Efstratios Chatzoglou - Unmasking Credential Leaks: A Security Evaluation of ...

Research Questions and Threat Model

University of Piraeus researchers asked which password managers, browser built-ins, and VPN clients store plaintext credentials in process memory, and how often those secrets repeat. Testing assumes standard user access, an unlocked vault, and ability to run OS commands—typical post-compromise conditions—not admin rights.

Scope and Methodology

The two-year study (July 2023–March 2025) examined 12 desktop password managers, five browsers, 12 browser extensions, and 21 commercial and enterprise VPNs. Primary scenarios dump process memory while apps are open; VPN tests also cover cases where credentials persist without re-prompting.

Findings Across Product Classes

Most tested password managers leaked master passwords and vault entries, often many times per dump. All evaluated Mac browsers exposed credentials in memory; extensions varied. Commercial VPNs showed fewer leaks than enterprise VPNs, where domain credentials in memory pose lateral-movement risk.

Pandora Tool and Vendor Response

The team released Pandora, an open-source extractor using pattern-based memory scanning, and assigned CVEs to vendors including Kaspersky, Passbolt, and Fortinet. Chatzoglou discusses how staggered disclosure timelines revealed uneven vendor remediation and why memory hygiene remains an underappreciated attack path.