Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass autofill exploit

labs.detectify.com

Post reply on HN
Print view View original

111–120 of 443 posts

Re: LastPass autofill exploit

#111

Post by icebraining »

starquake wrote: post #20
ktta wrote: post #13

I've been using LastPass for about 3 years, and now I'm seriously thinking about all the times people told me about how storing passwords in someone else's cloud is bad. I've been defending LastPass and recommending it to everyone till today. Now I'm thinking about how I might have to 'pay' for a software vulnerability in some private (read:unauditable by me) code. All the comments about offline, local backups make s…

I do not use LastPass exactly because of what you describe. I use a KeePass Password safe without autofill. I use other software to sync the file. It used to be Dropbox, later I was using BitTorrent Sync, but what tool sync shouldn't really matter. As I see it: the tool only gets to see and sync an encrypted file. You could even use a USB stick and not sync at all. Or only sync on LANs. I love it how I get to decide…

Lastpass also only syncs data after it's encrypted locally, so the threat model is the same.

Re: LastPass autofill exploit

#112

Post by kmiroslav »

rietta wrote: post #102
kmiroslav wrote: post #97

I don't quite follow. The author says that by entering the URL " http://avlidienbrunn.se/@twitter.com/@hehe.php" , the extension is fooled into autofilling as if the browser was on twitter.com. What's the difference with simply going to " http://twitter.com" ? This looks more like a bug than a vulnerability, what am I missing?

A bug that tricks the secure password management tool into revealing your Twitter password to a website that is not Twitter! That's a pretty major security vulnerability due to a bug in URL parsing.

But the information is not sent to the server, it's simply pasted in the text field.

Re: LastPass autofill exploit

#113

Post by icebraining »

zaroth wrote: post #69
mcs wrote: post #12

Please correct me if I am mistaken, but couldn't this have been implemented into an iframe that when ran could send the passwords to another remote server? If so, I am a little taken back by LastPass only offering $1,000 to the researcher that found and reported it for fixing. He or she could have taken a different path and resulted in this being used in some complex targeted attack against tech corporations via shor…

Normally I like bike shedding about bug bounty payouts just about as much as complaints about paywalls. If you are going to go poking around someone's code for fun or profit, the terms of the bounty program are readily available [1] so you can't complain after the fact for earning the maximum payout. LastPass isn't Facebook, and they never claimed they would pay more than $1,000 even for a full compromise or RCE. On…

you can't complain after the fact for earning the maximum payout

Why not? Sure, you can't accuse them of being dishonest, but why would simply announcing an action make it beyond reproach?

Re: LastPass autofill exploit

#114

Post by cyberpanther »

Great catch and everyone should know there is an easy way to parse URLs in JS. Just create an anchor element and let the browser parse it for you. Like so:

var parser = document.createElement('a');

parser.href = "http://example.com:3000/pathname/?search=test#hash";

parser.protocol; // => "http:"

parser.hostname; // => "example.com"

parser.port; // => "3000"

parser.pathname; // => "/pathname/"

parser.search; // => "?search=test"

parser.hash; // => "#hash"

parser.host; // => "example.com:3000"

Re: LastPass autofill exploit

#115

Post by throwawayReply »

dzmien wrote: post #88
K0nserv wrote: post #72

Earlier quoted context omitted.

The concern with the low payout is that it's supposed to be a way to compensate white hat hackers and dissuaded them from going to the black market with security problems like this. Given the business that LastPass is in wouldn't you agree that it's extremely crucial they make sure white hat hackers are aptly compensated for serious problems they find? In fact I'd think it'd be reasonable for them to pay more than Fa…

Wouldn't a true white hat hacker report the bug no matter what the bounty? Therefor, the bounty is in place to encourage black-hat hackers to report the bug instead of trying to profit from exploiting it. But I do agree that it is in a security company's best interest to offer high dollar sums for reporting crucial bugs. I am just arguing semantics :-)

It isn't a choice between "bother to submit or not", it's a case of a white-hat might be encouraged to look into this product rather than another product because of the bounty.

So the end effect is more bugs found by "white hats" rather than "black hats" because the bounty has focused the "white hat" efforts on your program. (Or encouraged them to look at all.)

I'm likely to poke around a site with a bug bounty even with small sums just because it hints at a more formal process and also likely means they have a sensible policy about not going after testers.

Bug bounties are as much about signalling than encouraging "black hats" to suddenly turn to the light side.

Re: LastPass autofill exploit

#116

Post by andybak »

ktta wrote: post #13

I've been using LastPass for about 3 years, and now I'm seriously thinking about all the times people told me about how storing passwords in someone else's cloud is bad. I've been defending LastPass and recommending it to everyone till today. Now I'm thinking about how I might have to 'pay' for a software vulnerability in some private (read:unauditable by me) code. All the comments about offline, local backups make s…

> I'm seriously thinking about all the times people told me about how storing passwords in someone else's cloud is bad.

This was a client-side bug and so surely doesn't depend on the fact that your passwords are 'stored in someone else's cloud'?

i.e. If there was only local storage of passwords this vulnerability would still be there.

(Also worth noting that lastpass encrypts your remote and local store with a key which is presumably only stored hashed and salted on their side)

Re: LastPass autofill exploit

#117

Post by oslavonik »

Alpacalex wrote: post #75
SaturateDK wrote: post #61

Earlier quoted context omitted.

I want an alternative, got a good one?

If you're using a *nix system: https://www.passwordstore.org/ I switched over from LastPass a few months ago. It uses gpg for encryption and supports git for password syncing between systems. Pretty simple to set up and use. There are quite a few third party apps for it already (both desktop and mobile)

I've been amazed by Pass, but couldn't find a thorough review between Pass and KeePass(x). Is one safer than the other?

Re: LastPass autofill exploit

#118

Post by lukasm »

Another regex bug what a surprise. Do not store whole password in LastPass. To mitigate this kind of attack I store only part of it on LastPass. The full password is + +

It's just a tiny overhead to my workflow.

Re: LastPass autofill exploit

#119

Post by zaroth »

onion2k wrote: post #84
k__ wrote: post #62

Earlier quoted context omitted.

They sold their future. The next bug will be sold to the highest bidder.

People find and disclose bugs regularly even where there isn't a bounty. Most (at least 99.99%) developers don't want to see a useful, successful product fail even if they can personally gain from it. The likelihood that an exploit for Lastpass will be discovered by an attacker and sold to a nefarious actor is very small. Further to that though, we now know that this problem is fixed in LastPass. We don't know about…

I have become a bit of a skeptic -- we know that a problem like this existed in the code-base and is now fixed. So, should we then conclude that LastPass is now "more secure" because of it, or is the existence of this face-palm bug in production code actually evidence that LassPass is "less secure"? Certainly I would not go so far as to claim that this bugfix somehow makes LassPass a better option than its rivals.

I put more/less secure in scare quotes, because my point is really that fixing one particular bug certainly closes that one particular attack vector, but security is not a progress bar that goes from 0 to 100.

What this write-up does in my mind is really highlight the risks that come along with using a complex piece of software to manage your passwords. We tell users they can use password managers to safeguard their passwords and increase their security. We talk a lot about the usability trade-offs which password managers entail, but perhaps not as much about the security trade-offs!

Re: LastPass autofill exploit

#120

Post by virtualwhys »

jrockway wrote: post #76
mcs wrote: post #12

Please correct me if I am mistaken, but couldn't this have been implemented into an iframe that when ran could send the passwords to another remote server? If so, I am a little taken back by LastPass only offering $1,000 to the researcher that found and reported it for fixing. He or she could have taken a different path and resulted in this being used in some complex targeted attack against tech corporations via shor…

Let's do a little calculation to see if the payout is worthwhile. Using something illegally means you run the risk of going to prison. Let's say there's a 1% chance you get caught, the prison sentence is 10 years, and the evil hackers will pay you $20,000 for your bug. Let's also say that you're a mid-career software engineer in the US, and over the next 10 years you expect to make $2M (after taxes). This means your…

> over the next 10 years you expect to make $2M (after taxes)

That would be $300K per year pre-tax (assuming current 2016 tax rate of 33% for the 200-400K bracket). Is that really a normal mid-career salary?

I need to change jobs if that's the case...

Post reply on HN