Finnish web developer and hacker Viljami Kuosmanen discovered that several web browsers, like Google's Chrome, Apple Safari and Opera, as well as some add-ons and utilities like LastPass, can be tricked into revealing a user's personal information through their autocomplete systems.
The phishing attack is simple. Kuosmanen found that when a user tries to fill in information in some simple text boxes, as name and email address, the automatic filling system, which aims to avoid the tedious repetition of standard information such as address, will enter other profile-based information in any other text box, even when those boxes are not visible on the page.
This means that when a user enters seemingly innocent information, basic on a site, the autofill system could be revealing much more sensitive information at the same time if the user confirms the autofill. Chrome's autofill system, that is turned on by default, stores data in email addresses, phone numbers, email addresses, Organizations, credit card information and various other items.
Kuosmanen created a site to demonstrate the problem, displaying a text box for a user's name and email address, with text boxes for address and phone number hidden from view, that Chrome was automatically populated.
Mozilla's Firefox is immune to the problem, as it does not yet have a multi-box autofill system and cannot be tricked into completing text boxes by programmatic means., according to Mozilla's security engineer, Daniel Veditz. However, a more complete autofill system is being developed for Firefox.
The phishing attack still relies on users being tricked into entering at least some information into a web form..
Users can protect themselves from this type of phishing attack by disabling the autofill system within their browser or setting it to their extensions.
Here's an example of how they could capture all your data:
This is why I don’t like autofill in web forms. #phishing #security #infosec pic.twitter.com/mVIZD2RpJ3
— Viljami Kuosmanen ⭐ (@anttiviljami) 4 January 2017
Fountain: The Guardian