German magazine c't article about security

lemonstre

The last c't (a big german IT-Magazin http://www.heise.de/ct/) writes in the newest issue that there might be a security attac on 1Password found by Thomas Roth.



Google found this Twitter Feed about it -> https://twitter.com/jpgoldberg/status/286610208023797761



Can you explain what is going on here and if it is really possible to read out unencrypted passwords from ram.



Thanks

Andreas

khad

I'm not aware of all the details, but Thomas Roth himself stated that there is not a vulnerability in 1Password:



[img]http://cdn.agilebits.com/k/img/Twitter___StackSmashing__%401Password_%28To_anyone_reading_...-20130114-190909.png[/img]



https://twitter.com/StackSmashing/status/286608632995520512



Do you have a link to the article? My German is not very good, so I wasn't able to find it by clicking randomly on links on the c't home page. <img src='http://forum.agilebits.com/public/style_emoticons/<#EMO_DIR#>/smile.png' class='bbc_emoticon' alt=':)' />

lemonstre

Thank you for the quick reply and the clearing words.

The article is right now only availiable in print an get online after the new issue is released. I've send you a full scan via forum message.



I have translated the relevant part about 1Password (sorry for my english):

Thomas Roth by Leveldown Security analyzed recently a malware sample that

fishes 1Password users plaintext passwords from memory.



It would be nice to know how the user can protect himself from this potential hack.

jpgoldberg

Hi lemonstre,



Now that the article is published, I'm hoping we can get more information about it.



Earlier Thomas told us that there is a "lame" attack on 1Password and posed no threat, but he wasn't able to give us details at that time.



I have my own private speculations about what it might be, but let me try to find out actual facts instead of speculating.



Cheers,





-j



–-

Jeffrey Goldberg

Chief Defender Against the Dark Arts @ AgileBits

http://agilebits.com