Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass autofill exploit

labs.detectify.com

Post reply on HN
Print view View original

81–90 of 443 posts

Re: LastPass autofill exploit

#81

Post by Donzo »

jrockway wrote: post #76
mcs wrote: post #12

Please correct me if I am mistaken, but couldn't this have been implemented into an iframe that when ran could send the passwords to another remote server? If so, I am a little taken back by LastPass only offering $1,000 to the researcher that found and reported it for fixing. He or she could have taken a different path and resulted in this being used in some complex targeted attack against tech corporations via shor…

Let's do a little calculation to see if the payout is worthwhile. Using something illegally means you run the risk of going to prison. Let's say there's a 1% chance you get caught, the prison sentence is 10 years, and the evil hackers will pay you $20,000 for your bug. Let's also say that you're a mid-career software engineer in the US, and over the next 10 years you expect to make $2M (after taxes). This means your…

There is also the reputation boost that the researcher receives for discovering this exploit and disclosing it in a responsible manner. The value of that is incalculable.

Re: LastPass autofill exploit

#82

Post by koolba »

ktta wrote: post #13

I've been using LastPass for about 3 years, and now I'm seriously thinking about all the times people told me about how storing passwords in someone else's cloud is bad. I've been defending LastPass and recommending it to everyone till today. Now I'm thinking about how I might have to 'pay' for a software vulnerability in some private (read:unauditable by me) code. All the comments about offline, local backups make s…

> 1. I can go to any computer with chrome and get access to all my passwords, so don't have to carry my passwords with me everywhere.

Maybe a computer you can trust but I wouldn't say any computer. I consider the shared PC you'd find in a hotel business center to be the digital equivalent of a diseased hooker. I'd be impressed if it didn't have a key logger installed.

> 2. Don't have to worry about storing passwords properly since lastpass is a good company and they know their stuff about protecting the customers' data.

Not being OSS I don't think that can be proven. It boils down to "Trust us, we're smart".

> I'd like to hear the thoughts of anyone else who uses lastpass and what they think.

Trust noone and put your faith in OSS (KeepassX, pass, etc).

Re: LastPass autofill exploit

#83

Post by zaroth »

K0nserv wrote: post #72
zaroth wrote: post #69

Earlier quoted context omitted.

Normally I like bike shedding about bug bounty payouts just about as much as complaints about paywalls. If you are going to go poking around someone's code for fun or profit, the terms of the bounty program are readily available [1] so you can't complain after the fact for earning the maximum payout. LastPass isn't Facebook, and they never claimed they would pay more than $1,000 even for a full compromise or RCE. On…

The concern with the low payout is that it's supposed to be a way to compensate white hat hackers and dissuaded them from going to the black market with security problems like this. Given the business that LastPass is in wouldn't you agree that it's extremely crucial they make sure white hat hackers are aptly compensated for serious problems they find? In fact I'd think it'd be reasonable for them to pay more than Fa…

There are many people capable of finding this specific bug and reporting it who might be motivated to take a look by a bug bounty, but who would never even consider trying to sell an exploit on the black market. I agree there is one cohort where you are trying to offer them an alternative to illegally monetizing their exploits. Then there is another cohort who you are just trying to encourage them to spend some time with your code versus someone else's. I could only guess at the relative sizes of the two groups, but the optimist in me thinks bug bounties are less about the former than the latter.

As we can see from avlidienbrunn2's response [1] sometimes it's not about the money. It's just fulfilling a natural curiosity about a product, maybe getting your killer write-up of a shocking bug to hit the top of the HN frontpage, etc. So in this case perhaps the bounty program is as much about establishing a legal structure for a whitehat to operate under than to fairly compensate ad hoc pen-testers. I wish they paid 10x or more for this bug. But I'm glad at least pen-testers can report these bugs without [as much] fear of reprisal.

[1] - https://news.ycombinator.com/item?id=12171753

Re: LastPass autofill exploit

#84

Post by onion2k »

k__ wrote: post #62
avlidienbrunn2 wrote: post #29

Earlier quoted context omitted.

At the time I submitted this, they didn't even have a bug bounty. Considering that, I think $1,000 is great :)

They sold their future. The next bug will be sold to the highest bidder.

People find and disclose bugs regularly even where there isn't a bounty. Most (at least 99.99%) developers don't want to see a useful, successful product fail even if they can personally gain from it. The likelihood that an exploit for Lastpass will be discovered by an attacker and sold to a nefarious actor is very small.

Further to that though, we now know that this problem is fixed in LastPass. We don't know about other password managers. To that end, LastPass is now a better option than it's rivals.

Re: LastPass autofill exploit

#85

Post by obsurveyor »

techdragon wrote: post #41
avolcano wrote: post #5

I'm generally very sympathetic to regex bugs (especially in a language like JavaScript where you don't get nice expanded multiline regexes with comments), but I am wondering why they went with a regex in the first place. Did they decide `document.location.host` was too brittle for some reason?

I'd agree if there wasn't an extremely good solution to this problem. Verbal Expressions - It's an extremely good higher level interface to the underlying regular expressions tools, in MANY languages. Including: JavaScript - https://github.com/VerbalExpressions/JSVerbalExpressions ActionScript 3 - https://github.com/VerbalExpressions/AS3VerbalExpressions Clojure - https://github.com/VerbalExpressions/ClojureVerbalExp…

You could have just linked to http://verbalexpressions.github.io instead of spamming all the repositories. Also, about half of them are out of date by 3 or more years.

Re: LastPass autofill exploit

#86

Post by estefan »

avlidienbrunn2 wrote: post #29
mcs wrote: post #12

Please correct me if I am mistaken, but couldn't this have been implemented into an iframe that when ran could send the passwords to another remote server? If so, I am a little taken back by LastPass only offering $1,000 to the researcher that found and reported it for fixing. He or she could have taken a different path and resulted in this being used in some complex targeted attack against tech corporations via shor…

At the time I submitted this, they didn't even have a bug bounty. Considering that, I think $1,000 is great :)

I think paying only $1000 for a potentially company-imploding bug like that is incredibly short sighted.

It's far too low to motivate a lot of people to look for bugs, and to me suggests they're not serious about protecting their reputation if someone does find such a company-destroying bug.

Re: LastPass autofill exploit

#87

Post by estefan »

RangerScience wrote: post #30
maze-le wrote: post #23

Earlier quoted context omitted.

Yes, my thoughts exactly. He could had made 100x that money on the black market, so no wonder we still have problems with 0days traded there. How long would you work for $1,000? Some days, a week, two? If you spend more than a week on this problem it seems not worth to report it... On the other hand, if you set the incentive for bug bounty too high I imagine all sorts of cranks pop up, that want to show off bugs that…

"You agree not to disclose the full amount awarded you as part of this bug bounty award contract."

If the full amount is <=1000 it's irrelevant what you're actually awarded for a bug as serious as this.

Re: LastPass autofill exploit

#88

Post by dzmien »

K0nserv wrote: post #72
zaroth wrote: post #69

Earlier quoted context omitted.

Normally I like bike shedding about bug bounty payouts just about as much as complaints about paywalls. If you are going to go poking around someone's code for fun or profit, the terms of the bounty program are readily available [1] so you can't complain after the fact for earning the maximum payout. LastPass isn't Facebook, and they never claimed they would pay more than $1,000 even for a full compromise or RCE. On…

The concern with the low payout is that it's supposed to be a way to compensate white hat hackers and dissuaded them from going to the black market with security problems like this. Given the business that LastPass is in wouldn't you agree that it's extremely crucial they make sure white hat hackers are aptly compensated for serious problems they find? In fact I'd think it'd be reasonable for them to pay more than Fa…

Wouldn't a true white hat hacker report the bug no matter what the bounty? Therefor, the bounty is in place to encourage black-hat hackers to report the bug instead of trying to profit from exploiting it. But I do agree that it is in a security company's best interest to offer high dollar sums for reporting crucial bugs. I am just arguing semantics :-)

Re: LastPass autofill exploit

#89

Post by daddykotex »

Alpacalex wrote: post #75
SaturateDK wrote: post #61

Earlier quoted context omitted.

I want an alternative, got a good one?

If you're using a *nix system: https://www.passwordstore.org/ I switched over from LastPass a few months ago. It uses gpg for encryption and supports git for password syncing between systems. Pretty simple to set up and use. There are quite a few third party apps for it already (both desktop and mobile)

I use password store to, and it works really well. I'm on MacOS but having it to work under Android and Windows was a breeze.

Re: LastPass autofill exploit

#90

Post by elktea »

obsurveyor wrote: post #85
techdragon wrote: post #41

Earlier quoted context omitted.

I'd agree if there wasn't an extremely good solution to this problem. Verbal Expressions - It's an extremely good higher level interface to the underlying regular expressions tools, in MANY languages. Including: JavaScript - https://github.com/VerbalExpressions/JSVerbalExpressions ActionScript 3 - https://github.com/VerbalExpressions/AS3VerbalExpressions Clojure - https://github.com/VerbalExpressions/ClojureVerbalExp…

You could have just linked to http://verbalexpressions.github.io instead of spamming all the repositories. Also, about half of them are out of date by 3 or more years.

The point being it's available for a wide range of languages
Post reply on HN