Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden Heist – How to break into password vaults without using passwords

blog.redteam-pentesting.de

Post reply on HN
Print view View original

131–140 of 209 posts

Re: Bitwarden Heist – How to break into password vaults without using passwords

#131

Post by Wowfunhappy »

dessimus wrote: post #98
Wowfunhappy wrote: post #89

Earlier quoted context omitted.

What if Microsoft limited these APIs to programs with "Compatibility Mode" enabled? (And—this may already be the case, I'm not sure—made it impossible to enable compatibility mode programmatically?) I feel like this would create a strong incentive for modern software to do things "properly", while still allowing legacy software to run (albeit with a couple of extra clicks).

Look how long we're still dealing with software that requires Java 6/7/8, and all the security issues that come with that. Servers/Appliances with IPMI remote consoles that do not support HTML5. It's easy to say "Replace the equipment" but our budgets don't always allow for that.

I think Microsoft's commitment to backwards compatibility is awesome. But it would still be better to at least get newer apps working the right way. Even in the event those legacy apps remain in use for ~forever, at least there would be fewer of them.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#132

Post by pbhjpbhj »

thereddaikon wrote: post #106
newZWhoDis wrote: post #93

Earlier quoted context omitted.

Is this post sarcastic and I’m just missing it? 4 different locations to store program data, some of which are hidden, is freaking stupid design. Like, beyond moronic design. Everything, and I mean everything, about a program should be in a single folder structure and the OS should by-default lock that application to only accessing it’s own folder unless otherwise granted permission (in a centrally auditable/revocabl…

That makes managing a user's application specific data difficult though. For one you have different user's data intermingling which potentially causes new problems. But on top of that you make managing and backing up that data more difficult. As it works now with appdata you can back up a user's profile folder under C:\users and get everything they have assuming they haven't gone out of their way to save data to a st…

I guess the OS keeping track of .../programs/NameOfProgram/user settings/NameOfUser is just impossible? Or having an app install create a link in /users/NameOfUser/program-config/NameOfProgram to the config folder is equally impossible magic ...?

Re: Bitwarden Heist – How to break into password vaults without using passwords

#133

Post by axus »

calamari4065 wrote: post #130
jtriangle wrote: post #127

Earlier quoted context omitted.

>an .ini file should not be a thing in Windows Hard, hard disagree there. Having config files available is vastly preferable to using the unmitigated shitshow that is the windows registry. That and a config file at least gives users a prayer at being able to provide some sort of troubleshooting information, and provides savvy users with a way to actually solve problems on their own. >half ass ports it to windows Redm…

Agreed. The windows registry needs to be killed with fire. There's no appreciable difference between the registry and a directory of config files except that instead of an INI parser you have to use the much, much worse WIN32 API. Editing config files is fairly safe and user-intuitive. Sure you can break something by writing the wrong config file, but you do not risk breaking everything . But clumsy use of regedit do…

But it's so easy to export all my PuTTY profiles from the SimonTatham registry folder to a .reg file and use on the next computer...

Re: Bitwarden Heist – How to break into password vaults without using passwords

#134

Post by kemotep »

lordofmoria wrote: post #57
WalterBright wrote: post #56

Earlier quoted context omitted.

With a keylogger, you lose passwords you typed in since the keylogger was installed, but that is rarely all of your passwords.

Absolutely agree - that's why I said "so the real difference is you've conveniently pre-loaded all your sensitive information in one go for the bad actor."

The average person usually does the same but without encryption or strong passwords.

I’ll stick to passwords that are impossible to guess and an encrypted vault with multifactor authentication.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#135

Post by SSLy »

EvanAnderson wrote: post #70
zelon88 wrote: post #49

Earlier quoted context omitted.

"AppData" is where user specific application data is supposed to be stored. "The Registry" is where application configuration is supposed to be stored. "ProgramData" is where application specific data is supposed to be stored. "Program Files" is where read-only application binaries and code is supposed to be stored. It really is a simple concept from a Windows perspective. What ruins everything is overzealous and/or…

As a Windows sysadmin AppData has been an unmitigated shit show forever. Developers (including those inside Microsoft) don't give a damn about how Microsoft intends anything to work, and AppData has become a dumping ground of software installs to end-run IT departments. A lot of malware dumps into there but good luck limiting execution from that directory hierarchy because all your business-critical end user communic…

And converse, on Linux it's so hard to get every shitty tool to put files in XDG dirs, not spew them all over ~.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#136

Post by dharmab »

Aerbil313 wrote: post #126

Tangential, what is the state of security on Linux desktop nowadays? Say out-of-the-box Debian 12 using Wayland. Is it still just that nobody is attacking Linux so it's safe?

Out of the box is not enough. Debian has a checklist for building a secure system, as well as some helper tools for configuration: https://www.debian.org/doc/manuals/securing-debian-manual/in...

Re: Bitwarden Heist – How to break into password vaults without using passwords

#137

Post by pixl97 »

cameronh90 wrote: post #91
zelon88 wrote: post #49

Earlier quoted context omitted.

"AppData" is where user specific application data is supposed to be stored. "The Registry" is where application configuration is supposed to be stored. "ProgramData" is where application specific data is supposed to be stored. "Program Files" is where read-only application binaries and code is supposed to be stored. It really is a simple concept from a Windows perspective. What ruins everything is overzealous and/or…

The point is that, nowadays, apps should by default be isolated from each other, rather than AppData and HKCU being a free-for-all. Windows makes it hard to whitelist known-safe apps (there’s WDAC but it’s poorly documented and a PITA) and every program you run has access to everything of importance on your system. Imagine how upset people would be if it turned out TikTok on your phone can access your entire iCloud D…

We accept it on the desktop because the desktop app model is from before the internet. There was only 'trusted' applications that had access to all the users data (and really most of the time the entire machine), and really there wasn't even the idea of an internet connection being built in at all. In addition desktop applications are based around the ability to read the users data files. Desktop users typically want all their excel files accessed, along with any embedded images from anywhere in their user directory.

For the most part the changes you'd want to implement for security would ruin the productivity most of the workflows desktop users have these days, and would take a massive amount of refactoring to get to work anywhere close to what they do now.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#138

Post by firen777 »

WalterBright wrote: post #42

I've always considered password vaults as a single point of failure that will compromise all of your passwords. I've had lots of intelligent, well-informed programmers argue that my concern is groundless.

The way I look at it is, password vault is a single point of failure with a very VERY tiny attack surface that attacker will need to directly target you with a sniper rifle to actually hit you (assuming you are not using things like Lastpass. I personally use Keepass and synchronize the local vault across devices using Syncthing). Suffice to say, unless your last name is Snowden, it should not be a concern to you.

Comparing to the common way of "managing" password (i.e. reusing one password everywhere), it is still a single point of failure. The difference is the attack surface balloons up in proportion to the number of website you sign up to. And just like a balloon, all it need is one poke, one website storing your password in plaintext to blow it all up.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#139

Post by blep_ »

AlienRobot wrote: post #58
mrguyorama wrote: post #43

Earlier quoted context omitted.

>python script on GitHub that allows to decrypt passwords the browser stores locally in their %Appdata% directory. Yes, otherwise known as "if you run code on your computer, it can run code on your computer". If a random python program can "decrypt" the passwords, that's not encryption. And browser password management isn't about security, but convenience.

>if you run code on your computer, it can run code on your computer For the love of God will someone please just make a web browser that isn't a web browser and it's just a cross platform multimedia sandbox with a couple of APIs in it, and you can run programs written in rust or something on it, and it doesn't let the programs touch your file system unless it has explicit permission? That would solve 99% of the appli…

The JVM did that many years ago and nobody liked it. I can't help but think wasm is just the same idea but worse.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#140

Post by raggi »

calamari4065 wrote: post #130
jtriangle wrote: post #127

Earlier quoted context omitted.

>an .ini file should not be a thing in Windows Hard, hard disagree there. Having config files available is vastly preferable to using the unmitigated shitshow that is the windows registry. That and a config file at least gives users a prayer at being able to provide some sort of troubleshooting information, and provides savvy users with a way to actually solve problems on their own. >half ass ports it to windows Redm…

Agreed. The windows registry needs to be killed with fire. There's no appreciable difference between the registry and a directory of config files except that instead of an INI parser you have to use the much, much worse WIN32 API. Editing config files is fairly safe and user-intuitive. Sure you can break something by writing the wrong config file, but you do not risk breaking everything . But clumsy use of regedit do…

There are real integration challenges with the "simple file approach":

  - File locking and concurrency
  - Atomic writes / moves
  - Realtime change observations
> clumsy use of regedit does have a chance of totally borking the entire system.

So does a clumsy rm -rf, which shows up in stories here far more often than stories of people breaking their registry.

Can you provide a recent reference to someone bricking their system with regedit?

Post reply on HN