Completing an online order. Filling out another registration form. These are just some of the online tasks we’re happy to have Autofill complete the information for us. Why should you disable Autofill on your browsers? Recently, web developer Viljami Kuosmanen discovered a vulnerability that can expose your stored data to a malicious person via phishing. In this attack, a phishing email would be sent asking the target to complete a form on a web page. Once the target fills out one of the (visible) fields, the browser then auto-populates multiple invisible fields on the page (drawing from the stored Autofill data).
Above is an example of the hack in action, and you can also test it out yourself on a test page Kuosmanen setup. With this, it’s possible to give an attacker access to your address, credit card information, and other sensitive data. According to Forbes password keeper, Last Pass is also susceptible to this vulnerability, which could cause you to give up your passwords unknowingly.
Prevention against the attack
One of the most reliable is turning Autofill off on your browser. It is easy to do, and if you’re using Chrome you can just follow these steps:
- Open Chrome and click on the settings button in the upper right.
- At the bottom, click Show advanced settings.
- Under “Passwords and forms,” uncheck “Enable Autofill to fill out web forms in a single click.”
- Click on Manage Autofill Settings, and delete any data that has already been stored.
If you’re looking to protect your enterprise environment from this, you’ll need to educate your users on not clicking and reporting suspicious emails. Phishing emails use many varied tactics, and exposing employees to these will help them to prevent attacks. Phishing as a Service (PHaaS) can offer continual testing and training to employees, helping them to spot phishing emails and know how to interact with them safely. This is a proven measure where corporations have seen reduced click ratios, increased reporting, and significant drops in malware on their networks.
Remember, if an email is asking you to visit a website or submit information, you should always manually navigate to a known trusted website (like your bank) to log in and enter information. Don’t ever click on suspicious email links or download attachments from unknown senders, and be wary if you continue to utilize the Autofill function on your browsers.
Sources:
https://github.com/anttiviljami/browser-autofill-phishing
