Have you become a loyal user of Windows 10? We have to admit that this operating system is the best from Microsoft and if you are using an older version (8, 7 or even XP), we hope that you will update your computer immediately. However, even this sophisticated OS has its own wars to battle: and we are going to explain one of the most recent ones.
“Keeper” password manager can allow hackers to remotely steal your credentials
Your computer is currently running Windows 10? Great, then it is time to check whether your device is also running a secretive third-party password manager application which was installed without your consent. Security researchers have determined that this sneaky application has capacities to allow hackers to remotely invade your privacy and steal credentials.
The program was installed through Content Delivery Manager which was introduced together with the Windows 10 Anniversary Update. The manager automatically installs the recommended applications, which means that you might not be informed about some programs that start to affect your PC. The big discovery was made by Google Project Zero team or more specifically, a person named Tavis Ormandy. The automatically installed application called “Keeper” contains a very dangerous vulnerability. Therefore, it was considered dangerous and not recommended to be used.
Ormandy figured out that hackers do not need excellent skills to crack Keeper’s security blocks. Therefore, crooks had the chance to obtain any credentials of the compromised users’ computers. Ormandy goes on to explain the fragile Keeper program and expressed his doubts to even using a password manager (especially the one with trivial remote root). In this article, he additionally elaborated on the proof-of-concept (PoC) exploit which could steal passwords to Twitter accounts.
A fix has been released
Overall, the situation was sorted out when owners of Keeper rushed to the rescue. They published an update for 11th version and hopes that this will fix the issue. Fortunately, there had been no reported instances of password-stealing through this vulnerability. Maybe hackers were not aware of this golden opportunity? Either way, we hope that you won’t hesitate to install the new update if you are currently using Keeper password manager.
However, this leads us to another issue: why does Microsoft keep allowing programs or updates to be installed automatically, without users’ consent? Since this is not a one-time thing, we have to express criticism for this recklessness. It is rare when automatic-installations are considered acceptable. Of course, if we are referring to emergency updates that get released to solve high-risk issues, this is another subject. Nevertheless, if we are talking about a third-party password manager, it would be best to ask for permission first.
Source: news.softpedia.com.
