Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden Heist – How to break into password vaults without using passwords

blog.redteam-pentesting.de

Post reply on HN
Print view View original

101–110 of 209 posts

Re: Bitwarden Heist – How to break into password vaults without using passwords

#101

Post by UberFly »

selykg wrote: post #7
2bluesc wrote: post #3

This affects Windows only. Really feel that should've made it to the title other it feels like click bait.

I worked in managing bug bounty programs at a previous job. If there is one thing I have learned it's that blog posts like this are heavily skewed towards making the problem seem much larger than it is. It's what gets the clicks, so it's not a surprise. It makes dealing with penetration testers and bug bounty participants really stressful and frankly, annoying. Our policy was that we would be happy if someone were to…

"BITWARDEN HEIST - HOW TO BREAK INTO PASSWORD VAULTS WITHOUT USING PASSWORDS"

Like this one??

Re: Bitwarden Heist – How to break into password vaults without using passwords

#102

Post by justincormack »

AlienRobot wrote: post #58
mrguyorama wrote: post #43

Earlier quoted context omitted.

>python script on GitHub that allows to decrypt passwords the browser stores locally in their %Appdata% directory. Yes, otherwise known as "if you run code on your computer, it can run code on your computer". If a random python program can "decrypt" the passwords, that's not encryption. And browser password management isn't about security, but convenience.

>if you run code on your computer, it can run code on your computer For the love of God will someone please just make a web browser that isn't a web browser and it's just a cross platform multimedia sandbox with a couple of APIs in it, and you can run programs written in rust or something on it, and it doesn't let the programs touch your file system unless it has explicit permission? That would solve 99% of the appli…

Thats pretty much Wasm with Wasi (minus multimedia though right now)

Re: Bitwarden Heist – How to break into password vaults without using passwords

#103

Post by edrxty »

WalterBright wrote: post #56
lordofmoria wrote: post #50

Earlier quoted context omitted.

Everything is a tradeoff - but the basic balance is very strongly in favor of password managers: 1. without a password manager that is shared on all your devices, you WILL re-use passwords out of frustration. 2. without a password manager, if you do any sort of regular sharing passwords with a engineering team, friends & family, you'll resort to pretty insecure channels. 3. true E2E encryption, while still providing…

With a keylogger, you lose passwords you typed in since the keylogger was installed, but that is rarely all of your passwords.

Most of these managers support some form of 2fa. I use a yubikey with mine such that if my master password is compromised someone would still need to obtain my security key. You can enroll multiple and keep one in a safe and one or more on your person. It's not perfect, but it prevents the vast majority of huge dragnet style malware attacks and a lot of the targeted ones until you get to the point where someone is trying to hunt you down on the street.

This still leaves a case where someone manages to get the final key out of memory but you're pretty hosed at that point anyway. I'd prefer a system where the yubikey itself is doing the final credential decryption instead of the CPU, unfortunately most people aren't that paranoid though.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#104

Post by NegativeK »

chimprich wrote: post #67
WalterBright wrote: post #42

I've always considered password vaults as a single point of failure that will compromise all of your passwords. I've had lots of intelligent, well-informed programmers argue that my concern is groundless.

That's because it is a SPOF. However, a password manager seems to me the best compromise along the security / convenience axes. I memorise good passwords for a handful of my most critical stuff (and have MFA). They don't go in my password manager. If my password manager gets compromised then I probably could lose some cash, maybe get embarrassed by being impersonated on social media - it could get very inconvenient b…

PW managers are SPOF that typically replace a different, worse SPOF: humans trying to remember all of the passwords.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#105

Post by thereddaikon »

zelon88 wrote: post #49
walki wrote: post #35

Microsoft's %Appdata% directory is a security nightmare in my opinion. Ideally applications should only have access to their own directories in %Appdata% by default. I recently came across a python script on GitHub that allows to decrypt passwords the browser stores locally in their %Appdata% directory. Many attacks could be prevented if access to %Appdata% was more restricted. I also found a post of an admin a few d…

"AppData" is where user specific application data is supposed to be stored. "The Registry" is where application configuration is supposed to be stored. "ProgramData" is where application specific data is supposed to be stored. "Program Files" is where read-only application binaries and code is supposed to be stored. It really is a simple concept from a Windows perspective. What ruins everything is overzealous and/or…

Microsoft themselves don't understand that. Teams installs itself to appdata in its entirety. One full install of teams for each user profile. Keeping it updated across one machine is impossible. How can we expect anyone else to do it right when Microsoft allows its own employees to abuse it?

Re: Bitwarden Heist – How to break into password vaults without using passwords

#106

Post by thereddaikon »

newZWhoDis wrote: post #93
zelon88 wrote: post #49

Earlier quoted context omitted.

"AppData" is where user specific application data is supposed to be stored. "The Registry" is where application configuration is supposed to be stored. "ProgramData" is where application specific data is supposed to be stored. "Program Files" is where read-only application binaries and code is supposed to be stored. It really is a simple concept from a Windows perspective. What ruins everything is overzealous and/or…

Is this post sarcastic and I’m just missing it? 4 different locations to store program data, some of which are hidden, is freaking stupid design. Like, beyond moronic design. Everything, and I mean everything, about a program should be in a single folder structure and the OS should by-default lock that application to only accessing it’s own folder unless otherwise granted permission (in a centrally auditable/revocabl…

That makes managing a user's application specific data difficult though. For one you have different user's data intermingling which potentially causes new problems. But on top of that you make managing and backing up that data more difficult. As it works now with appdata you can back up a user's profile folder under C:\users and get everything they have assuming they haven't gone out of their way to save data to a strange place. If all data for an app lived in program files then backing up and restoring that data becomes much harder.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#107

Post by FuriouslyAdrift »

thereddaikon wrote: post #105
zelon88 wrote: post #49

Earlier quoted context omitted.

"AppData" is where user specific application data is supposed to be stored. "The Registry" is where application configuration is supposed to be stored. "ProgramData" is where application specific data is supposed to be stored. "Program Files" is where read-only application binaries and code is supposed to be stored. It really is a simple concept from a Windows perspective. What ruins everything is overzealous and/or…

Microsoft themselves don't understand that. Teams installs itself to appdata in its entirety. One full install of teams for each user profile. Keeping it updated across one machine is impossible. How can we expect anyone else to do it right when Microsoft allows its own employees to abuse it?

The original Teams was an Electron app and was stuck with Google's methods.

The new Teams is based on WebView2 and runs from C:\Program Files\WindowsApps\

Re: Bitwarden Heist – How to break into password vaults without using passwords

#108

Post by whoisthemachine »

withinboredom wrote: post #90
nulld3v wrote: post #83

Earlier quoted context omitted.

I don't think this is fair. Linux and Mac used to operate in generally the same fashion. Only recently have they started sandboxing stuff. Windows doesn't have the same privileges because they are forced to maintain backwards compatibility.

It's just as bad there with everyone randomly shoving dot-files in my home directory instead of using ~/.config, ~/.local, ~/.cache, and friends. Just to name a few in my home dir ... aws, cargo, dotnet, yarn, vscode... All of these narcissistic tools are pretty annoying.

40% of those tools are majority controlled by Microsoft...

Re: Bitwarden Heist – How to break into password vaults without using passwords

#109

Post by oefrha »

hattmall wrote: post #82
zelon88 wrote: post #49

Earlier quoted context omitted.

"AppData" is where user specific application data is supposed to be stored. "The Registry" is where application configuration is supposed to be stored. "ProgramData" is where application specific data is supposed to be stored. "Program Files" is where read-only application binaries and code is supposed to be stored. It really is a simple concept from a Windows perspective. What ruins everything is overzealous and/or…

So what category does stored browser passwords fall? Because it sounds like " user specific application data " which is in AppData, which is the issue. But if that's not correct which of those locations is?

It should be in AppData. Gp is just a really weird unrelated rant.

ggp: unsandboxed AppData (unsandboxed filesystem in general, really) allowing everyone to read everyone else’s stuff is a security nightmare.

gp: stupid programmers don’t respect Windows’ simple scheme to place data in four different places!

What? Even if everyone places data correctly, they can still read everyone else’s stuff, as long as they belong to the same user. That’s the problem.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#110

Post by pi-e-sigma »

EvanAnderson wrote: post #87
at_a_remove wrote: post #85

Earlier quoted context omitted.

Okay, so that's the sysadmin perspective. Tell me about the user perspective. Then, we should talk about, when they are in conflict, which one comes first.

A dev is going to include UI to manage the settings if non-technical users are expected to modify them. Whether those settings go in an INI or the registry doesn't matter at all for that UI. Having said, that level of technical skill req'd to edit an INI or the registry is about the same. Either way you're talking about a non-technical user descending thru a hierarchy of strange-to-them named containers to get to an…

How is the registry going to make that administration any easier? The registry is its own micro cosmos, doesn't matter if some setting is in an INI file somewhere on the filesystem or somewhere in the registry
Post reply on HN