6 ms·

Seems like a broken 2FA implementation.

by bobleeswagger 4y ago

Thorrez 4y ago
2FA can't protect you from malware on your machine.
- bobleeswagger 4y ago
  Sure, but I wouldn't expect the vault to be accessible without 2FA each time it is cached. 2FA should be used as part of the decryption process even if the vault is cached.
  - Thorrez 4y ago
    You expect 2FA to be used for decryption? I'm not aware of any system with that does that that has any significant amount of usage. Even if the 2FA was used for decryption, it wouldn't really make you much safer, because malware can steal the decrypted vault out of memory right after you type in the 2FA. A HSM would solve this, as long as the HSM has some out of band way to communicate with the user, such as an approval button that malware can't press and a screen saying what password to release.
    - bobleeswagger 4y ago
      > Even if the 2FA was used for decryption, it wouldn't really make you much safer If the second factor is stripped for some arbitrary time, you don't have 2FA anymore. Your argument that "any adversary can read the vault from memory" is a weak one, we might as well not have passwords with that attitude. The point of a second factor is that BOTH need to be present to get to the secrets. If one of those factors is stripped away for "convenience" we're misunderstanding the point of 2FA entirely. I can't make this any clearer.
      - Thorrez 4y ago
        >Your argument that "any adversary can read the vault from memory" is a weak one, we might as well not have passwords with that attitude. It all comes down to threat model. If you don't have malware on your machine, 2FA and passwords are quite useful. If you do have malware on your machine, they're basically useless. This is basically the same for any service. Name one website or program that's safe even if you have malware on your machine. >If one of those factors is stripped away for "convenience" we're misunderstanding the point of 2FA entirely. I can't make this any clearer. It's not for convenience. It's because there's no practical way to implement encryption/decryption with 2FA. You seem to think there's some practical way to do it, but there isn't. Lastpass 2FA protects against the threat model of an attacker who has stolen your password. In that case, the attacker cannot steal the contents of your database because the attacker can't get any form of the database, encrypted or decrypted due to not having the 2FA. Unfortunately now that an attacker has stolen all the encrypted databases by compromising Lastpass itself, this threat model is no longer realistic against this one specific attacker or any attackers that this attacker shares the loot with, because they now all have your encrypted database.
        bobleeswagger 4y ago
        > You seem to think there's some practical way to do it, but there isn't. It is an implementation detail of the password manager itself. Any password manager can update their implementation to ensure the second factor is always needed when decrypting the vault. I'm not sure why you think this is an impossible feat. It's a choice that can be made.
        Thorrez 4y ago
        How? What type of 2FA are you talking about? Is there any that does this that many people use? The only thing I know that does encryption with 2FA is https://keepass.info/plugins.html#otpkeyprov https://keepass.info/plugins.html#otpkeyprov . But I highly doubt it has much usage. It's going to be annoying typing in a 2FA every time you decrypt your password database (I decrypt my password database maybe 10 times per day). More concerningly, if you press the button on your 2FA device (this is HOTP, which requires you to press a button to get a new code) too many times, or typo the 2FA too many times, you can permanently lose access to your database because the HOTP device will advance past the point that the database supports. So yes, it's a choice that can be made, but it has very major downsides.
- jhoelzel 4y ago
  why wouldn't it? And its not so much about protecting me, but to protect company interest right?
  - secabeen 4y ago
    Read the technical details of TOTP, at root, you and the other end are performing similar mathematical operations on a shared secret such that knowledge of a single result gives you no information about later results. The actual check is just a string compare; the result is not included in the vault decryption operations in any way. Thus, if you have root, you can just alter the Check2FA() function to return true. I'm not aware of any encryption algorithm that can include rotating 2FA data in the actual decryption process.
    - Thorrez 4y ago
      There's a keypass plugin that allows you to encrypt and decrypt your database with HOTP. I doubt it has much usage. It seems really inconvenient, and also potentially dangerous, because if your HOTP provider gets too far ahead of your database (you press the button too many times, or typo too many times), you permanently lose access to your data. You would want a HOTP provider that supports rewinding to avoid that problem. But I think HOTP doesn't really support rewinding very much. https://keepass.info/plugins.html#otpkeyprov https://keepass.info/plugins.html#otpkeyprov But this is beside the point I was making. My point was that even if the the database was encrypted with 2FA, right after you enter your 2FA malware can steal the decrypted database out of memory.
      - secabeen 4y ago
        Indeed. That's a neat plugin, each time you lock the database, it rolls forward your HOTP key some number of rounds, then uses the results of those rounds to encrypt a piece of key material for the vault. Then, when you go to decrypt, as long as your HOTP app hasn't generated more than the number of rounds it rolled forward, it can generate the decryption key from the HOTP stream and decrypt the vault. A little fragile, but a neat implementation. > right after you enter your 2FA malware can steal the decrypted database out of memory. There's probably a creative protection here where each key is encrypted individually, but you'd still need some solution like the above HOTP trick or the attacker could scrape the key information out of memory, then decrypt each entry individually.
razemio 4y ago
How would you fix this problem with 2fa? I can't imagine how this would work technically. Maybe I am missing something.
- execveat 4y ago
  You could ask user to present second factor (secure one, Webauthn) for every password they access. That would be a notable obstacle for me as an attacker, but I can't imagine any organization implementing this for real (maybe apart from military/spooks and their contractors). All of the IAM solutions I know of cache their creds and password manager usually is expected to work offline as well, so I don't think you can avoid having recoverable (in the CS meaning of the word) database locally.
  - bobleeswagger 4y ago
    It doesn't need to be every password, just require 2FA to unlock the vault in the first place. Downloading the vault shouldn't strip one factor, but it seems like that is the implementation.
    - Fabricio20 4y ago
      I'm not aware of any encryption algos that can encrypt data using a rotating key such as a TOTP code. The vault file is encrypted using the master password, if you encrypted it with the TOTP code you wouldn't be able to decrypt it 30s later, and if you have logic to parse the 2FA I can just replace your logic with return true;
      - bobleeswagger 4y ago
        Wouldn't this be an implementation detail of the password manager? Either way, I hear you that this is asking for new functionality. Still, I don't think most people think that a factor disappears depending on the caching policy of the vault on your machine. It's quite a footgun.

Seems like a broken 2FA implementation.

Thorrez 4y ago

2FA can't protect you from malware on your machine.

bobleeswagger 4y ago
Sure, but I wouldn't expect the vault to be accessible without 2FA each time it is cached. 2FA should be used as part of the decryption process even if the vault is cached.
- Thorrez 4y ago
  You expect 2FA to be used for decryption? I'm not aware of any system with that does that that has any significant amount of usage. Even if the 2FA was used for decryption, it wouldn't really make you much safer, because malware can steal the decrypted vault out of memory right after you type in the 2FA. A HSM would solve this, as long as the HSM has some out of band way to communicate with the user, such as an approval button that malware can't press and a screen saying what password to release.
  - bobleeswagger 4y ago
    > Even if the 2FA was used for decryption, it wouldn't really make you much safer If the second factor is stripped for some arbitrary time, you don't have 2FA anymore. Your argument that "any adversary can read the vault from memory" is a weak one, we might as well not have passwords with that attitude. The point of a second factor is that BOTH need to be present to get to the secrets. If one of those factors is stripped away for "convenience" we're misunderstanding the point of 2FA entirely. I can't make this any clearer.
    - Thorrez 4y ago
      >Your argument that "any adversary can read the vault from memory" is a weak one, we might as well not have passwords with that attitude. It all comes down to threat model. If you don't have malware on your machine, 2FA and passwords are quite useful. If you do have malware on your machine, they're basically useless. This is basically the same for any service. Name one website or program that's safe even if you have malware on your machine. >If one of those factors is stripped away for "convenience" we're misunderstanding the point of 2FA entirely. I can't make this any clearer. It's not for convenience. It's because there's no practical way to implement encryption/decryption with 2FA. You seem to think there's some practical way to do it, but there isn't. Lastpass 2FA protects against the threat model of an attacker who has stolen your password. In that case, the attacker cannot steal the contents of your database because the attacker can't get any form of the database, encrypted or decrypted due to not having the 2FA. Unfortunately now that an attacker has stolen all the encrypted databases by compromising Lastpass itself, this threat model is no longer realistic against this one specific attacker or any attackers that this attacker shares the loot with, because they now all have your encrypted database.
      - bobleeswagger 4y ago
        > You seem to think there's some practical way to do it, but there isn't. It is an implementation detail of the password manager itself. Any password manager can update their implementation to ensure the second factor is always needed when decrypting the vault. I'm not sure why you think this is an impossible feat. It's a choice that can be made.
        Thorrez 4y ago
        How? What type of 2FA are you talking about? Is there any that does this that many people use? The only thing I know that does encryption with 2FA is https://keepass.info/plugins.html#otpkeyprov https://keepass.info/plugins.html#otpkeyprov . But I highly doubt it has much usage. It's going to be annoying typing in a 2FA every time you decrypt your password database (I decrypt my password database maybe 10 times per day). More concerningly, if you press the button on your 2FA device (this is HOTP, which requires you to press a button to get a new code) too many times, or typo the 2FA too many times, you can permanently lose access to your database because the HOTP device will advance past the point that the database supports. So yes, it's a choice that can be made, but it has very major downsides.
jhoelzel 4y ago
why wouldn't it? And its not so much about protecting me, but to protect company interest right?
- secabeen 4y ago
  Read the technical details of TOTP, at root, you and the other end are performing similar mathematical operations on a shared secret such that knowledge of a single result gives you no information about later results. The actual check is just a string compare; the result is not included in the vault decryption operations in any way. Thus, if you have root, you can just alter the Check2FA() function to return true. I'm not aware of any encryption algorithm that can include rotating 2FA data in the actual decryption process.
  - Thorrez 4y ago
    There's a keypass plugin that allows you to encrypt and decrypt your database with HOTP. I doubt it has much usage. It seems really inconvenient, and also potentially dangerous, because if your HOTP provider gets too far ahead of your database (you press the button too many times, or typo too many times), you permanently lose access to your data. You would want a HOTP provider that supports rewinding to avoid that problem. But I think HOTP doesn't really support rewinding very much. https://keepass.info/plugins.html#otpkeyprov https://keepass.info/plugins.html#otpkeyprov But this is beside the point I was making. My point was that even if the the database was encrypted with 2FA, right after you enter your 2FA malware can steal the decrypted database out of memory.
    - secabeen 4y ago
      Indeed. That's a neat plugin, each time you lock the database, it rolls forward your HOTP key some number of rounds, then uses the results of those rounds to encrypt a piece of key material for the vault. Then, when you go to decrypt, as long as your HOTP app hasn't generated more than the number of rounds it rolled forward, it can generate the decryption key from the HOTP stream and decrypt the vault. A little fragile, but a neat implementation. > right after you enter your 2FA malware can steal the decrypted database out of memory. There's probably a creative protection here where each key is encrypted individually, but you'd still need some solution like the above HOTP trick or the attacker could scrape the key information out of memory, then decrypt each entry individually.

razemio 4y ago

How would you fix this problem with 2fa? I can't imagine how this would work technically. Maybe I am missing something.

execveat 4y ago
You could ask user to present second factor (secure one, Webauthn) for every password they access. That would be a notable obstacle for me as an attacker, but I can't imagine any organization implementing this for real (maybe apart from military/spooks and their contractors). All of the IAM solutions I know of cache their creds and password manager usually is expected to work offline as well, so I don't think you can avoid having recoverable (in the CS meaning of the word) database locally.
- bobleeswagger 4y ago
  It doesn't need to be every password, just require 2FA to unlock the vault in the first place. Downloading the vault shouldn't strip one factor, but it seems like that is the implementation.
  - Fabricio20 4y ago
    I'm not aware of any encryption algos that can encrypt data using a rotating key such as a TOTP code. The vault file is encrypted using the master password, if you encrypted it with the TOTP code you wouldn't be able to decrypt it 30s later, and if you have logic to parse the 2FA I can just replace your logic with return true;
    - bobleeswagger 4y ago
      Wouldn't this be an implementation detail of the password manager? Either way, I hear you that this is asking for new functionality. Still, I don't think most people think that a factor disappears depending on the caching policy of the vault on your machine. It's quite a footgun.