Windows 10 included password manager with huge security hole

There’s a good reason why security analysts get nervous about bundled third-party software: it can introduce vulnerabilities that the companies can’t control. And Microsoft, unfortunately, has learned that the hard way. Google researcher Tavis Ormandy discovered that a Windows 10 image came bundled with a third-party password manager, Keeper, which came with a glaring browser plugin flaw — a malicious website could steal passwords. Ormandy’s copy was an MSDN image meant for developers, but Reddit users noted that they received the vulnerable copy of Keeper after clean reinstalls of regular copies and even a brand new laptop.

A Microsoft spokesperson told Ars Technica that the Keeper team had patched the exploit (in response to Ormandy’s private disclosure), so it shouldn’t be an issue if your software is up to date. Also, you were only exposed if you enabled the plugin.

However, the very existence of the hole has still raised a concern: are Microsoft’s security tests as thorough for third-party apps as its own software? The company has declined to comment, but that kind of screening may prove crucial if Microsoft is going to maintain the trust of Windows users. It doesn’t matter how secure Microsoft’s code is if a bundled app undermines everything.

760 Shares

California advises against keeping your phone in your pocket

For thirty years, hundreds of millions and now billions of people have been irradiating themselves with cellphones, yet rates for cancer and other diseases have steadily fallen. Where’s the evidence for this official warning?

iTunes isn’t coming to the Windows Store this year after all

There are significant challenges when one tries to port poorly written software into the nice, structured, sandboxed Microsoft Store. I look forward to seeing the first usable version if iTunes.

North Korea hackers steal bitcoin by targeting currency insiders

The headline is wrong. They TRY to steal Bitcoin. The article doesn’t say that they were successful. Engadget, please insert try to between hackers and steal in the headline, or I will call the police.

Eve V review: The wisdom of the crowd mostly pays off

the bluetooth capability of the keyboard is a nice feature that i’ve been hoping for with every new surface pro release. i’ve been in a few situations with my sp3 where this would have been killer to have.

What do made-for-AI processors really do?

TL:DR technical answer: Less silicon dedicated to high-precision floating point calculations (good for graphics), more silicon dedicated to low-precision integer calculations (good for AI)

Facebook’s ‘snooze’ button mutes a friend for 30 days