Android Version 14.3.0
Released on June 21, 2019
Features & Benefits
Support for BreachWatch Business customers
App Launcher Shortcuts
Android Q Autofill Night Mode support
Security Update
This update addresses a potential security vulnerability on the Android application related to installation of a malicious 3rd party Android application. For the exploit to be realized, a sequence of conditions would be required which in turn, would impact the Keeper Android application. No customer reported being affected by this issue.
Reporting Sequence
The security researcher’s findings were reported via Keeper's Bugcrowd Public Vulnerability Disclosure Program on May 18, 2019. The issue disclosed in the report was accepted and validated on May 20, 2019. The fixes were completed and submitted for publication to the Google Play app store on June 21, 2019 in version 14.3.0.
Summarized Findings in the Security Researcher’s Report
A rogue 3rd party malicious application installed on the user's device could monitor events on the Keeper application and wait for certain conditions to capture a user's record login and password, when the user uses the "Copy to clipboard" feature. The researcher pointed out that while Keeper had FLAG_SECURE enabled at the application level, this flag must be enabled on all app fragments to address this potential vulnerability.
Keeper’s Security Team’s Response
In order for this potential vulnerability to result in an exploit of the user’s password for a website, the following conditions would need to exist:
1. User installs malicious 3rd party Android application 2. User opens Keeper app and opens password record 3. User taps on "eyeball" to display the plain text password 4. User taps on password field to copy to clipboard Result: The "Toast" message containing the password could be read by the malicious application.
Resolution
Added FLAG_SECURE to all app fragments to prevent 3rd party malicious application from monitoring clipboard events when the user taps "eyeball" to show password and taps password field to copy to clipboard.
Bug Fixes & Improvements
Removed KitKat support
Improved user account switching between KeeperChat and Keeper
Crash when clicking "Protect your business" promotion
Last updated
Was this helpful?