How to take advantage of Chrome autofill feature to get sensitive information

["vulns () 11paths com" <vulns () 11paths com>]

At the end of 2010, Google introduced autofill in Chrome, a feature that may be a security problem for its users. 
Chrome's autofill allows to store postal addresses (divided in some other data like name, surname, telephone, postal 
code...) and credit card (divided in cardholder name, number and expiration date). For a form to take advantage of 
autofill feature, input fields has to be properly identified so Chrome knows what values go with them. There is a 
weakness that may allow an attacker to take advantage of this characteristic to obtain private information like an 
address or credit card data  without the user noticing anything.

As a precaution, Chrome only fills up credit card number with autofill under https pages. This is not a problem for the 
attacker, since he just have to operate uner a SSL connection. Another precaution that Chrome takes, is to forbid 
"hidden" tag in autocomplete inputs. Chrome also avoids to fill up Autofill inputs if there is a div tag with 
visibility set to "hidden".

So a formula would be to take advantage of the scroll property, rising up the layer some pixels so the inputs used to 
steal information are unseen. In this case, the "decoy" form would be created by using this specially crafted "div", so 
we get to hide inside it all these inputs and the browser will not show them (but will autofill them):


<form action="recolector.php" method="post">
    <div style="overflow:hidden;height:35px;">
            Nombre  <input id="cn" autocomplete="cc-name" ><br><br>
            <input id="cc" autocomplete="cc-number" >
            <input id="ce" autocomplete="cc-exp" >
            <input id="c5" autocomplete="cc-exp" maxlength="5">
            <input id="cg" autocomplete="cc-given-name">
            <input id="ca" autocomplete="cc-additional-name">
            <input id="cf" autocomplete="cc-family-name">

...

</div>


Chrome will fill up all that information without the user noticing anything. This weakness has been detected by Ricardo 
Mart?n from Eleven Paths (ricardo.martin () 11paths com). Full samples and detailed explanation is here: 
http://blog.elevenpaths.com/2013/10/how-to-take-advantage-of-chrome.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/