Google’s new version of Password Alert blocking bypass is bypassed
Just 24 hours after Google had rolled out the Chrome plugin, it has been bypassed by a drop-dead simple exploit. Within hours of publication, Google issued an update that blocked the exploit. Now the same researcher has figured out a way to block the new version, too.
The newer exploit, which circumvents Thursday night’s release of version 1.4, relies on just three lines. It works by refreshing the browser page after each password character is entered. That causes a browser to behave as if only one character of the password has been entered. Consequently, the warning is never displayed. The newer exploit has limitations, however. If the phishing target types the password too slowly, the browser will catch up to the constant refreshing and display the warning as Google engineers intended. Still, the bypass works about 90 percent of the time, said Paul Moore, the UK-based security researcher who devised both attacks. It wouldn’t be surprising to see Google release yet another patch that may or may not be bypassed yet again.
The back-and-forth between Google and Moore highlights the cat-and-mouse struggle of security. A defender builds a lock of sorts, an attacker figures out a way to break it, the defender responds with refinements that block the attack, the defender works around the refinement, and so on. The process can be repeated for years, decades, or even centuries. The Password Alert travails also demonstrate the asymmetry of security, where a lone attacker can easily breach the security of a defender with vastly greater resources. Don’t count on this struggle being resolved anytime soon.