Why You Should Never Store Passwords in Web Browsers

In a bid to not always have to type in your Passwords, you take Google’s option of storing them in your web browser. But is it safe?

Learn more from the video below.

Watch the Video

https://www.youtube.com/watch?v=yBy2H6VZqpA&ab_channel=GrantCollins

00:00

all right so have you ever been up on a

00:01

website such as the one right in front

00:03

of me

00:04

and you're on your browser and you have

00:06

the option to save your password

00:08

now this is a very standard thing to do

00:09

just go ahead and click save and move

00:11

forward although it may be

00:13

a standard practice it is not the most

00:14

secure way to store your passwords

00:16

so in today's video i'm going to show

00:18

you why it is that you should never

00:20

store your passwords in

00:21

browser through a couple of

00:22

demonstrations and then after that i'm

00:24

going to quickly overview

00:25

some solutions that you can use to

00:27

tackle this

00:28

problem before i get started with demo

00:30

one allow me to overview the scope of

00:32

attack and target devices

00:33

so for double one i will be overviewing

00:35

and running a simple python script to

00:37

capture passwords through the google

00:38

chrome browser

00:39

because google chrome browser has the

00:41

majority share in the browser market and

00:43

windows has the lead in the os wars i

00:45

will be using both

00:46

services to conduct my attack demo for

00:48

number two i will be switching up things

00:50

moving over to my home lab environment

00:52

which is running an ubuntu 1804 desktop

00:54

lts version this environment i have a

00:56

post exploitation tool

00:58

installed to capture passwords this time

01:00

the scope is mozilla firefox as my

01:02

browser in

01:03

linux as my os now let's just talk about

01:05

some general limitations to each of

01:07

these attacks first off both demos

01:08

require a scenario where the attacker

01:10

has full remote or physical access

01:13

with correct privileges to the target

01:14

machine also they both require

01:16

python 2.7 or 3.8 to be installed to use

01:20

the python script or

01:21

post exploitation tool alright so with

01:23

this behind us let's get into

01:25

demo number one

01:26

[Music]

01:30

all right so for the first demonstration

01:32

this is a bit outdated

01:34

all you need is a remote access to a

01:36

windows machine as well as python

01:38

installed so with that being said let's

01:40

go ahead and transition over to my

01:42

screen here

01:43

in front of me i have a virtual

01:45

connection to my home lab which is

01:46

running a virtual machine

01:48

specifically windows 10 home edition

01:51

now this virtual machine has the latest

01:53

version of google chrome installed

01:55

and it has python 3.8 installed so for

01:58

the first technique

01:59

it is a python script which allows you

02:01

to get the username and

02:03

password in front of me i have a python

02:05

script which i pulled off

02:07

from an online article link in the

02:09

description below as well on the side of

02:10

the screen

02:11

full credit goes to this author i made

02:13

just a couple of edits for my specific

02:16

use case

02:16

up until chrome 79 you could get all the

02:18

passwords and usernames

02:20

and to do this all you had to do was go

02:22

to the folder location where chrome

02:25

stores its passwords

02:26

get the website url the value in the

02:29

password value

02:30

right here from the sql database and

02:33

then you could iterate through

02:34

the lines and get the password so i'm

02:37

gonna go ahead and

02:38

run this in my case and you're gonna see

02:41

two things

02:42

the first thing is a tuple and we're

02:44

gonna go over that in a moment but the

02:45

second thing

02:46

is an error from chrome 80 and up google

02:49

made a patch or changed their method of

02:52

storing the password

02:53

which no longer allows you to unencrypt

02:56

the password

02:57

in this case it's a bit outdated if you

02:58

were to find a machine

03:00

say in chrome 79 you could go ahead and

03:02

use this method the first

03:04

bit of output is a tuple and in this

03:06

case

03:07

we can locate both the websites as well

03:11

as the

03:11

username so we have both of those things

03:14

and then as you can see here we have an

03:16

encrypted password which we don't have

03:19

access

03:20

to now you do have to have a saved

03:22

password in google chrome which i went

03:24

ahead and saved

03:25

and there you go you can get the website

03:28

as well

03:28

as the username it's not very

03:31

sophisticated anymore it's outdated but

03:33

if it is up to chrome 79 you can go

03:35

ahead and do this

03:36

method now let's get on to demonstration

03:39

number two

03:45

all right for the second demonstration

03:46

we're going to be quickly reviewing the

03:48

post

03:48

exploitation tool in this case it's

03:50

called laziness target is going to be

03:52

firefox

03:52

and the linux operating system now here

03:55

in front of me we see a github

03:56

page and it's an overview of the lazane

03:59

tool you can go ahead and install it for

04:01

linux mac or

04:02

windows and we're going to be using the

04:04

linux in this case

04:06

now zane is a post exploitation tool

04:08

which allows you to extract passwords

04:11

from various types of systems including

04:13

browsers and wi-fi

04:14

in this case the scope is browsers in a

04:17

real world scenario once you would have

04:18

access to

04:20

the machine you'd go ahead and install

04:22

the zane on here

04:23

and then you could go ahead and extract

04:25

the passwords while zane is already

04:26

installed on

04:27

this environment it is very easy to

04:30

extract the passwords

04:31

from whatever browser it goes through a

04:33

lot of browsers here in front of me i

04:35

have a journal session open

04:36

and i'm going to go ahead and launch the

04:39

lazane tool

04:40

using python

04:47

i'm going to be using the browsers

04:49

option so in front of me once i hit

04:50

enter

04:51

we are going to see that the passwords

04:54

have been found

04:55

now in this case what i've done is i

04:58

went ahead and saved a couple passwords

05:00

to uh the browser firefox and as you can

05:03

see we have the url

05:05

login and the password so there you go

05:08

zing is a very easy tool to use once you

05:11

have gained access

05:12

to the remote systems all right so with

05:14

these two demonstrations behind us

05:17

what can you do to really remediate or

05:20

i guess protect yourself against an

05:22

attack like this one but let's go ahead

05:24

and overview a solution that i propose

05:27

[Music]

05:28

[Applause]

05:32

first off i wouldn't save your passwords

05:35

to your browser now the limitation to

05:37

this entire attack is that

05:39

the attacker is already gonna have to

05:41

have access

05:42

to your machine which that could be

05:44

remotely or

05:45

physical so that is the big limitation

05:47

to this attack what i would recommend

05:48

you do is look into a password

05:51

management solution now there's all

05:53

types of password management solutions

05:54

out there

05:55

you have locally hosted ones such as

05:57

keepass you can even locally host your

05:59

own

06:00

password manager on your home network or

06:02

you can look into

06:04

something that's a little bit more

06:05

convenient such as third-party

06:08

cloud hosted password managers one

06:10

password

06:11

i highly recommend lastpass there is all

06:13

types of password managers out there

06:15

that's what i would recommend that you

06:17

do

06:17

instead of entering the limitation of

06:20

chrome

06:21

firefox or any of the popular browsers

06:23

which only have your password saved to

06:25

that specific

06:26

browser i would recommend looking into a

06:29

password management solution

06:31

alright so that's it for today's video

06:33

hopefully that you have learned

06:34

something new

06:35

i just thought that this was a very

06:36

interesting topic to just overview

06:38

really quickly

06:39

and you know maybe suggest a password

06:41

management solution

06:42

if you've enjoyed uh please consider

06:45

liking the video which would help me

06:47

and yeah until the next time have a good

06:49

day