Blockchain.info isn't safe - My Wallet Password Stealer (Passes the "Verifier")

[molecular]

@OP: can you explain more precisely what you did?

He looked into his own system memory and was amazed to discover stuff. 

In his last post he said he managed to make a browser plugin that was able to read the pw when user entered it on blockchain.info. That would be a serious threat.

That's how it's supposed to work. When you open a Blockchain wallet, you're opening it in your own computer RAM. Your own browser is going to read at your own password, because he needs it to decrypt your wallet in the memory. Yes, there's a vulnerability when you type your password and use it to decrypt your wallet, since you can intercept the password at that moment (using a keylogger or any malicious software). But it's nothing new, that vulnerability always existed. If you use the official Bitcoin software and type your password to decrypt your wallet, you have the same vulnerability. Your password is going to exist in a decrypted form in your system memory at a point in time. We consider the risk acceptable simply because RAM is so volatile.

The difference between blockchain.info and other online wallets is that the point of failure is at each user computer, instead of being the server itself.

tl;dr
TradeFortress is trolling.

He might be trolling, but he's not saying: "I found blockchain pw in my memory". He's saying: "I can write an extension that will send me the pw if installed in the browser by someone". That's a big difference. It's not exceptionally hard to make a browser extension that will be installed by many bitcoiners. Up until now I thought it'd be hard to make one that send the blockchain.info pw home. I'm not so sure any more.

[John (John K.)]

@OP: can you explain more precisely what you did?

He looked into his own system memory and was amazed to discover stuff. 

In his last post he said he managed to make a browser plugin that was able to read the pw when user entered it on blockchain.info. That would be a serious threat.

That's how it's supposed to work. When you open a Blockchain wallet, you're opening it in your own computer RAM. Your own browser is going to read at your own password, because he needs it to decrypt your wallet in the memory. Yes, there's a vulnerability when you type your password and use it to decrypt your wallet, since you can intercept the password at that moment (using a keylogger or any malicious software). But it's nothing new, that vulnerability always existed. If you use the official Bitcoin software and type your password to decrypt your wallet, you have the same vulnerability. Your password is going to exist in a decrypted form in your system memory at a point in time. We consider the risk acceptable simply because RAM is so volatile.

The difference between blockchain.info and other online wallets is that the point of failure is at each user computer, instead of being the server itself.

tl;dr
TradeFortress is trolling.

He might be trolling, but he's not saying: "I found blockchain pw in my memory". He's saying: "I can write an extension that will send me the pw if installed in the browser by someone". That's a big difference. It's not exceptionally hard to make a browser extension that will be installed by many bitcoiners. Up until now I thought it'd be hard to make one that send the blockchain.info pw home. I'm not so sure any more.

Well, I'm not too sure about the difference between someone writing a keylogger and sending the password home and writing a malicious extension to send the password home.

[davout]

These points are moot since its extremely easy to protect your blockchain.info wallet with  a yubikey. oh. no. wait a second, the yubikey otp check is done in horribly wrong and broken ways and only checks the key id, not the actual otp.

Replay attacks ? Go for it !

[Jaw3bmasters]

@OP: can you explain more precisely what you did?

He looked into his own system memory and was amazed to discover stuff. 

In his last post he said he managed to make a browser plugin that was able to read the pw when user entered it on blockchain.info. That would be a serious threat.

That's how it's supposed to work. When you open a Blockchain wallet, you're opening it in your own computer RAM. Your own browser is going to read at your own password, because he needs it to decrypt your wallet in the memory. Yes, there's a vulnerability when you type your password and use it to decrypt your wallet, since you can intercept the password at that moment (using a keylogger or any malicious software). But it's nothing new, that vulnerability always existed. If you use the official Bitcoin software and type your password to decrypt your wallet, you have the same vulnerability. Your password is going to exist in a decrypted form in your system memory at a point in time. We consider the risk acceptable simply because RAM is so volatile.

The difference between blockchain.info and other online wallets is that the point of failure is at each user computer, instead of being the server itself.

tl;dr
TradeFortress is trolling.

He might be trolling, but he's not saying: "I found blockchain pw in my memory". He's saying: "I can write an extension that will send me the pw if installed in the browser by someone". That's a big difference. It's not exceptionally hard to make a browser extension that will be installed by many bitcoiners. Up until now I thought it'd be hard to make one that send the blockchain.info pw home. I'm not so sure any more.

Well, I'm not too sure about the difference between someone writing a keylogger and sending the password home and writing a malicious extension to send the password home.

One is easier to install.

[flatfly]

One problem with malicious browser extensions is that they are usually not checked by antivirus software for evil behavior and provide an attacker with easy access to all OSes simultaneously.

That said, piuk is right when saying that end-users should ultimately be responsible for securing their own computers.

[jago25_98]

OK folks.

So...
 look at what extensions and addons you have installed...
 potentially any of those extensions have access to your wallet.

Thanks for the proof of concept. I hope it can be improved.

This has already been a worry of mine. Chrome extensions especially are very low hanging fruit for a carte-blanche rouge code in the same way phone apps are.

As a minimum I will be watching what I install more, going only for open source extensions methinks. Though this is no real protection it's the most practical I can think of for now.