[Full-disclosure] How to take advantage of Chrome autofill feature to get sensitive information

["vulns@xxxxxxxxxxx" <vulns@xxxxxxxxxxx>]

At the end of 2010, Google introduced autofill in Chrome, a feature that may be 
a security problem for its users. Chrome's autofill allows to store postal 
addresses (divided in some other data like name, surname, telephone, postal 
code...) and credit card (divided in cardholder name, number and expiration 
date). For a form to take advantage of autofill feature, input fields has to be 
properly identified so Chrome knows what values go with them. There is a 
weakness that may allow an attacker to take advantage of this characteristic to 
obtain private information like an address or credit card data  without the 
user noticing anything.

As a precaution, Chrome only fills up credit card number with autofill under 
https pages. This is not a problem for the attacker, since he just have to 
operate uner a SSL connection. Another precaution that Chrome takes, is to 
forbid "hidden" tag in autocomplete inputs. Chrome also avoids to fill up 
Autofill inputs if there is a div tag with visibility set to "hidden".

So a formula would be to take advantage of the scroll property, rising up the 
layer some pixels so the inputs used to steal information are unseen. In this 
case, the "decoy" form would be created by using this specially crafted "div", 
so we get to hide inside it all these inputs and the browser will not show them 
(but will autofill them):


<form action="recolector.php" method="post">
    <div style="overflow:hidden;height:35px;">
            Nombre  <input id="cn" autocomplete="cc-name" ><br><br>
            <input id="cc" autocomplete="cc-number" >
            <input id="ce" autocomplete="cc-exp" >
            <input id="c5" autocomplete="cc-exp" maxlength="5">
            <input id="cg" autocomplete="cc-given-name">
            <input id="ca" autocomplete="cc-additional-name">
            <input id="cf" autocomplete="cc-family-name">

...

</div>


Chrome will fill up all that information without the user noticing anything. 
This weakness has been detected by Ricardo Mart?n from Eleven Paths 
(ricardo.martin@xxxxxxxxxxx). Full samples and detailed explanation is here: 
http://blog.elevenpaths.com/2013/10/how-to-take-advantage-of-chrome.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/