Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass autofill exploit

labs.detectify.com

Post reply on HN
Print view View original

141–150 of 443 posts

Re: LastPass autofill exploit

#141

Post by jxpx777 »

cyberpanther wrote: post #114

Great catch and everyone should know there is an easy way to parse URLs in JS. Just create an anchor element and let the browser parse it for you. Like so: var parser = document.createElement('a'); parser.href = " http://example.com:3000/pathname/?search=test#hash "; parser.protocol; // => "http:" parser.hostname; // => "example.com" parser.port; // => "3000" parser.pathname; // => "/pathname/" parser.search; // => "…

Disclosure: I work for AgileBits, makers of 1Password.

For browser extensions, the URL constructor would be even easier: https://developer.mozilla.org/en-US/docs/Web/API/URL/URL (Yes, I know it says that IE doesn't support it, but IE doesn't have a proper extensions framework, so it's irrelevant to this topic.)

Re: LastPass autofill exploit

#143

Post by JackC »

dkopi wrote: post #124
cyberpanther wrote: post #114

Great catch and everyone should know there is an easy way to parse URLs in JS. Just create an anchor element and let the browser parse it for you. Like so: var parser = document.createElement('a'); parser.href = " http://example.com:3000/pathname/?search=test#hash "; parser.protocol; // => "http:" parser.hostname; // => "example.com" parser.port; // => "3000" parser.pathname; // => "/pathname/" parser.search; // => "…

While that might be an "easy way" - it isn't a secure way in this case. Since malicious attackers have complete control over the page you're seeing - they can simply replace document.createElement with their own function. And instead of returning a DOM object, they can return an object that returns whatever they want in .hostname

I think the point is that this would run in a document belonging to the LastPass extension -- not that it would run in javascript injected into the target site.

The same attack you describe could be applied to basically any javascript you cared to write (say, String.prototype.length). The safest approach is to treat the output of injected javascript as untrusted third-party input to your extension code and work from there.

Re: LastPass autofill exploit

#144

Post by lorenzhs »

avlidienbrunn2 wrote: post #99
thruflo wrote: post #73

Earlier quoted context omitted.

Perhaps LassPass users might like to donate to show their gratitude -- after all, you just protected an awful lot of people's passwords. Have you got a mechanism you could post here for them to do so?

You may donate by spreading the word about multi-factor auth :)

That's a great response. I really like my Yubikey (Neo) and wish I could use it with more sites.

Re: LastPass autofill exploit

#145

Post by cloudjacker »

tptacek wrote: post #139
cloudjacker wrote: post #134

Earlier quoted context omitted.

What he's saying is "raise the bid" Your rationale would be a valid rebuttal in your world no matter what the amounts in question were. $500? Incentive! $50? Incentive!

This is a non-sequitur response to my comment, whose whole purpose is to point out that a bug bounty is not a bid in an auction against organized crime.

You wish it was a non sequitur when it is completely relevant

We can agree to disagree because the perspective really wasn't for you, it was for everyone else reading that will share a sentiment they've felt but never articulated

Re: LastPass autofill exploit

#146

Post by jxpx777 »

mabcat wrote: post #71
SaturateDK wrote: post #61

Earlier quoted context omitted.

I want an alternative, got a good one?

I switched to 1Password after Lastpass got acquired. I obviously have no special knowledge how secure it is but it's serving me well. OSX browser integration excellent, iOS integration mediocre.

Disclosure: I work for AgileBits, makers of 1Password.

If you're interested, all our data formats are well documented for review: https://blog.agilebits.com/2013/03/06/you-have-secrets-we-do... You might also be interested in the security white paper for our hosted 1Password service: https://1password.com/security/ (White paper is linked at the bottom of the page.)

Re: LastPass autofill exploit

#147

Post by tptacek »

K0nserv wrote: post #98
zaroth wrote: post #83

Earlier quoted context omitted.

There are many people capable of finding this specific bug and reporting it who might be motivated to take a look by a bug bounty, but who would never even consider trying to sell an exploit on the black market. I agree there is one cohort where you are trying to offer them an alternative to illegally monetizing their exploits. Then there is another cohort who you are just trying to encourage them to spend some time…

I agree with the cohort theory, but to me it's not so much about the risk of someone selling an exploit on the black market, all though it's still a risk. To me it's more about how it reflects on a company where security is key to their product. Low bounties kinda gives of a vibe of not caring about the security of their product and maintaining it. Personally I lost a lot of confidence in them when they got acquired…

Most companies, including companies far more security-sensitive than LogMeIn, pay no bug bounties at all. Meanwhile, the companies that pay the largest bounties are themselves routinely harangued online for underbidding the black market --- despite the fact that outbidding crime is in no way the purpose of a bug bounty.

From my vantage point, the logical conclusion to the comment you just wrote is that companies should avoid offering bug bounties. They just attract negative attention.

(I won't use LastPass, and have recommended 1Password --- but Tavis Ormandy is looking at 1Password right now, and I'm guessing they're going to end up disappointing HN too.)

Re: LastPass autofill exploit

#148

Post by tptacek »

estefan wrote: post #86
avlidienbrunn2 wrote: post #29

Earlier quoted context omitted.

At the time I submitted this, they didn't even have a bug bounty. Considering that, I think $1,000 is great :)

I think paying only $1000 for a potentially company-imploding bug like that is incredibly short sighted. It's far too low to motivate a lot of people to look for bugs, and to me suggests they're not serious about protecting their reputation if someone does find such a company-destroying bug.

HN has weird beliefs about the company-imploding properties of all sorts of bugs, from this to CSRFs that let you delete photos from Facebook. After all, a competitor could use it to erase all the photos on Facebook and then take over the market!

That was an actual argument on a thread about Facebook underpaying bounties.

Re: LastPass autofill exploit

#149

Post by tptacek »

zaroth wrote: post #119
onion2k wrote: post #84

Earlier quoted context omitted.

People find and disclose bugs regularly even where there isn't a bounty. Most (at least 99.99%) developers don't want to see a useful, successful product fail even if they can personally gain from it. The likelihood that an exploit for Lastpass will be discovered by an attacker and sold to a nefarious actor is very small. Further to that though, we now know that this problem is fixed in LastPass. We don't know about…

I have become a bit of a skeptic -- we know that a problem like this existed in the code-base and is now fixed. So, should we then conclude that LastPass is now "more secure" because of it, or is the existence of this face-palm bug in production code actually evidence that LassPass is "less secure"? Certainly I would not go so far as to claim that this bugfix somehow makes LassPass a better option than its rivals. I…

It depends on the nature of the bug, right? In this case, the bug would make me much less likely to ever recommend LastPass.

Re: LastPass autofill exploit

#150

Post by Quiark »

theandrewbailey wrote: post #132
toxican wrote: post #91

Earlier quoted context omitted.

Why not? I've been using it for about a year now (switched from LastPass) and haven't had any issues. Kind of miss the in-browser features of LastPass, but seeing as how those are what's being exploited, maybe not so much!

There are browser extensions that work with KeePass. This LastPass vulnerability makes me wonder, too. I wish the KeePass site would be 100% HTTPS, though, but the maintainer is a jerk in that regard.

Be careful about browser integration https://github.com/pfn/keepasshttp/issues/258
Post reply on HN