Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How did my LastPass master password get leaked?

news.ycombinator.com

Post reply on HN
Print view View original

281–290 of 529 posts

Re: Ask HN: How did my LastPass master password get leaked?

#281

Post by Fnoord »

criley2 wrote: post #94
ComputerGuru wrote: post #43

Earlier quoted context omitted.

There was no 1Password to LastPass importer at the time I wrote that (believe me, I looked because I have better things to do than write apps to benefit a commercial entity like agilebits otherwise), and of course the code is published on GitHub and released under the MIT license. It's very short and simple and rather easy to review. It's also a .NET executable, which is ridiculously easy to reverse-compile back to C…

Just because you put a warning label on a bad practice doesn't mean it's a good practice. Pumping your passwords through some random code on Github that has a "be smart" label doesn't make it a good idea. Would be so easy to imitate you, reupload the code with an exploit. For giggles, if I was making this into a hijack I'd leave all your warnings in and even make them bigger and more obvious, confident in the knowled…

1) Clone random git repo on Kali, related to Kali usage.

2) Don't read the code.

3) ???

4) Forever don't know what or when it happened.

Re: Ask HN: How did my LastPass master password get leaked?

#282

Post by zdragnar »

gregsadetsky wrote: post #259
tim333 wrote: post #247

Earlier quoted context omitted.

I just tried logging into my LassPass (not used for a while) and I entered the password wrongly (I capitalised one letter) and got an email "Someone just used your master password to try to log in to your account from a device or location we didn't recognize." Maybe it says someone used your master password even if they didn't? It gave the IP as Islington which is kind of correct.

I think that password case is a separate issue. If I remember correctly, many online services do "secretly" accept mixed cases for the same password (because users make more mistakes than they realize and it would be "annoying" to be too strict) If you didn't receive a "Someone just used" email (with an IP that's completely geographically off from where you are) that's a good sign, of course.

I tried pushing back on just such a request once, pointing out it made of of the password "security" requirements pointless (use mixed case letters).

"But famous company X does this, it is really convenient for users!" was all the response I got. All I could do at the time was (internally) shake my head.

Re: Ask HN: How did my LastPass master password get leaked?

#283

Post by Godel_unicode »

colejohnson66 wrote: post #249
wholinator2 wrote: post #245

Earlier quoted context omitted.

Why ignore VPNs? Im sure someone else can chime in but to my knowledge that's what makes them useless. You can't be sure someone isn't running VPN, then you can never be certain GeoIP is correct, thus it's useless.

Because everyone knows that VPN IPs’ geoloc is useless, so I assumed that those were being ignored. Also because it’s possible to see if an IP is (possibly) a VPN one by looking up the owner.

As with most things IP-related, this is only somewhat true. There are a lot of VPN providers that specialize in not getting their exit IPs marked as VPNs, so just because an IP isn't listed as a VPN by your intel provider of choice doesn't mean it's not a VPN. GDPR also means finding netblocks with super generic IP-whois is really easy.

Geo-ip is a perfect analysis trap, because it seems like it's probably a good idea so people put it into the roadmap. Then they spend forever tracking down all the ways it doesn't work (I bet you have customers in whatever geo you're thinking of blocking, there's a surprising amount of netblocks that are attributed incorrectly, etc), and then the sunk cost fallacy leads them to maintaining their creaky system. Imagine what you could have done with that effort in the meantime.

Now, let's put our badguy hat on. It takes effectively zero time to tell if your target is geo-blocking (compare your port results between several geos, or cheat with censys and shodan). Being blocked? Launch your attack from IP space in another geo. Pro-tip on that: nobody blacklists cloud provider IP space because of VDI solutions. You can migrate between stolen cloud accounts faster than the provider can suspend them, especially for reconnaissance and initial payload delivery.

Edit: see also, renting time on botnets, renting physical colo, compromising residential ISP equipment, and friends.

Re: Ask HN: How did my LastPass master password get leaked?

#284

Post by Fnoord »

sillysaurusx wrote: post #102
dogman123 wrote: post #47

Earlier quoted context omitted.

posting another comment here too for visibility, but this _just_ happened to me as well.... Time Monday, December 27, 2021 at 1:41 PM EST Location São Paulo, SP 01323, BRAZIL IP address 160.116.88.235

Hmm. So I don't know if this means anything, but I was googling for the IP address and wound up at https://ipinfo.io/160.116.88.235 which says hostname: visit.keznews.com. When you go to that hostname, it's one of the best phishing sites I've ever seen. They dynamically inserted my ISP's logo (Spectrum) and tried to do a phishing attempt: https://i.imgur.com/C9HQw1c.png The full non-clickable URL: https://us.poonstat…

Great post, seriously.

How many extensions are you using again? :-)

Re: Ask HN: How did my LastPass master password get leaked?

#286

Post by Fnoord »

donmcronald wrote: post #280
rjp0008 wrote: post #220

Earlier quoted context omitted.

Can't use the same PIN as a hacker would just add myhackurl.com/login to your vault and see what the PIN came across as. I think you'd also run into issues with password length as a lot of sites still have a restriction. I like the idea though and maybe a different implementation could work.

I mean a PIN that's not stored in the vault or auto-filled. It would be something extra that you add manually after the password manager fills in the password So the password manager would put in 'password' and I'd manually type '1234' to make it 'password1234'.

That would not have stopped the vulnerability 'LastPass bug leaks credentials from previous site' (see Zdnet article posted elsewhere) though that's not a common vulnerability in software.

Re: Ask HN: How did my LastPass master password get leaked?

#287

Post by robbedpeter »

gregsadetsky wrote: post #218
robbedpeter wrote: post #142

Earlier quoted context omitted.

A login attempt without the 2fa token, failed with valid master password, so far a handful of others have reported it in this thread.

It's a side note, but I had 2fa enabled on my LastPass account but didn't have access to my token (it's an old phone that I don't have anymore). I was able to remove the 2fa by clicking a link that LastPass sent to my email (confirming that I wanted to remove the 2fa). So if anyone has your LastPass master password and has access to your email, it's game over and having the 2fa enabled on the LastPass account won't d…

Lol, that's horrible. Between things like that and simjacking, phones seem to be a terrible thing to involve in security. And people, I guess.

Re: Ask HN: How did my LastPass master password get leaked?

#288

Post by gregsadetsky »

IsThisYou wrote: post #277

> Is the email from LastPass accurate I don't know LastPass, but is it possible to login and see what emails they sent you? Or maybe see a list of login attempts?

Yes, it's possible to see all of this in the "Account History"

And yes, the same things -- failed password attempts (i.e. someone trying the wrong passwords) and "Login Verification Email" (sent when the correct password is used from a new IP) -- all appear in the Account History.

Unfortunately, the phishing scenario is improbable at this point, and there have also been multiple corroborating reports in this thread.

Re: Ask HN: How did my LastPass master password get leaked?

#289

Post by gregsadetsky »

robbedpeter wrote: post #287
gregsadetsky wrote: post #218

Earlier quoted context omitted.

It's a side note, but I had 2fa enabled on my LastPass account but didn't have access to my token (it's an old phone that I don't have anymore). I was able to remove the 2fa by clicking a link that LastPass sent to my email (confirming that I wanted to remove the 2fa). So if anyone has your LastPass master password and has access to your email, it's game over and having the 2fa enabled on the LastPass account won't d…

Lol, that's horrible. Between things like that and simjacking, phones seem to be a terrible thing to involve in security. And people, I guess.

Yeah, and I used an app instead of sms on my phone for the 2fa token. Didn't make a lick of a difference...

Re: Ask HN: How did my LastPass master password get leaked?

#290

Post by IsThisYou »

donmcronald wrote: post #204
trajcek wrote: post #194

Just happened to me one hour ago and got scared shitless. Time Monday, December 27, 2021 at 3:50 PM EST Location UNITED STATES IP address 107.173.195.83 Actions taken, in this order: - Head to *Advanced Options* -> *View account history* to see if anything suspicious is going on (nothing so far) - Disable Lastpass MFA and use Google Authenticator (Authy) - *Account Settings* -> click on *Show Advanced Settings* -> *D…

This is my worst nightmare and I wonder what the order of operations is in terms of downloading and unlocking a vault. This sounds like you need the master password to download and unlock the vault, so that’s a tiny bit of extra protection I guess (not much). I wonder if password managers should be designed around, and encourage the use of, an undocumented PIN that’s appended to every stored password. You could use t…

Isn't that what 2FA is for? An additional "PIN" that changes every couple of seconds.

Also, do not store your 2FA reset codes in the same account as your passwords.

Post reply on HN