Starting from Windows 10 Anniversary Update (Version 1607), Microsoft added a new feature called Content Delivery Manager that silently installs new "suggested apps" without asking for users' permission.
According to a blog post published Friday on Chromium Blog, Google Project Zero researcher Tavis Ormandy said he found a pre-installed famous password manager, called "Keeper," on his freshly installed Windows 10 system which he downloaded directly from the Microsoft Developer Network.
Ormandy was not the only one who noticed the Keeper Password Manager. Some Reddit users complained about the hidden password manager about six months ago, one of which reported Keeper being installed on a virtual machine created with Windows 10 Pro.
Critical Flaw In Keeper Password Manager
Knowing that a third-party password manager now comes installed by default on Windows 10, Ormandy started testing the software and took no longer to discover a critical vulnerability that leads to "complete compromise of Keeper security, allowing any website to steal any password."
"I don't want to hear about how even a password manager with a trivial remote root that shares all your passwords with every website is better than nothing. People really tell me this," Ormandy tweeted.
The security vulnerability in the Keeper Password Manager was almost identical to the one Ormandy discovered and reported in the non-bundled version of the same Keeper plugin in August 2016 that enabled malicious websites to steal passwords.
"I checked and, they're doing the same thing again with this version. I think I'm being generous considering this a new issue that qualifies for a ninety day disclosure, as I literally just changed the selectors and the same attack works," Ormandy said.
To explain the severity of the bug, Ormandy also provided a working proof-of-concept (PoC) exploit that steals a user's Twitter password if it is stored in the Keeper app.
Install Updated Keeper Password Manager
Ormandy reported the vulnerability to the Keeper developers, who acknowledged the issue and released a fix in the just released version 11.4 on Friday by removing the vulnerable "add to existing" functionality.
Since the vulnerability only affects version 11 of the Keeper app, which was released on December 6 as a major browser extension update, the vulnerability is different from the one Ormandy reported six months ago.
Keeper has also added that the company has not noticed any attack using this security vulnerability in the wild.
As for Windows 10 users, Ormandy said users wouldn't be vulnerable to the password theft unless they open Keeper password manager and enable the software to store their passwords.
However, Microsoft still needs to explain how the Keeper password manager gets installed on the users' computers without their knowledge.
Meanwhile, users can use this registry tweak to disable Content Delivery Manager in order to prevent Microsoft from installing unwanted apps silently on their PCs.
