Latest in Gear

Image credit: Edgar Alvarez/Engadget

Windows 10 included password manager with huge security hole

Or, why bundling third-party apps can create risks.
1406 Shares
Share
Tweet
Share

Sponsored Links

Edgar Alvarez/Engadget

There's a good reason why security analysts get nervous about bundled third-party software: it can introduce vulnerabilities that the companies can't control. And Microsoft, unfortunately, has learned that the hard way. Google researcher Tavis Ormandy discovered that a Windows 10 image came bundled with a third-party password manager, Keeper, which came with a glaring browser plugin flaw -- a malicious website could steal passwords. Ormandy's copy was an MSDN image meant for developers, but Reddit users noted that they received the vulnerable copy of Keeper after clean reinstalls of regular copies and even a brand new laptop.

A Microsoft spokesperson told Ars Technica that the Keeper team had patched the exploit (in response to Ormandy's private disclosure), so it shouldn't be an issue if your software is up to date. Also, you were only exposed if you enabled the plugin.

However, the very existence of the hole has still raised a concern: are Microsoft's security tests as thorough for third-party apps as its own software? The company has declined to comment, but that kind of screening may prove crucial if Microsoft is going to maintain the trust of Windows users. It doesn't matter how secure Microsoft's code is if a bundled app undermines everything.

All products recommended by Engadget are selected by our editorial team, independent of our parent company. Some of our stories include affiliate links. If you buy something through one of these links, we may earn an affiliate commission.
Comment
Comments
Share
1406 Shares
Share
Tweet
Share

Popular on Engadget

The Morning After: Nike's accessible AJI

The Morning After: Nike's accessible AJI

View
HTC's Exodus 1s can run a full Bitcoin node for under $250

HTC's Exodus 1s can run a full Bitcoin node for under $250

View
Kik Messenger will keep running under a different owner

Kik Messenger will keep running under a different owner

View
Netflix's 'Cowboy Bebop' production pauses after John Cho is injured on-set

Netflix's 'Cowboy Bebop' production pauses after John Cho is injured on-set

View
Nike puts an accessibility twist on its iconic Air Jordan 1

Nike puts an accessibility twist on its iconic Air Jordan 1

View

From around the web

Page 1Page 1ear iconeye iconFill 23text filevr