I know this topic might probably not fit this community or is even violating against Bitwarden’s Community Guidelines and Rules but I as a non-tech / IT guy want to know if it is true that password managers do not protect against info/password stealers?
Reddit post:
Do password managers actually protect from password stealers?
I got bitwarden installed on my PC (on chrome) and on my phone. lets say I got a password stealer somehow. would my accounts be safe then?
And all the comments say the same thing, that they do not protect again info/password stealers.
From what I know from my very small knowledge: Password Managers make it harder for info/password stealers to steal login credentials than the browser in-built password managers.
I think ultimately, the reason why the general answer to this question is no, it doesn’t protect against malware, is because it’s outside the design parameters of password managers. All efforts made to resist malware are best effort, meaning they work against some malware but not others. On a Windows system, because any user-space software can read the memory of another, malware can be designed to dump the plaintext memory of Bitwarden when it’s unlocked; it would obviously work if it doesn’t get shut down by the AV software running on the system.
That said, since I started using Bitwarden, I have tried reading all the technical publications on infostealers attacking Bitwarden specifically. Usually, these infostealers are said to exfiltrate the encrypted vaults (see examples in Kaspersky’s report on Stealka stealer and Bitdefender’s report on Raccoon stealer).
Some of those don’t mention keyloggers, RATs, or persistent loaders (which install additional malware/keyloggers), so it’s not apparent that they have the master password. Based on this, the most vulnerable Bitwarden configurations would be those set to NEVER lock (and never requiring the master password) and perhaps those locked by a weak PIN that doesn’t require the master password on restart.
Ultimately, if malware gets onto your system, the question would be whether the malware is capable of exfiltrating your vault’s plaintext information, given the Bitwarden configuration you have. Sometimes, you may not be able to determine this (such as if there were signs that you were infected but it’s not obvious with what and what capabilities it may have, given the lack of technical details). If there are signs of vault compromise (while in fact other things may have been compromised), the safe response is to assume total vault compromise and act accordingly.
The best cybersecurity measure regarding the infostealer threat is to ensure it doesn’t get onto your system in the first place. If you can’t be sure (due to supply chain attacks, trusted software turning bad, or trusted software being taken over), then implement additional layered defenses that, while being best efforts and not guaranteed to work against all attacks, would frustrate the attackers further.
PS:
Third-party password managers are usually automatically safer since infostealers, by definition, steal from browsers’ password managers but often not from third-party managers.
For software, the best-protected software is the one that requires authentication on startup and stores data encrypted. The harder the authentication (complex password, etc.), the more difficult it is to steal the information. Software that requires no authentication (like browser password managers) is usually “easy” to steal from using available tools.
All efforts made to resist malware are best effort, meaning they work against some malware but not others. On a Windows system, because any user-space software can read the memory of another, malware can be designed to dump the plaintext memory of Bitwarden when it’s unlocked; it would obviously work if it doesn’t get shut down by the AV software running on the system.
I want to add some additional notes here. While it is true that user-space malware is out of scope for the desktop app’s threat model, and efforts here are best-effort, not guarantees, the desktop app on all platforms now since recently has hardening against memory access. Note: The locked desktop app is within scope for hardening against userspace compromise, so Biometrics especially requires hardening, since it loads a key into memory after the first time a user unlocks, that has to stay in memory, even while locked.
On Windows, the in-memory biometric unlock key is encrypted via DPAPI, which in-memory encrypts using a key held in the kernel, bound to the process. Further, Debugger access to the application is prevented using DACL.
On Linux, if you are on Ubuntu, then kernel.yama.ptrace_scope already protects you from user-space dumping. If not, then the desktop app uses PR_SET_DUMPABLE to prevent ptrace access (and thus memory dumping), and also moves biometric unlock keys either to keyctl or uses memfd_secret, both of which prevent memory dumping.
On Mac, the system already prevents debugger access, and memory dumping (but production apps still use PT_DENY_ATTACH)
If you are interested here are some links to the changes:
Congrat and thanks! This is something that can definitely be bragged about, with pieces that can be followed up to learn more. All 3 platforms, and that’s with different implementations. Awesome!