6 ms·

LastPass: design flaw in communication to privileged components

156 points by pedro84 10y ago

mentat 10y ago
Agree with the comment that the blogger doesn't understand what phishing is. This could be done against a huge number of people through various approaches with ad network code or targeted attacks controlling path to internet. That's all setting aside how trivial it would be for nation states.
- bqe 10y ago
  They have a history of trying to explain away their security problems as not really their fault. That alone should give any LastPass user pause.
  - bad_user 10y ago
    That's unfair. LastPass has always been transparent about their problems, much more so than other companies like Dropbox. And there's nothing in their response that tries shifting the blame: https://blog.lastpass.com/2016/07/lastpass-security-updates.html/ https://blog.lastpass.com/2016/07/lastpass-security-updates....
    - mentat 10y ago
      > Beware of phishing attacks. Do not click on links from people you don’t know, or that seem out of character from your trusted contacts and companies. This was not necessary for this attack to be successful on the default configuration of the tool. That's what I take issue with.
  - coderdude 10y ago
    >They have a history of trying to explain away their security problems as not really their fault. I feel like I'm reading some person's pet Wikipedia page. If they do then at least give some examples. You can't just say damning things and expect everyone to take it at face value.
  - wjd2030 10y ago
    Seriously? Unfounded to say the least. LastPass has always been super transparent and forthcoming regarding ANY security issue.
- gizmo686 10y ago
  I don't. The phrasing was "both exploits do require tricking a user via a phishing attack into going to a malicious website". This suggests that the blogger believes that the only attack vector involves tricking the user to go to a malicious website; I can reasonably see calling such attacks phishing attacks. The problem (which is, in my opinion, more serious) is that, as you identify, the blogger seems to horribly misunderstand the potential attack vectors.
- the_mitsuhiko 10y ago
  I have not used LP in a long time but does not not prompt for the master password before filling?
  - alistairjcbrown 10y ago
    I believe it depends on the settings for that entry - from "auto log in", "auto fill", "fill in when selected from menu" to "require master password before filling in"
kevin_thibedeau 10y ago
Password managers exchange a strong secret, something you know, for a weak one, something you have. Once an attacker gets to your database you're completely owned. When they compromise a normal password the damage is more contained if you maintain reasonable security practices.
- saurik 10y ago
  I thought the point of a password manager is to allow you to have separate passwords for numerous services which are protected by centralizing those passwords somewhere (preferably somewhere you control, such as your own phone) and protecting the result with one password. Your model of them seems to involve them replacing a password locally, which I don't think anyone would recommend.
  - deleted 10y ago
    [deleted]
  - EGreg 10y ago
    I would say password reuse can be pretty good! Simply have your own rule such as "letters 2 and 5 of the domain name" and combine those with your reusable password. In fact, I'd go further and say that you can do this with your login name. So for example: myemail+by@gmail.com for eBaY This also helps mitigate those attacks where the attacker actually contacts support and socially engineers them into giving all your info and even stealing your account: https://medium.com/@espringe/amazon-s-customer-service-backdoor-be375b3428c4#.xnxfahqib https://medium.com/@espringe/amazon-s-customer-service-backd... If you are hosting with AWS you should really consider doing that http://www.techinsider.io/hacker-social-engineer-2016-2 http://www.techinsider.io/hacker-social-engineer-2016-2
    - tonmoy 10y ago
      This "clever" security measure would be annihilated in case of a well planned attack targeted against a single individual.
cottsak 10y ago
This is not the same as https://labs.detectify.com/2016/07/27/how-i-made-lastpass-give-me-all-your-passwords/ https://labs.detectify.com/2016/07/27/how-i-made-lastpass-gi... is it?
- mintplant 10y ago
  No, the two disclosures just happened to come at the same time.
  - jessaustin 10y ago
    Wow, a bad day for them. Two different awful bugs on the front page.
    - breakingcups 10y ago
      Up until now I wasn't aware there were two issues, I saw two very similar titles on the front page and assumed it was about the same issue. Might work out better for them than having one issue appear a week later.
mdesq 10y ago
I wonder how the Citrix acquisition/merger will affect LastPass, especially some of the security aspects.
JumpCrisscross 10y ago
Has LastPass ever subjected their code to a proper, outside security audit in a form tptacek would endorse?
mikkom 10y ago
So this post says > We have verified that intercepting messages via the method you suggested is possible and is a problem. We have also verified it only affects firefox (chrome, ie, safari, opera, etc do not use the window for message passing in the same manner) and doesn't affect our primary addons.mozilla.org firefox download (which is still 3.0 version). It seems latest version for windows is 4.1.20a? As I'm both linux and firefox user and there have been 2 password stealing exploits revealed I would very much like to know if this affects me (my version seems to be 3.3.1). Is there any version history that I could check or does anyone know what versions are affected by these 2 exploits?
- keksdev 10y ago
  They say version 3.0 is not affected by this: > If you are running LastPass 3.0, you are not impacted and do not need to update. As far as I know, 3.0 refers to their old interface. You can download the new version directly from their website, but not through the Firefox add-on site. The version history is available here [1]. [1] https://lastpass.com/upgrade.php https://lastpass.com/upgrade.php
Accacin 10y ago
So, I've been using Lastpass for a few years now and I probably rely on it too much. Every single login has a unique and strong password so it would be a pain to have to move away. I use a Yubikey that's required when I log into a new PC (my home pc is set to only ask every 30 days for my 2FA key), I use an email that is only connected to Lastpass and I have a strong passphrase. Any other device I use Lastpass on is set to require a password and 2FA key at each start. Is that enough to make me reasonably secure?
- ciucanu 10y ago
  It should be safe enough, with a few exceptions, one of those being this exploit: https://news.ycombinator.com/item?id=12171547 https://news.ycombinator.com/item?id=12171547 This guy says that if the webpage "asks" for another's page credentials, lastpass plugin will give it. Every character/keystroke in specific fields could be catched/logged , here you have an example from ... eBay : https://news.ycombinator.com/item?id=12000820 https://news.ycombinator.com/item?id=12000820 Anyway, this was already fixed and pushed to the users, as the guy mentions in his post.
- mhurron 10y ago
  LastPass does allow you to export all of your saved sites and passwords as an csv file. So moving away is simply exporting the vault and uninstalling the software. The LastPass exploits presented exist after you have unlocked your vault, so 2fa on the LastPass vault won't stop them. Personally, I'm not moving away from LastPass over these.

156 points by pedro84 10y ago

Agree with the comment that the blogger doesn't understand what phishing is. This could be done against a huge number of people through various approaches with ad network code or targeted attacks controlling path to internet. That's all setting aside how trivial it would be for nation states.

bqe 10y ago
They have a history of trying to explain away their security problems as not really their fault. That alone should give any LastPass user pause.
- bad_user 10y ago
  That's unfair. LastPass has always been transparent about their problems, much more so than other companies like Dropbox. And there's nothing in their response that tries shifting the blame: https://blog.lastpass.com/2016/07/lastpass-security-updates.html/ https://blog.lastpass.com/2016/07/lastpass-security-updates....
  - mentat 10y ago
    > Beware of phishing attacks. Do not click on links from people you don’t know, or that seem out of character from your trusted contacts and companies. This was not necessary for this attack to be successful on the default configuration of the tool. That's what I take issue with.
- coderdude 10y ago
  >They have a history of trying to explain away their security problems as not really their fault. I feel like I'm reading some person's pet Wikipedia page. If they do then at least give some examples. You can't just say damning things and expect everyone to take it at face value.
- wjd2030 10y ago
  Seriously? Unfounded to say the least. LastPass has always been super transparent and forthcoming regarding ANY security issue.
gizmo686 10y ago
I don't. The phrasing was "both exploits do require tricking a user via a phishing attack into going to a malicious website". This suggests that the blogger believes that the only attack vector involves tricking the user to go to a malicious website; I can reasonably see calling such attacks phishing attacks. The problem (which is, in my opinion, more serious) is that, as you identify, the blogger seems to horribly misunderstand the potential attack vectors.
the_mitsuhiko 10y ago
I have not used LP in a long time but does not not prompt for the master password before filling?
- alistairjcbrown 10y ago
  I believe it depends on the settings for that entry - from "auto log in", "auto fill", "fill in when selected from menu" to "require master password before filling in"

kevin_thibedeau 10y ago

Password managers exchange a strong secret, something you know, for a weak one, something you have. Once an attacker gets to your database you're completely owned. When they compromise a normal password the damage is more contained if you maintain reasonable security practices.

saurik 10y ago
I thought the point of a password manager is to allow you to have separate passwords for numerous services which are protected by centralizing those passwords somewhere (preferably somewhere you control, such as your own phone) and protecting the result with one password. Your model of them seems to involve them replacing a password locally, which I don't think anyone would recommend.
- deleted 10y ago
  [deleted]
- EGreg 10y ago
  I would say password reuse can be pretty good! Simply have your own rule such as "letters 2 and 5 of the domain name" and combine those with your reusable password. In fact, I'd go further and say that you can do this with your login name. So for example: myemail+by@gmail.com for eBaY This also helps mitigate those attacks where the attacker actually contacts support and socially engineers them into giving all your info and even stealing your account: https://medium.com/@espringe/amazon-s-customer-service-backdoor-be375b3428c4#.xnxfahqib https://medium.com/@espringe/amazon-s-customer-service-backd... If you are hosting with AWS you should really consider doing that http://www.techinsider.io/hacker-social-engineer-2016-2 http://www.techinsider.io/hacker-social-engineer-2016-2
  - tonmoy 10y ago
    This "clever" security measure would be annihilated in case of a well planned attack targeted against a single individual.

cottsak 10y ago

This is not the same as https://labs.detectify.com/2016/07/27/how-i-made-lastpass-give-me-all-your-passwords/ https://labs.detectify.com/2016/07/27/how-i-made-lastpass-gi... is it?

mintplant 10y ago
No, the two disclosures just happened to come at the same time.
- jessaustin 10y ago
  Wow, a bad day for them. Two different awful bugs on the front page.
  - breakingcups 10y ago
    Up until now I wasn't aware there were two issues, I saw two very similar titles on the front page and assumed it was about the same issue. Might work out better for them than having one issue appear a week later.

mdesq 10y ago

I wonder how the Citrix acquisition/merger will affect LastPass, especially some of the security aspects.

JumpCrisscross 10y ago

Has LastPass ever subjected their code to a proper, outside security audit in a form tptacek would endorse?

mikkom 10y ago

So this post says > We have verified that intercepting messages via the method you suggested is possible and is a problem. We have also verified it only affects firefox (chrome, ie, safari, opera, etc do not use the window for message passing in the same manner) and doesn't affect our primary addons.mozilla.org firefox download (which is still 3.0 version). It seems latest version for windows is 4.1.20a? As I'm both linux and firefox user and there have been 2 password stealing exploits revealed I would very much like to know if this affects me (my version seems to be 3.3.1). Is there any version history that I could check or does anyone know what versions are affected by these 2 exploits?

keksdev 10y ago
They say version 3.0 is not affected by this: > If you are running LastPass 3.0, you are not impacted and do not need to update. As far as I know, 3.0 refers to their old interface. You can download the new version directly from their website, but not through the Firefox add-on site. The version history is available here [1]. [1] https://lastpass.com/upgrade.php https://lastpass.com/upgrade.php

Accacin 10y ago

So, I've been using Lastpass for a few years now and I probably rely on it too much. Every single login has a unique and strong password so it would be a pain to have to move away. I use a Yubikey that's required when I log into a new PC (my home pc is set to only ask every 30 days for my 2FA key), I use an email that is only connected to Lastpass and I have a strong passphrase. Any other device I use Lastpass on is set to require a password and 2FA key at each start. Is that enough to make me reasonably secure?

ciucanu 10y ago
It should be safe enough, with a few exceptions, one of those being this exploit: https://news.ycombinator.com/item?id=12171547 https://news.ycombinator.com/item?id=12171547 This guy says that if the webpage "asks" for another's page credentials, lastpass plugin will give it. Every character/keystroke in specific fields could be catched/logged , here you have an example from ... eBay : https://news.ycombinator.com/item?id=12000820 https://news.ycombinator.com/item?id=12000820 Anyway, this was already fixed and pushed to the users, as the guy mentions in his post.
mhurron 10y ago
LastPass does allow you to export all of your saved sites and passwords as an csv file. So moving away is simply exporting the vault and uninstalling the software. The LastPass exploits presented exist after you have unlocked your vault, so 2fa on the LastPass vault won't stop them. Personally, I'm not moving away from LastPass over these.