Exploiting a Bad User Practice to Retrieve Data Leakage on Android Password Managers

In the Internet of Things (IoT) era users want to be able to access to their accounts on all their devices—e.g., laptops, smartphones, smart TVs, smartwatches, tablets, and so on—and a number of security and privacy concerns have to be addressed. In particular, passwords are widely used to protect sensitive data or to gain access to specific resources. Thus, they have to be stored safely and picked up easily. A possible solution to this issue is to adopt a password manager to remember and secure them. However, a bad user practice, i.e., rooting devices, might affect the security of installed apps. In this scenario, unintended data leakage flaws might exist. In order to detect such flaws, we analyze the top installed Android password managers running them on rooted devices. We will show that a simple malicious application might collect secret data, thus providing an access door into a specific network and all the information stored on it.