AutoSpill: Zero Effort Credential Stealing from Mobile Password Managers
summary
AutoSpill is an Android WebView attack that exfiltrates saved credentials during autofill: a custom autofill service captures the OS-provided assist structure, password managers build datasets from excess fields, and a benign-looking app (the WebView test) receives usernames and passwords. Evaluation of seven popular managers (from a top-10 set) finds most leak creds without JavaScript and all leak with JS; Google Smart Lock and Dashlane resist the simple case. Proof-of-concept app works; recommended fixes: limit assist data to the focused webview and stop excessive dataset construction.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 0:19The Age of Internet
- 0:46Mobile Devices
- 8:18What is AutoSpill
- 15:34Assist Structure
- 16:28Biggest Benefit
- 19:51Evaluation
- 22:08Demo
- 26:30Testing
- 27:12Conclusion
- 27:54QA
related talks
45mImprove user experience and retention with the Android Autofill Framework
44mDraining Your Credentials From Popular MacOS Password Managers
53mA More Secure World for Android Apps
24mThe Emperor’s New Password Manager
15mBest practices for shielding mobile apps from emerging threats
53mAre your secrets secure? How mobile applications are leaking millions of credentials
47mAuthenticator Leakage Through Backup Channels on Android
47mThe state of passwordless auth on the web