We use cookies and other technologies on this website to enhance your user experience.
By clicking any link on this page you are giving your consent to our Privacy Policy and Cookies Policy.
ClipCaster icon


1.0.60 for Android

The description of ClipCaster

[ Update: I no longer have time to continue to improve this app. Thanks to everybody who tried it out and improved awareness of this vulnerability! Improvements & fixes are welcome via Github ]

[ LastPass update round 2: I automated the exploit for Facebook, as described in my blog post. If LastPass changes things up again it will stop working and may take a few days to get back up, but hopefully this time they will realise how ineffective this is and stop exposing their users to this vulnerability. ]

[ LastPass update: ClipCaster no longer automates the retrieval LastPass credentials. LastPass' fill-in is still vulnerable though. For an explanation of why, and how to verify it yourself (some knowledge of JavaScript required), see my blog post at https://blog.xbc.nz/2014/12/lastpass-attempt-at-client-side-android.html ]

ClipCaster is an open source proof of concept app that shows how any installed app can read passwords when they're used from password management applications.

It can also be used as a tool to track the state of the clipboard, and to get a dump of the JavaScript LastPass uses for its Chrome Fill-In feature.

Ars Technica article: http://ars.to/1vwcmT0

Finds credentials when using RoboForm's 'fill-in' feature for Chrome (Android version at least 4.3) and KeePassDroid.

We do NOT store the passwords or send them anywhere; this app does not even have the Internet permission. The only place they are used is in the notification when they are sniffed.

Now on the open source app store, F-Droid: https://f-droid.org/repository/browse/?fdfilter=clipcaster&fdid=com.actisec.clipcaster

Scope of ClipCaster

ClipCaster will automatically detect credentials when used from RoboForm filling out fields in Chrome (thanks to Robert for the tipoff) and KeePassDroid's copying notification.

ClipCaster also has a clipboard history, collected while the app is switched on. Just hit the 'history' icon on the main app. With this you can see what any app is doing with the clipboard.

In the case of LastPass, it will also aid manual reproduction of the vulnerability by providing the JavaScript dump and the time it was generated. See https://blog.xbc.nz/2014/12/lastpass-attempt-at-client-side-android.html for an example

Scope of vulnerability

For all password managers: if it requires you pasting your credentials, it is vulnerable. If the manager has a built-in browser or keyboard, using that feature will almost definitely avoid the vulnerability. If the manager doesn't, type passwords manually to avoid the vulnerability

For LastPass: Even though it doesn't mention it, the 'fill-in' feature (the one that pops up with credential choices, as in the screenshots) uses the clipboard and so is vulnerable. The alternatives are: the LastPass keyboard (or input method as they call it), the built-in browser, or using a mobile browser with a browser-specific LastPass extension such as Dolphin.

If you're unsure whether a password manager's feature is vulnerable, ask the developers of the password manager. Alternatively, email x.clark@actisec.com and we will attempt to check it out.


No permissions required

Source & Acknowledgements


This project is an independent implementation of the concept in "Hey, You, Get Off of My Clipboard - On How Usability Trumps Security in Android Password Managers" (http://fc13.ifca.ai/proc/4-2.pdf).

A special thanks to Arturo Blas-Jiménez, Daniel Resnick and Andrew Wilson for testing and to Valerio Bozzolan for the Italian localisation.

If any bugs are found, please put a description of them plus your version of Android on the issues page of the GitHub repo (https://github.com/activems/clipcaster/issues) or email x.clark@actisec.com
Show More

ClipCaster 1.0.60 Update

Wishing everyone a safe and secure Christmas and New Years!

Limited LastPass credential interception is back! Works for Facebook (English and Italian) sites, many more sites to be added soon. If LastPass changes things up again it will stop working and may take a few days to get back up, but hopefully this time they will realise how ineffective this is and stop exposing their users to this vulnerability.

ClipCaster Tags

Add Tags

By adding tag words that describe for Games&Apps, you're helping to make these Games and Apps be more discoverable by other APKPure users.

Additional Information

Previous versions
  • V1.0.60 662.0 KB APK



    ClipCaster 1.0.60 (60)

    Update on: 2015-10-17

    Requires Android: Android 4.1+ (Jelly Bean, API 16)

    Signature: e2e0adee635618a102ece313fef97f8c473bd146 ClipCaster 1.0.60(60) safe verified

    Screen DPI: 160-640dpi

    Architecture: universal

    File SHA1: cea9ee388370b03f84eb79e9a18fa3b81e1df2b8

    File Size: 662.0 KB

    What's new:


Comment Loading...
Ooops! No such content!
APKPure App