Basically every password manager (like LastPass, 1Password, ...) has its Android & iOS app and browser extensions for Chrome, Safari, Firefox etc., to automatically fill in usernames and passwords.

I see this as the most obvious point of attack. An attacker would only have to gain access to the developers' app store account and could then publish a modified version of the Android/iOS app or browser extensions. That modified version would secretly send all the usernames and passwords to the attacker's server. The result would be a large scale theft of clear text usernames and passwords of all the users who updated to the modified version. No costly password cracking necessary!

No matter how strong the encryption is, where the vault is stored (local vs. cloud vs. own server) or whether there is two-factor authentication, that won't make a difference. The app or browser extension needs to be able to access the encrypted data in order to do autofill, so that data can be stolen.

So I'm wondering:

  1. What kind of security measures do developers apply against this type of attack?
  2. What can users do? Only use self-compiled apps and browser extensions? Any particular recommendations?
  3. What can OS and browser do? I suppose it would be very helpful if one could restrict network access of the password manager app or browser extension to only certain hostnames, e.g. lastpass.com, so that a modified version would not be able to send the stolen data anywhere.
  • 2
    "An attacker would only have to gain access to the developers' app store account"...or he can just hack App Store or he can just hack OEM OTA update service. These are not vulnerabilities but are assumed attack vectors that may not be feasible to exploit. There is no one common fix for supply chain attack. Every participating entity is responsible for its security.
    – defalt
    Commented Jan 14, 2023 at 9:24
  • Why would an attacker want to steal all such credentials when they only have to gain access to any of Musk's bank accounts to become rich? Commented Jan 14, 2023 at 17:46
  • Both Android and Apple require app signing and normally wouldn't allow you to supply an update without the same signing key. Typically, the phone will also check the signature before allowing an app update. If the attacker forcibly replaces the listing, then it is effectively a new app without access to existing data.
    – billc.cn
    Commented Jan 17, 2023 at 13:20


You must log in to answer this question.

Browse other questions tagged .