Phishing attack against Lastpass • Hacker News Board

Re: Phishing attack against Lastpass

#11

Post by bikamonki » Sat, Jan 16, 2016, 11:46 PM UTC

greggarious wrote: post #8

bikamonki wrote: post #7

I believe so far my brain is still the best, if not only, secure password storage. To add a layer of security while reducing password complexity, I coded a small hasher so my brain remembers easy phrases and passwords come out of this tool über strong. I suppose I am still vulnerable to social engineering hacks or the attacker getting a hold of my hasher, but for such cases the only layer left is whatever vendors imp…

Still, that's just one password. Do you use this one password for all your accounts, or as input to a password manager? Or are you just manually copying and pasting this one super good hash into all your accounts? :/

I do manually copy/paste.

Re: Phishing attack against Lastpass

#12

Post by Oogoo » Sat, Jan 16, 2016, 11:51 PM UTC

bikamonki wrote: post #7

I believe so far my brain is still the best, if not only, secure password storage. To add a layer of security while reducing password complexity, I coded a small hasher so my brain remembers easy phrases and passwords come out of this tool über strong. I suppose I am still vulnerable to social engineering hacks or the attacker getting a hold of my hasher, but for such cases the only layer left is whatever vendors imp…

I like this idea. It allows you do something as simple as:

"[password phrase] + facebook"

"[password phrase] + bank"

etc for all of your passwords, and as long as the hasher works well, you have strong, random passwords for everything.

Re: Phishing attack against Lastpass

#13

Post by l1n » Sun, Jan 17, 2016, 12:04 AM UTC

th0br0 wrote: post #3

jnevill wrote: post #2

This is of the devil. It needs to be burned with fire and the ashes should be sunk in the Mariana trench and the trench should be filled with dirt that has been cursed by a witch that was formerly dead but was reanimated by Cthulhu and then rekilled, burned with fire, and buried on the opposite side of the earth. Everything here is usual phishing stuff, but that Chrome-Extension.pw url is disturbing combined with the…

Where's that quote coming from? It's awesome.

Seems to be ungoogleable. Maybe it's unique :D

Re: Phishing attack against Lastpass

#14

Post by DyslexicAtheist » Sun, Jan 17, 2016, 12:15 AM UTC

bikamonki wrote: post #7

I believe so far my brain is still the best, if not only, secure password storage. To add a layer of security while reducing password complexity, I coded a small hasher so my brain remembers easy phrases and passwords come out of this tool über strong. I suppose I am still vulnerable to social engineering hacks or the attacker getting a hold of my hasher, but for such cases the only layer left is whatever vendors imp…

have been tinkering with this idea also something like

   *echo -n 'my unique passphrase' |sha512sum*

only issue is this shows up in your memory and on disk (e.g. .bash_history)

Re: Phishing attack against Lastpass

#15

Post by infinitelurker » Sun, Jan 17, 2016, 12:22 AM UTC

vosper wrote: post #5

Woah, this is scary. I'll need to look closely at LastPass alternatives (perhaps something that runs separately from the browser, even if it's a little more clunky to use than LastPass's integration).

This isn't the first time that LastPass has had security issues and it seems like a fools game to use a password manager that keeps you data in the cloud.

https://www.blackhat.com/eu-15/briefings.html#even-the-lastp...

https://blog.lastpass.com/2015/06/lastpass-security-notice.h...

I've been very happy with 1password, runs locally can be synced directly to other devices. https://agilebits.com/onepassword

Does anyone have experience with 1password security breaches?

Re: Phishing attack against Lastpass

#16

Post by delhanty » Sun, Jan 17, 2016, 12:32 AM UTC

I have 1Password on Mac and the 1Password Chrome extension. But for typing my master password in, I always use the Mac application. That's because I'm worried that the Chrome extension might be vulnerable.

Re: Phishing attack against Lastpass

#17

Post by veddan » Sun, Jan 17, 2016, 12:33 AM UTC

DyslexicAtheist wrote: post #14

bikamonki wrote: post #7

I believe so far my brain is still the best, if not only, secure password storage. To add a layer of security while reducing password complexity, I coded a small hasher so my brain remembers easy phrases and passwords come out of this tool über strong. I suppose I am still vulnerable to social engineering hacks or the attacker getting a hold of my hasher, but for such cases the only layer left is whatever vendors imp…

have been tinkering with this idea also something like *echo -n 'my unique passphrase' |sha512sum* only issue is this shows up in your memory and on disk (e.g. .bash_history)

Prefix the command with a space and bash won't save it in its history.

Re: Phishing attack against Lastpass

#18

Post by chrisfosterelli » Sun, Jan 17, 2016, 12:52 AM UTC

infinitelurker wrote: post #15

vosper wrote: post #5

Woah, this is scary. I'll need to look closely at LastPass alternatives (perhaps something that runs separately from the browser, even if it's a little more clunky to use than LastPass's integration).

This isn't the first time that LastPass has had security issues and it seems like a fools game to use a password manager that keeps you data in the cloud. https://www.blackhat.com/eu-15/briefings.html#even-the-lastp... https://blog.lastpass.com/2015/06/lastpass-security-notice.h... I've been very happy with 1password, runs locally can be synced directly to other devices. https://agilebits.com/onepassword Does anyone…

I don't think that's a fair criticism of Lastpass for having "security issues" for the following reasons:

1. In the blog post you linked, no user passwords were at risk. They were being abundantly cautious, which makes sense since they hold everyone's passwords.

2. In the talk you linked, this is a inherent problem with storing keys on your local filesystem and not a problem with Lastpass. 1password is also "vulnerable" to this attack.

3. This current phishing attack is not a vulnerability in Lastpass itself, or anything wrong with their cryptography. As the author points out, anyone who falls for this will receive an automatic email notice (if 2FA is not on) from Lastpass and if you have geographic restrictions enabled this attack won't work at all (note 1password does not have these features).

4. Storing encrypted data in the cloud is not inherently a vulnerability, although it increases your attack surface. Many users of 1password also do this with features like Dropbox sync, and Dropbox provides much less rigorous access control compared to Lastpass.

5. 1password has had it's own share of security blunders. The most recent being their database format that leaks all of your account names and the URL they are for, which 1password defended was for "performance reasons". http://myers.io/2015/10/22/1password-leaks-your-data/

EDIT: Updated to mention that alert emails are only sent if 2FA is disabled.

Re: Phishing attack against Lastpass

#19

Post by stordoff » Sun, Jan 17, 2016, 12:57 AM UTC

chrisfosterelli wrote: post #6

vosper wrote: post #5

Woah, this is scary. I'll need to look closely at LastPass alternatives (perhaps something that runs separately from the browser, even if it's a little more clunky to use than LastPass's integration).

I'll keep using Lastpass and I'm not sure that this is really their fault, but I have to say this is the first phishing scheme that I've thought "Wow, I would definitely fall for that". The chrome-extension.pw domain looked almost exactly the same as the Lastpass URL at first glance. I wonder if it would help if Chrome added a special URL-bar designation for extensions. EDIT: It looks like Chromium has an issue for a…

Same here. I saw the screenshot before scrolling down to see the explanation, and assumed it was the real thing shown for comparison purposes. Very convincing attack.

Edit: assume->assumed

Re: Phishing attack against Lastpass

#20

Post by redwards510 » Sun, Jan 17, 2016, 12:58 AM UTC

This is amazing not just for the execution, but the plain simplicity of it. Could you get around this by always clicking on the browser bar LastPass button when you want to login?

I've noticed LastPass will often log out seemingly at random. This is supposed to be determined by a combination of your settings like "only allow one IP logged in at a time", which would log you out if you switched on your VPN for instance. However, it can appear to happen out of the blue, which makes this attack more dangerous, because people are used to that occurring.

LastPass has a binary extension option for Chrome, hopefully they put that to use here with a desktop window that pops up for you to log in. But the fact that they just got bought by LogMeIn (and their reply to this issue) worries me that they won't do anything.