8 ms·

LastPass and the Heartbleed Bug

104 points by mjhoy 13y ago

mjhoy 13y ago
LastPass puts vulnerable in scare quotes. But to my understanding, with this bug session information to the website could have leaked, and they don't seem to address this. Could an attacker have hijacked logins?
- pgrote 13y ago
  No. Here is the explanation: "However, LastPass is unique in that your data is also encrypted with a key that LastPass servers don’t have access to. Your sensitive data is never transmitted over SSL unencrypted - it’s already encrypted when it is transmitted, with a key LastPass never receives. While this bug is still very serious, it could not expose LastPass customers’ encrypted data due to our extra layers of protection. On the majority of the web, user data is not encrypted before being transmitted over SSL, hence the widespread concern."
  - jbinto 13y ago
    This means "your passwords are safe, because they're encrypted with a key that only you have". It still means people could have hijacked your session, which is what GP was referring to. I don't use LastPass, but I speculate even if your data isn't vulnerable, people could use your ID/password to do malicious things (denial of service to your passwords being the first thought).
    - pgrote 13y ago
      I thought that too, until they mentioned logins at the end. Perhaps you are right. It would appear the session info would be compromised, but the login credentials would be protected.
    - Xylanthia 13y ago
      hijacking your session with lastpass wouldn't do someone any good, as they still wouldn't have access to anything. All they could attempt to get back is encrypted data. Your encryption key is never available.
  - deleted 13y ago
    [deleted]
    - deleted 13y ago
      [deleted]
    - pixl97 13y ago
      Lastpass appears to use TLS 1.2 with Forward Secrecy. They would have to hijack individual sessions (or somehow get the current session kays and capture the data at the same time).
- jbinto 13y ago
  It seems some servers had some combination of nginx+openssl that caused the memory location being dumped to always be a recent HTTP request/response. Keep hitting that enough times and you'll get all sorts of goodies (session cookies, cleartext passwords). This tweet shows someone getting credentials from Yahoo Mail: https://twitter.com/markloman/status/453502888447586304 https://twitter.com/markloman/status/453502888447586304 I think any service who suspects they've been vulnerable should issue a forced password reset email to their users. Even if there's only an infinitesimal chance of credential disclosure, how can you be sure, and why not take precautions?
EGreg 13y ago
Also, LastPass has employed a feature called “perfect forward secrecy”. This ensures that when security keys are changed, past and future traffic also can’t be decrypted even when a particular security key is compromised. I thought perfect forward secrecy simply gives you plausible deniability, or is that in the particular case of Off The Record messaging? How is it that a key I could have used yesterday to decrypt all the traffic I was capturing until yesterday suddely cannot be used to decrypt the same data, if none of it has changed in my vault?
- jnbiche 13y ago
  No, they're using the term correctly. The plausible deniability in OTR comes as a result of forward security. Since past and future traffic can't be decrypted with a certain captured key, the entity that captures that key can't cryptographically tie an identity to the previous messages.
  - mandalar12 13y ago
    It goes futher than that in OTR. After the ephemeral keys are out of use, the public keys (used for encryption, not decryption) are broadcasted so if later someone gets an old encrypted message, it could "effectively" have be written by anyone.
- blueskin_ 13y ago
  Plausible deniability is when you have a hidden datastream inside another encrypted one, as there's no way to prove it is or isn't there without the key. See: TrueCrypt. PFS means "If the server's private key is later compromised, it can't be used to decrypt past captured traffic".
icebraining 13y ago
I don't get it. If someone capture the SSL cert, they could be MITMing the server. Which means they could be serving poisoned JavaScript code to everyone who was using the website or the bookmarklets, code that could send the master password to the attacker's servers. How is this not vulnerable? EDIT: and more, what guarantees can they offer that the plugins downloaded from their site ever since their were vulnerable are not themselves trojanized? OpenSSL has been vulnerable since March 2012, how many downloads did they have since then?
- Erwin 13y ago
  I'm unclear on what you mean by "MITM... serving Javascript to EVERYONE". In a typical MITM scenario, you've logged into your coffee shop with an insecure network, or you are in some Middle Eastern country where all traffic is under control of the government. Unless you are somehow able to route all traffic through your network, you cannot MITM "everyone", no matter even you have the private certificate for lastpass.com.
  - jsn 13y ago
    Of course you can -- for example, if you are NSA and in position to apply pressure to whoever hosts lastpass SSL frontends.
    - icebraining 13y ago
      If you're the NSA, you can probably get a CA to sign a cert for you, no need to steal theirs. But MITM can still affect a lot of people if the attacker can get into a big gateway (e.g. large company, ISP, university, etc).
      - Xylakant 13y ago
        > If you're the NSA, you can probably get a CA to sign a cert for you, no need to steal theirs. That would leave a trace (at least the person issuing the cert would know) while heartbleed doesn't.
  - 13y ago
blueskin_ 13y ago
Should have used KeePass. Even HTTPS isn't perfect, so uploading your data to a third party is a bad idea.
- Fishkins 13y ago
  I've heard people say this before, but I'm a little confused by it. Do you only use one device? If not, how do you keep the PWs for your devices in sync without uploading your data somewhere?
  - scragg 13y ago
    I suppose you could carry it on a usb drive.
  - rquirk 13y ago
    Don't know about the OP, but I use a combination of sneakernet and scp to keep keepassx up to date across machines.
  - deleted 13y ago
    [deleted]
    - theboss 13y ago
      last pass never decrypts or encrypts anything on the server. Everything is decrypted and encrypted locally. Their website says so and many many security researchers, including me, have verified that...
      - blueskin_ 13y ago
        Have you seen the source? Have you verified the source you saw is what actually runs? I understand you actually might have; genuinely interested there. That said, no way I'm going to trust them, especially post-PRISM.
        theboss 13y ago
borplk 13y ago
Thank god I'm using Keepass I can put my head on the pillow comfortably.
- deleted 13y ago
  [deleted]
theboss 13y ago
I don't understand how anyone can throw last pass under the bus here. 0day where an unbelievable amount of sites are affected. last pass comes out and says we were vulnerable and we fixed it and provides information as to what it means for your data... I wish everyone did that... edit: A lot of people recommend keepass. keepass is vulnerable to the same thing everyone else is worried last pass was vulnerable to. kee pass' download site is HTTP. You could be getting trojaned binaries and incorrect shasums if you download it from ANYWHERE.
- streptomycin 13y ago
  I installed keepassx through my distro's package manager.
  - theboss 13y ago
    Where do you think they got the package from?
    - eikenberry 13y ago
      Compiled from source.
    - IgorPartola 13y ago
      To be fair, not where you think he got it from (it seems). For example, in Ubuntu you download all packages over plain HTTP. Worried yet? Don't be. Let me tell you why: A Debian repository (a repository of .deb packages) is a directory containing *.deb files, a list of packages in a file called Packages and a description of the repository in a file called Release. Every package listed in Packages includes the filename, the name and version of the package, and several checksums of the file (typically MD5sum, SHA1, SHA256, and SHA512). Thus if you trust Packages you can verify the integrity of the .deb file. Why should you trust the Packages file? Well, it's checksums are listed in the Release file. Why should you trust the Release file? Because there is a signature of it available in Release.gpg file. The signature is created by the distribution maintainers. How can you trust this signature? Because your initial installation ISO, etc. came with the public key of the distribution maintainers which APT uses to verify all the packages. How can you trust the ISO you used to install it? Because presumably you verified the checksums of it when you downloaded it, and you obtained those checksums over a secure channel at the time of the installation.
efuquen 13y ago
Not understanding some of the responses, I think they did a pretty nice job trying to address the issues in their posts. Of course you could have been MITM but the vast majority of that danger comes from using public wifi and if you're smart you should be using a VPN provider anyway. Realistically speaking here they found out about this at the same time as everyone else did and addressed it pretty quickly and professionally. Is there really anything else they or anyone else could have done, other then just use KeePass? Which has it's own major inconveniences that can only be addressed by some sort of cloud based solution (whether controlled by you or someone else), which probably would very likely have been using OpenSSL as well ...
- yblu 13y ago
  Any VPN provider that you can recommend?
  - efuquen 13y ago
    I use privateinternetaccess, good reference comparisons: http://lifehacker.com/5935863/five-best-vpn-service-providers http://lifehacker.com/5935863/five-best-vpn-service-provider... https://torrentfreak.com/which-vpn-services-take-your-anonymity-seriously-2014-edition-140315/ https://torrentfreak.com/which-vpn-services-take-your-anonym...
    - yblu 13y ago
      Great, thanks a lot for the links.
- eikenberry 13y ago
  Most VPN providers offer openvpn which uses openssl and thus is vulnerable as well.
  - efuquen 13y ago
    yup, good point. A good provider should have multiple protocol options but most people would use the default, something definitely to look into changing from the norm. i.e. if a lot of sites use OpenSSL for https then for your VPN you should probably use a different protocol, so no single vulnerability in either would screw you over.
IgorPartola 13y ago
The issue I have with LastPass is that they claim to never see your master password. This is not true in any sense. Open their website, log in using your master pass. You just submitted it to them. As a secondary thing, pick a random password from the list and say "Show me the password"; it will ask you for your master password. The extension you install has nothing to do with this: you are entering the password directly into their web page and interacting with their JavaScript and their server-side code. At this point they have your master password. I understand why they do this: it's convenient and lets you share/give passwords to others. But this feature is 100% incompatible with the claim that they never see your master password.
- stungeye 13y ago
  My understanding is that even with their web login process your password isn't sent to their servers in plaintext. From the comments on their heartbleed blog post: "We only use one-way salted hashes (after going through PBKDF2 rounds) to send to the server for authentication." So their servers get a hashed version of your password, but not the password itself. Their servers likely also store a hashed version of your password so that they can authenticate you. This style of auth is also used when you use the "show me the password" feature.
  - IgorPartola 13y ago
    This cannot be. Your passwords (the ones you are trying to protect) must be encrypted using your master password. LastPass needs to decrypt them somewhere using your master password. What you are describing is how their browser extension seems to work. However, their website does not require the extension to work. So either they implement security in JavaScript that's running within the page (cannot by definition be done securely), or they store all your passwords in a way that they can decrypt them (invalidates the use case for LastPass).
    - stungeye 13y ago
      The passwords are decrypted locally on your machine using javascript not on the lastpass servers.
davexunit 13y ago
Don't worry, you're still storing secret information with a proprietary web service that you can't audit. You're safe!
- RainbowRandolph 13y ago
  The website and extensions are mostly JavaScript, so you can audit the code yourself if you wish. LastPass does use a proprietary plugin for some features, but they have a binary free version for most, if not all browsers.
DavideNL 13y ago
This reminds me of the time when i downloaded the Lastpass iPhone app, synced it with my Macbook's Lastpass, opened the Lastpass iPhone app _for the first time_ and it uploaded all my data to icloud without asking for permission... #fail It was about a year ago, and at the time the iphone app apparently defaulted to 'sync -> iCloud -> on'.
LocalMan 13y ago
Password managers can protect you from being "Hacked" in the manner of destroying all your Gmail, and can help prevent your computer from being enslaved by a botnet. And probably help protect your bank account and any online medical records. But if the NSA or any competent government targets you as an individual, no password manager can help you. TrueCrypt might help, but even that has vulnerabilities.

104 points by mjhoy 13y ago

mjhoy 13y ago

LastPass puts vulnerable in scare quotes. But to my understanding, with this bug session information to the website could have leaked, and they don't seem to address this. Could an attacker have hijacked logins?

pgrote 13y ago
No. Here is the explanation: "However, LastPass is unique in that your data is also encrypted with a key that LastPass servers don’t have access to. Your sensitive data is never transmitted over SSL unencrypted - it’s already encrypted when it is transmitted, with a key LastPass never receives. While this bug is still very serious, it could not expose LastPass customers’ encrypted data due to our extra layers of protection. On the majority of the web, user data is not encrypted before being transmitted over SSL, hence the widespread concern."
- jbinto 13y ago
  This means "your passwords are safe, because they're encrypted with a key that only you have". It still means people could have hijacked your session, which is what GP was referring to. I don't use LastPass, but I speculate even if your data isn't vulnerable, people could use your ID/password to do malicious things (denial of service to your passwords being the first thought).
  - pgrote 13y ago
    I thought that too, until they mentioned logins at the end. Perhaps you are right. It would appear the session info would be compromised, but the login credentials would be protected.
  - Xylanthia 13y ago
    hijacking your session with lastpass wouldn't do someone any good, as they still wouldn't have access to anything. All they could attempt to get back is encrypted data. Your encryption key is never available.
- deleted 13y ago
  [deleted]
  - deleted 13y ago
    [deleted]
  - pixl97 13y ago
    Lastpass appears to use TLS 1.2 with Forward Secrecy. They would have to hijack individual sessions (or somehow get the current session kays and capture the data at the same time).
jbinto 13y ago
It seems some servers had some combination of nginx+openssl that caused the memory location being dumped to always be a recent HTTP request/response. Keep hitting that enough times and you'll get all sorts of goodies (session cookies, cleartext passwords). This tweet shows someone getting credentials from Yahoo Mail: https://twitter.com/markloman/status/453502888447586304 https://twitter.com/markloman/status/453502888447586304 I think any service who suspects they've been vulnerable should issue a forced password reset email to their users. Even if there's only an infinitesimal chance of credential disclosure, how can you be sure, and why not take precautions?

EGreg 13y ago

Also, LastPass has employed a feature called “perfect forward secrecy”. This ensures that when security keys are changed, past and future traffic also can’t be decrypted even when a particular security key is compromised. I thought perfect forward secrecy simply gives you plausible deniability, or is that in the particular case of Off The Record messaging? How is it that a key I could have used yesterday to decrypt all the traffic I was capturing until yesterday suddely cannot be used to decrypt the same data, if none of it has changed in my vault?

jnbiche 13y ago
No, they're using the term correctly. The plausible deniability in OTR comes as a result of forward security. Since past and future traffic can't be decrypted with a certain captured key, the entity that captures that key can't cryptographically tie an identity to the previous messages.
- mandalar12 13y ago
  It goes futher than that in OTR. After the ephemeral keys are out of use, the public keys (used for encryption, not decryption) are broadcasted so if later someone gets an old encrypted message, it could "effectively" have be written by anyone.
blueskin_ 13y ago
Plausible deniability is when you have a hidden datastream inside another encrypted one, as there's no way to prove it is or isn't there without the key. See: TrueCrypt. PFS means "If the server's private key is later compromised, it can't be used to decrypt past captured traffic".

icebraining 13y ago

I don't get it. If someone capture the SSL cert, they could be MITMing the server. Which means they could be serving poisoned JavaScript code to everyone who was using the website or the bookmarklets, code that could send the master password to the attacker's servers. How is this not vulnerable? EDIT: and more, what guarantees can they offer that the plugins downloaded from their site ever since their were vulnerable are not themselves trojanized? OpenSSL has been vulnerable since March 2012, how many downloads did they have since then?

Erwin 13y ago
I'm unclear on what you mean by "MITM... serving Javascript to EVERYONE". In a typical MITM scenario, you've logged into your coffee shop with an insecure network, or you are in some Middle Eastern country where all traffic is under control of the government. Unless you are somehow able to route all traffic through your network, you cannot MITM "everyone", no matter even you have the private certificate for lastpass.com.
- jsn 13y ago
  Of course you can -- for example, if you are NSA and in position to apply pressure to whoever hosts lastpass SSL frontends.
  - icebraining 13y ago
    If you're the NSA, you can probably get a CA to sign a cert for you, no need to steal theirs. But MITM can still affect a lot of people if the attacker can get into a big gateway (e.g. large company, ISP, university, etc).
    - Xylakant 13y ago
      > If you're the NSA, you can probably get a CA to sign a cert for you, no need to steal theirs. That would leave a trace (at least the person issuing the cert would know) while heartbleed doesn't.
- 13y ago

blueskin_ 13y ago

Should have used KeePass. Even HTTPS isn't perfect, so uploading your data to a third party is a bad idea.

Fishkins 13y ago
I've heard people say this before, but I'm a little confused by it. Do you only use one device? If not, how do you keep the PWs for your devices in sync without uploading your data somewhere?
- scragg 13y ago
  I suppose you could carry it on a usb drive.
- rquirk 13y ago
  Don't know about the OP, but I use a combination of sneakernet and scp to keep keepassx up to date across machines.
- deleted 13y ago
  [deleted]
  - theboss 13y ago
    last pass never decrypts or encrypts anything on the server. Everything is decrypted and encrypted locally. Their website says so and many many security researchers, including me, have verified that...
    - blueskin_ 13y ago
      Have you seen the source? Have you verified the source you saw is what actually runs? I understand you actually might have; genuinely interested there. That said, no way I'm going to trust them, especially post-PRISM.
      - theboss 13y ago

borplk 13y ago

Thank god I'm using Keepass I can put my head on the pillow comfortably.

deleted 13y ago
[deleted]

theboss 13y ago

I don't understand how anyone can throw last pass under the bus here. 0day where an unbelievable amount of sites are affected. last pass comes out and says we were vulnerable and we fixed it and provides information as to what it means for your data... I wish everyone did that... edit: A lot of people recommend keepass. keepass is vulnerable to the same thing everyone else is worried last pass was vulnerable to. kee pass' download site is HTTP. You could be getting trojaned binaries and incorrect shasums if you download it from ANYWHERE.

streptomycin 13y ago
I installed keepassx through my distro's package manager.
- theboss 13y ago
  Where do you think they got the package from?
  - eikenberry 13y ago
    Compiled from source.
  - IgorPartola 13y ago
    To be fair, not where you think he got it from (it seems). For example, in Ubuntu you download all packages over plain HTTP. Worried yet? Don't be. Let me tell you why: A Debian repository (a repository of .deb packages) is a directory containing *.deb files, a list of packages in a file called Packages and a description of the repository in a file called Release. Every package listed in Packages includes the filename, the name and version of the package, and several checksums of the file (typically MD5sum, SHA1, SHA256, and SHA512). Thus if you trust Packages you can verify the integrity of the .deb file. Why should you trust the Packages file? Well, it's checksums are listed in the Release file. Why should you trust the Release file? Because there is a signature of it available in Release.gpg file. The signature is created by the distribution maintainers. How can you trust this signature? Because your initial installation ISO, etc. came with the public key of the distribution maintainers which APT uses to verify all the packages. How can you trust the ISO you used to install it? Because presumably you verified the checksums of it when you downloaded it, and you obtained those checksums over a secure channel at the time of the installation.

efuquen 13y ago

Not understanding some of the responses, I think they did a pretty nice job trying to address the issues in their posts. Of course you could have been MITM but the vast majority of that danger comes from using public wifi and if you're smart you should be using a VPN provider anyway. Realistically speaking here they found out about this at the same time as everyone else did and addressed it pretty quickly and professionally. Is there really anything else they or anyone else could have done, other then just use KeePass? Which has it's own major inconveniences that can only be addressed by some sort of cloud based solution (whether controlled by you or someone else), which probably would very likely have been using OpenSSL as well ...

yblu 13y ago
Any VPN provider that you can recommend?
- efuquen 13y ago
  I use privateinternetaccess, good reference comparisons: http://lifehacker.com/5935863/five-best-vpn-service-providers http://lifehacker.com/5935863/five-best-vpn-service-provider... https://torrentfreak.com/which-vpn-services-take-your-anonymity-seriously-2014-edition-140315/ https://torrentfreak.com/which-vpn-services-take-your-anonym...
  - yblu 13y ago
    Great, thanks a lot for the links.
eikenberry 13y ago
Most VPN providers offer openvpn which uses openssl and thus is vulnerable as well.
- efuquen 13y ago
  yup, good point. A good provider should have multiple protocol options but most people would use the default, something definitely to look into changing from the norm. i.e. if a lot of sites use OpenSSL for https then for your VPN you should probably use a different protocol, so no single vulnerability in either would screw you over.

IgorPartola 13y ago

The issue I have with LastPass is that they claim to never see your master password. This is not true in any sense. Open their website, log in using your master pass. You just submitted it to them. As a secondary thing, pick a random password from the list and say "Show me the password"; it will ask you for your master password. The extension you install has nothing to do with this: you are entering the password directly into their web page and interacting with their JavaScript and their server-side code. At this point they have your master password. I understand why they do this: it's convenient and lets you share/give passwords to others. But this feature is 100% incompatible with the claim that they never see your master password.

stungeye 13y ago
My understanding is that even with their web login process your password isn't sent to their servers in plaintext. From the comments on their heartbleed blog post: "We only use one-way salted hashes (after going through PBKDF2 rounds) to send to the server for authentication." So their servers get a hashed version of your password, but not the password itself. Their servers likely also store a hashed version of your password so that they can authenticate you. This style of auth is also used when you use the "show me the password" feature.
- IgorPartola 13y ago
  This cannot be. Your passwords (the ones you are trying to protect) must be encrypted using your master password. LastPass needs to decrypt them somewhere using your master password. What you are describing is how their browser extension seems to work. However, their website does not require the extension to work. So either they implement security in JavaScript that's running within the page (cannot by definition be done securely), or they store all your passwords in a way that they can decrypt them (invalidates the use case for LastPass).
  - stungeye 13y ago
    The passwords are decrypted locally on your machine using javascript not on the lastpass servers.

davexunit 13y ago

Don't worry, you're still storing secret information with a proprietary web service that you can't audit. You're safe!

RainbowRandolph 13y ago
The website and extensions are mostly JavaScript, so you can audit the code yourself if you wish. LastPass does use a proprietary plugin for some features, but they have a binary free version for most, if not all browsers.

DavideNL 13y ago

This reminds me of the time when i downloaded the Lastpass iPhone app, synced it with my Macbook's Lastpass, opened the Lastpass iPhone app _for the first time_ and it uploaded all my data to icloud without asking for permission... #fail It was about a year ago, and at the time the iphone app apparently defaulted to 'sync -> iCloud -> on'.

LocalMan 13y ago

Password managers can protect you from being "Hacked" in the manner of destroying all your Gmail, and can help prevent your computer from being enslaved by a botnet. And probably help protect your bank account and any online medical records. But if the NSA or any competent government targets you as an individual, no password manager can help you. TrueCrypt might help, but even that has vulnerabilities.