast.