9 ms·

Phishing attack against Lastpass

jnevill 11y ago
This is of the devil. It needs to be burned with fire and the ashes should be sunk in the Mariana trench and the trench should be filled with dirt that has been cursed by a witch that was formerly dead but was reanimated by Cthulhu and then rekilled, burned with fire, and buried on the opposite side of the earth. Everything here is usual phishing stuff, but that Chrome-Extension.pw url is disturbing combined with the lastpass API stuff.
- th0br0 11y ago
  Where's that quote coming from? It's awesome.
  - l1n 11y ago
    Seems to be ungoogleable. Maybe it's unique :D
- DrScump 11y ago
  Digging it out from the bottom of the Marianas Trench only to rebury it in an inferior location (from an accessibility standpoint) seems counterproductive.
deleted 11y ago
[deleted]
vosper 11y ago
Woah, this is scary. I'll need to look closely at LastPass alternatives (perhaps something that runs separately from the browser, even if it's a little more clunky to use than LastPass's integration).
- chrisfosterelli 11y ago
  I'll keep using Lastpass and I'm not sure that this is really their fault, but I have to say this is the first phishing scheme that I've thought "Wow, I would definitely fall for that". The chrome-extension.pw domain looked almost exactly the same as the Lastpass URL at first glance. I wonder if it would help if Chrome added a special URL-bar designation for extensions. EDIT: It looks like Chromium has an issue for adding this sort of URL-bar designation: https://code.google.com/p/chromium/issues/detail?id=453093 https://code.google.com/p/chromium/issues/detail?id=453093
  - stordoff 11y ago
    Same here. I saw the screenshot before scrolling down to see the explanation, and assumed it was the real thing shown for comparison purposes. Very convincing attack. Edit: assume->assumed
- infinitelurker 11y ago
  This isn't the first time that LastPass has had security issues and it seems like a fools game to use a password manager that keeps you data in the cloud. https://www.blackhat.com/eu-15/briefings.html#even-the-lastpass-will-be-stolen-deal-with-it https://www.blackhat.com/eu-15/briefings.html#even-the-lastp... https://blog.lastpass.com/2015/06/lastpass-security-notice.html/ https://blog.lastpass.com/2015/06/lastpass-security-notice.h... I've been very happy with 1password, runs locally can be synced directly to other devices. https://agilebits.com/onepassword https://agilebits.com/onepassword Does anyone have experience with 1password security breaches?
  - chrisfosterelli 11y ago
    I don't think that's a fair criticism of Lastpass for having "security issues" for the following reasons: 1. In the blog post you linked, no user passwords were at risk. They were being abundantly cautious, which makes sense since they hold everyone's passwords. 2. In the talk you linked, this is a inherent problem with storing keys on your local filesystem and not a problem with Lastpass. 1password is also "vulnerable" to this attack. 3. This current phishing attack is not a vulnerability in Lastpass itself, or anything wrong with their cryptography. As the author points out, anyone who falls for this will receive an automatic email notice (if 2FA is not on) from Lastpass and if you have geographic restrictions enabled this attack won't work at all (note 1password does not have these features). 4. Storing encrypted data in the cloud is not inherently a vulnerability, although it increases your attack surface. Many users of 1password also do this with features like Dropbox sync, and Dropbox provides much less rigorous access control compared to Lastpass. 5. 1password has had it's own share of security blunders. The most recent being their database format that leaks all of your account names and the URL they are for, which 1password defended was for "performance reasons". http://myers.io/2015/10/22/1password-leaks-your-data/ http://myers.io/2015/10/22/1password-leaks-your-data/ EDIT: Updated to mention that alert emails are only sent if 2FA is disabled.
    - redwards510 11y ago
      I think you may be wrong about #3. The author argues that anyone with 2factor turned on will NOT receive email notification, and I'm not sure what you mean by geographic restriction. You can disallow Tor IPs but that is about it.
- TwoBit 11y ago
  For sites that really matter, don't use lastpass or any system other than memory or a written down hint system.
bikamonki 11y ago
I believe so far my brain is still the best, if not only, secure password storage. To add a layer of security while reducing password complexity, I coded a small hasher so my brain remembers easy phrases and passwords come out of this tool über strong. I suppose I am still vulnerable to social engineering hacks or the attacker getting a hold of my hasher, but for such cases the only layer left is whatever vendors implement to defend its users, like SSL, 2FA or external devices.
- greggarious 11y ago
  Still, that's just one password. Do you use this one password for all your accounts, or as input to a password manager? Or are you just manually copying and pasting this one super good hash into all your accounts? :/
  - bikamonki 11y ago
    Different phrases->hashes for each vendor. The brain can easily remember what short phrase corresponds to what vendor.
    - scrollaway 11y ago
      Up until one of the vendor's databases leaks on the internet and we find out their passwords were stored in cleartext.
    - subsection1h 11y ago
      I assume you have hundreds of accounts like I and most people I know have. If you can recall hundreds of passphrases, including passphrases for accounts that you don't access for several years, and you can continue recalling these hundreds of passphrases even while changing them regularly, how else are you making use of your exceptional memory? Just curious.
      - bikamonki 11y ago
        I wish I had an exceptional memory ;) Only 4-5 accounts require a strong password. The rest I don't care, I use the same password or request a reset every time I go back.
bobwaycott 11y ago
Wow. What a well-conceived attack with impressive execution. Hopefully, this helps more than LastPass when thinking about security.
delhanty 11y ago
I have 1Password on Mac and the 1Password Chrome extension. But for typing my master password in, I always use the Mac application. That's because I'm worried that the Chrome extension might be vulnerable.
- kobayashi 11y ago
  Are you running a 1Password version <5.0? In 1Password 5 AgileBits added 1Password mini, which is a small helper app running in the background. The point of this is to say that one no longer enters passwords into the extension - toggling the extension merely brings up 1Password mini, which is where passwords are entered. Once the 1P mini is unlocked, it then enters the relevant login info into the browser (by using the extension's functionality, all of which is transparent to the user.
redwards510 11y ago
This is amazing not just for the execution, but the plain simplicity of it. Could you get around this by always clicking on the browser bar LastPass button when you want to login? I've noticed LastPass will often log out seemingly at random. This is supposed to be determined by a combination of your settings like "only allow one IP logged in at a time", which would log you out if you switched on your VPN for instance. However, it can appear to happen out of the blue, which makes this attack more dangerous, because people are used to that occurring. LastPass has a binary extension option for Chrome, hopefully they put that to use here with a desktop window that pops up for you to log in. But the fact that they just got bought by LogMeIn (and their reply to this issue) worries me that they won't do anything.
- chrisfosterelli 11y ago
  Yes, clicking on the button in the browser's task bar would foil this phishing attack.
userbinator 11y ago
<a href="https://www.seancassidy.me/images/lastpass_login.png"><img https://www.seancassidy.me/images/lastpass_login.png"><img src="/images/lostpass_login.png" I clicked on the thumbnail to examine it more closely, and was briefly confused, then amused that it pointed to the real one. I think this quite nicely shows why hiding the URL scheme is NOT a good idea; otherwise it would show this, which is far more obvious to indicate that the page is either from the extension or not: http://chrome-extension.pw/:/... chrome-extension://... Ironically, it wasn't that long ago when browser designers thought completely hiding the URL bar was a good idea.
pwman 11y ago
LastPass has pushed Google for years to give us a way to avoid using the browser viewport: infobars was a solution to this issue -- you can see one of my pleas for it back in January 2012: https://code.google.com/p/chromium/issues/detail?id=39511 https://code.google.com/p/chromium/issues/detail?id=39511 We do a lot to try to protect our usage of viewports using iframes, but it's not good enough and we'll figure out a way to do better. LastPass has generally told people to use the extension directly to login as it's more secure, we'll need to go further here as well. Sean was clever using http://chrome-extension.pw http://chrome-extension.pw which looks close -- but LastPass also detects you enter your master password on an incorrect domain and notifies you immediately of your mistake, mitigating this a great deal. This has existed for a long time before Sean's report and we did not implement as a response to Sean's bug report -- we implemented it as a general way for people to know about password resuse and to be notified of being phished. Making this practical is a lot tougher than email phishing -- you really need an XSS on a page that people use to login, and unlike email phishing it is immediately caught.
- DrewHintz 11y ago
  > LastPass also detects you enter your master password on an incorrect domain and notifies you immediately of your mistake Interesting! How does it do this?
  - willidiots 11y ago
    I'm assuming by the same mechanism that offers to save previously-entered passwords. It's always sniffing anything you type into a password field.
    - TwoBit 11y ago
      How would it know it's a password field and not just some text input box that uses * characters?
      - joshschreuder 11y ago
alexandrerond 11y ago
In my Lixux/Firefox credentials are requested in a popup window. Looks quite different than this. It is worrying that 2FA can be compromised so easily though.
EGreg 11y ago
This is also an attack that is possible against MacOS and Windows. My app can make the screen "go dark" or throw up an Apple-looking password prompt. As I kept saying (and once emailed Steve Jobs about) the way to properly handle this is: 1. Establish a secret phrase or icon when the account is created, that the user can recognize 2. Show it in the iframe when the user places their keyboard focus into the password field 3. Do not allow outside code to grab it -- in browsers, use the cross domain security model, in MacOS use the anti-DRM preventing screenshotting a certain window. Now, it's true that on the web, the secret phrase or icon has to depend on the user already having a session they've logged into. This authentication prevents an attacker from simply getting the secret phrase or icon.
some1else 11y ago
I suggest using the desktop app with global hotkeys for Search and Vault. I got used to it, and actually prefer how I can now seamlessly access login details from a Terminal window.

This is of the devil. It needs to be burned with fire and the ashes should be sunk in the Mariana trench and the trench should be filled with dirt that has been cursed by a witch that was formerly dead but was reanimated by Cthulhu and then rekilled, burned with fire, and buried on the opposite side of the earth. Everything here is usual phishing stuff, but that Chrome-Extension.pw url is disturbing combined with the lastpass API stuff.

th0br0 11y ago
Where's that quote coming from? It's awesome.
- l1n 11y ago
  Seems to be ungoogleable. Maybe it's unique :D
DrScump 11y ago
Digging it out from the bottom of the Marianas Trench only to rebury it in an inferior location (from an accessibility standpoint) seems counterproductive.

deleted 11y ago

[deleted]

vosper 11y ago

Woah, this is scary. I'll need to look closely at LastPass alternatives (perhaps something that runs separately from the browser, even if it's a little more clunky to use than LastPass's integration).

chrisfosterelli 11y ago
I'll keep using Lastpass and I'm not sure that this is really their fault, but I have to say this is the first phishing scheme that I've thought "Wow, I would definitely fall for that". The chrome-extension.pw domain looked almost exactly the same as the Lastpass URL at first glance. I wonder if it would help if Chrome added a special URL-bar designation for extensions. EDIT: It looks like Chromium has an issue for adding this sort of URL-bar designation: https://code.google.com/p/chromium/issues/detail?id=453093 https://code.google.com/p/chromium/issues/detail?id=453093
- stordoff 11y ago
  Same here. I saw the screenshot before scrolling down to see the explanation, and assumed it was the real thing shown for comparison purposes. Very convincing attack. Edit: assume->assumed
infinitelurker 11y ago
This isn't the first time that LastPass has had security issues and it seems like a fools game to use a password manager that keeps you data in the cloud. https://www.blackhat.com/eu-15/briefings.html#even-the-lastpass-will-be-stolen-deal-with-it https://www.blackhat.com/eu-15/briefings.html#even-the-lastp... https://blog.lastpass.com/2015/06/lastpass-security-notice.html/ https://blog.lastpass.com/2015/06/lastpass-security-notice.h... I've been very happy with 1password, runs locally can be synced directly to other devices. https://agilebits.com/onepassword https://agilebits.com/onepassword Does anyone have experience with 1password security breaches?
- chrisfosterelli 11y ago
  I don't think that's a fair criticism of Lastpass for having "security issues" for the following reasons: 1. In the blog post you linked, no user passwords were at risk. They were being abundantly cautious, which makes sense since they hold everyone's passwords. 2. In the talk you linked, this is a inherent problem with storing keys on your local filesystem and not a problem with Lastpass. 1password is also "vulnerable" to this attack. 3. This current phishing attack is not a vulnerability in Lastpass itself, or anything wrong with their cryptography. As the author points out, anyone who falls for this will receive an automatic email notice (if 2FA is not on) from Lastpass and if you have geographic restrictions enabled this attack won't work at all (note 1password does not have these features). 4. Storing encrypted data in the cloud is not inherently a vulnerability, although it increases your attack surface. Many users of 1password also do this with features like Dropbox sync, and Dropbox provides much less rigorous access control compared to Lastpass. 5. 1password has had it's own share of security blunders. The most recent being their database format that leaks all of your account names and the URL they are for, which 1password defended was for "performance reasons". http://myers.io/2015/10/22/1password-leaks-your-data/ http://myers.io/2015/10/22/1password-leaks-your-data/ EDIT: Updated to mention that alert emails are only sent if 2FA is disabled.
  - redwards510 11y ago
    I think you may be wrong about #3. The author argues that anyone with 2factor turned on will NOT receive email notification, and I'm not sure what you mean by geographic restriction. You can disallow Tor IPs but that is about it.
TwoBit 11y ago
For sites that really matter, don't use lastpass or any system other than memory or a written down hint system.

bikamonki 11y ago

I believe so far my brain is still the best, if not only, secure password storage. To add a layer of security while reducing password complexity, I coded a small hasher so my brain remembers easy phrases and passwords come out of this tool über strong. I suppose I am still vulnerable to social engineering hacks or the attacker getting a hold of my hasher, but for such cases the only layer left is whatever vendors implement to defend its users, like SSL, 2FA or external devices.

greggarious 11y ago
Still, that's just one password. Do you use this one password for all your accounts, or as input to a password manager? Or are you just manually copying and pasting this one super good hash into all your accounts? :/
- bikamonki 11y ago
  Different phrases->hashes for each vendor. The brain can easily remember what short phrase corresponds to what vendor.
  - scrollaway 11y ago
    Up until one of the vendor's databases leaks on the internet and we find out their passwords were stored in cleartext.
  - subsection1h 11y ago
    I assume you have hundreds of accounts like I and most people I know have. If you can recall hundreds of passphrases, including passphrases for accounts that you don't access for several years, and you can continue recalling these hundreds of passphrases even while changing them regularly, how else are you making use of your exceptional memory? Just curious.
    - bikamonki 11y ago
      I wish I had an exceptional memory ;) Only 4-5 accounts require a strong password. The rest I don't care, I use the same password or request a reset every time I go back.

bobwaycott 11y ago

Wow. What a well-conceived attack with impressive execution. Hopefully, this helps more than LastPass when thinking about security.

delhanty 11y ago

I have 1Password on Mac and the 1Password Chrome extension. But for typing my master password in, I always use the Mac application. That's because I'm worried that the Chrome extension might be vulnerable.

kobayashi 11y ago
Are you running a 1Password version <5.0? In 1Password 5 AgileBits added 1Password mini, which is a small helper app running in the background. The point of this is to say that one no longer enters passwords into the extension - toggling the extension merely brings up 1Password mini, which is where passwords are entered. Once the 1P mini is unlocked, it then enters the relevant login info into the browser (by using the extension's functionality, all of which is transparent to the user.

redwards510 11y ago

This is amazing not just for the execution, but the plain simplicity of it. Could you get around this by always clicking on the browser bar LastPass button when you want to login? I've noticed LastPass will often log out seemingly at random. This is supposed to be determined by a combination of your settings like "only allow one IP logged in at a time", which would log you out if you switched on your VPN for instance. However, it can appear to happen out of the blue, which makes this attack more dangerous, because people are used to that occurring. LastPass has a binary extension option for Chrome, hopefully they put that to use here with a desktop window that pops up for you to log in. But the fact that they just got bought by LogMeIn (and their reply to this issue) worries me that they won't do anything.

chrisfosterelli 11y ago
Yes, clicking on the button in the browser's task bar would foil this phishing attack.

userbinator 11y ago

<a href="https://www.seancassidy.me/images/lastpass_login.png"><img https://www.seancassidy.me/images/lastpass_login.png"><img src="/images/lostpass_login.png" I clicked on the thumbnail to examine it more closely, and was briefly confused, then amused that it pointed to the real one. I think this quite nicely shows why hiding the URL scheme is NOT a good idea; otherwise it would show this, which is far more obvious to indicate that the page is either from the extension or not: http://chrome-extension.pw/:/... chrome-extension://... Ironically, it wasn't that long ago when browser designers thought completely hiding the URL bar was a good idea.

pwman 11y ago

LastPass has pushed Google for years to give us a way to avoid using the browser viewport: infobars was a solution to this issue -- you can see one of my pleas for it back in January 2012: https://code.google.com/p/chromium/issues/detail?id=39511 https://code.google.com/p/chromium/issues/detail?id=39511 We do a lot to try to protect our usage of viewports using iframes, but it's not good enough and we'll figure out a way to do better. LastPass has generally told people to use the extension directly to login as it's more secure, we'll need to go further here as well. Sean was clever using http://chrome-extension.pw http://chrome-extension.pw which looks close -- but LastPass also detects you enter your master password on an incorrect domain and notifies you immediately of your mistake, mitigating this a great deal. This has existed for a long time before Sean's report and we did not implement as a response to Sean's bug report -- we implemented it as a general way for people to know about password resuse and to be notified of being phished. Making this practical is a lot tougher than email phishing -- you really need an XSS on a page that people use to login, and unlike email phishing it is immediately caught.

DrewHintz 11y ago
> LastPass also detects you enter your master password on an incorrect domain and notifies you immediately of your mistake Interesting! How does it do this?
- willidiots 11y ago
  I'm assuming by the same mechanism that offers to save previously-entered passwords. It's always sniffing anything you type into a password field.
  - TwoBit 11y ago
    How would it know it's a password field and not just some text input box that uses * characters?
    - joshschreuder 11y ago

alexandrerond 11y ago

In my Lixux/Firefox credentials are requested in a popup window. Looks quite different than this. It is worrying that 2FA can be compromised so easily though.

EGreg 11y ago

This is also an attack that is possible against MacOS and Windows. My app can make the screen "go dark" or throw up an Apple-looking password prompt. As I kept saying (and once emailed Steve Jobs about) the way to properly handle this is: 1. Establish a secret phrase or icon when the account is created, that the user can recognize 2. Show it in the iframe when the user places their keyboard focus into the password field 3. Do not allow outside code to grab it -- in browsers, use the cross domain security model, in MacOS use the anti-DRM preventing screenshotting a certain window. Now, it's true that on the web, the secret phrase or icon has to depend on the user already having a session they've logged into. This authentication prevents an attacker from simply getting the secret phrase or icon.

some1else 11y ago

I suggest using the desktop app with global hotkeys for Search and Vault. I got used to it, and actually prefer how I can now seamlessly access login details from a Terminal window.