{"id":77287,"date":"2014-11-21T23:31:31","date_gmt":"2014-11-21T21:31:31","guid":{"rendered":"http:\/\/onsoftware.en.softonic.com\/?p=77287"},"modified":"2025-07-02T00:20:25","modified_gmt":"2025-07-02T07:20:25","slug":"android-vulnerability-leaves-some-password-managers-open-to-sniffing","status":"publish","type":"post","link":"https:\/\/cms-articles.softonic.io\/en\/android-vulnerability-leaves-some-password-managers-open-to-sniffing\/","title":{"rendered":"Android vulnerability leaves some password managers open to sniffing"},"content":{"rendered":"

If you’re using a password manager<\/a> on your Android phone or tablet, you will want to pay attention to this vulnerability. The problem is inherent with Android itself<\/strong> but affects password managers that utilize the clipboard<\/strong> to fill in passwords.<\/p>\n

The vulnerability isn’t new and shouldn’t come as a surprise. Researcers discovered the bug back in early 2013 but nothing has been done about it since. But recently, an app called ClipCaster<\/a> has made its way onto the Google Play Store that allows the app to sniff usernames and passwords stored in the Android clipboard<\/strong>.<\/p>\n

ClipCaster is a proof of concept that this vulnerability exists and works. The app doesn’t require any permissions<\/strong> so a victim will be none the wiser that his or her passwords are being sniffed out. There’s no functionality behind ClipCaster other than to expose vulnerable password managers on Android.<\/p>\n

While password managers like LastPass<\/a> are affected, others that don’t utilize the clipboard are not. LastPass responded, saying that the vulnerability is not with its own app but a problem with Android itself.<\/p>\n

“This is an any clipboard activity problem<\/strong> [his emphasis] and impacts any password manager involving the clipboard (100% of them)\u2014the way all password managers have consistently allowed you to enter your password into other apps since Android has existed. This demonstration is aimed at LastPass, but it’s the whole of Android that must be addressed,” said Lastpass CEO Joe Siegrist speaking with Ars Technica<\/em>.<\/p>\n

\"Lastpass<\/p>\n

Android password managers which use their own browsers, browser extensions, or software keyboards are unaffected by this bug. This means LastPass users can stop this bug by disabling the “autofill” feature<\/strong> using the Lastpass secure browser or software keyboard instead.<\/p>\n

You can also protect yourself by only installing trusted apps, meaning apps you find in Google Play since Google checks those apps for malicious code. Still, some malicious apps may fall through the cracks so use your best judgement. Now is also a good time to install a mobile antivirus program<\/strong> like Lookout<\/a> or AVG<\/a> to monitor your phone for vulnerabilities.<\/p>\n

Android does have a security feature called “sandboxing<\/a>” that would render this attack useless but it would also stop password managers from working properly. Basically, sandboxing isolates an app from interacting with other apps, protecting it from sniffing. However, sandboxing password managers would make the apps extremely limited and difficult to use<\/strong>.<\/p>\n

There’s no need to panic<\/strong> about this vulnerability, but Google and app developers should work together to implement a fix. Just use your best judgement about the apps you install and you should be safe.<\/p>\n

For more information about how to protect yourself online, check out my in-depth guide<\/a>.<\/p>\n

Source: Ars Technica<\/a><\/em><\/p>\n

Related Stories<\/h3>\n

Detekt looks for government spyware on your PC<\/a><\/p>\n

Malware being spread through Steam chat<\/a><\/p>\n

End to end user encryption coming to WhatsApp<\/a><\/p>\n

@lewisleong<\/a><\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

If you’re using a password manager on your Android phone or tablet, you will want to pay attention to this vulnerability. The problem is inherent with Android itself but affects password managers that utilize the clipboard to fill in passwords. The vulnerability isn’t new and shouldn’t come as a surprise. Researcers discovered the bug back … Continue reading “Android vulnerability leaves some password managers open to sniffing”<\/span><\/a><\/p>\n","protected":false},"author":2033,"featured_media":71603,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","wpcf-pageviews":0},"categories":[],"tags":[],"usertag":[],"vertical":[],"content-category":[],"class_list":["post-77287","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/posts\/77287","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/users\/2033"}],"replies":[{"embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/comments?post=77287"}],"version-history":[{"count":1,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/posts\/77287\/revisions"}],"predecessor-version":[{"id":329797,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/posts\/77287\/revisions\/329797"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/media\/71603"}],"wp:attachment":[{"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/media?parent=77287"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/categories?post=77287"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/tags?post=77287"},{"taxonomy":"usertag","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/usertag?post=77287"},{"taxonomy":"vertical","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/vertical?post=77287"},{"taxonomy":"content-category","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/content-category?post=77287"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}