Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass autofill exploit

labs.detectify.com

Post reply on HN
Print view View original

161–170 of 443 posts

Re: LastPass autofill exploit

#161

Post by tptacek »

K0nserv wrote: post #158
tptacek wrote: post #147

Earlier quoted context omitted.

Most companies, including companies far more security-sensitive than LogMeIn, pay no bug bounties at all. Meanwhile, the companies that pay the largest bounties are themselves routinely harangued online for underbidding the black market --- despite the fact that outbidding crime is in no way the purpose of a bug bounty. From my vantage point, the logical conclusion to the comment you just wrote is that companies shou…

It's true that not all companies pay bug bounties and you might very well be right that paying them, especially if they are much lower than other companies that operate bug bounties, might have a worse affect on public opinion then not having bug bounties at all. To me it's still concerning that Facebook pays 10x more for problems that are less severe and it does still make LastPass look like they don't care as much…

If this was a thread about a Facebook vulnerability, the exact same things would be said about Facebook. To verify for yourself, use the search box at the bottom of the page to find a thread about a Facebook bounty.

Re: LastPass autofill exploit

#162

Post by tombert »

I never fully trusted any centralized password managers. Since I'm a paranoid goober, I've ended up dumping LastPass and using the Unix "pass" tool.

Anyway, I'm glad that LastPass has resolved this; last thing I want in the news is another big password breach.

Re: LastPass autofill exploit

#163

Post by tptacek »

PeterisP wrote: post #160
tptacek wrote: post #139

Earlier quoted context omitted.

This is a non-sequitur response to my comment, whose whole purpose is to point out that a bug bounty is not a bid in an auction against organized crime.

In practice, in many cases, bug bounties are de facto a bid in an auction against organized crime. It doesn't need to be 1-to-1 equivalent bid, and it's not for all sources of found bugs, but the intent and the effect is definitely there.

No, they are virtually never a bid against organized crime.

There are two kinds of vulnerabilities in the world:

The kind organized criminals will pay tens of thousands of dollars for, and the kind they, like any Internet rando, will pay $50 for lulz.

If you think this dumb regex bug is worth the same to organized criminals as a Chrome sandbox escape or drive-by reliable Flash RCE... well, people think that about a lot of bugs, I guess.

This LastPass bug is terrible. I was already inclined to warn friends against using it (but my other friends have beat me to that punch many times before). The bug looks terrible for LastPass and its mere existence is damaging to that project.

But that doesn't mean the bug has significant monetary value. As someone else here cleverly put it on the last dumb bug bounty thread: you can smash a car with a sledgehammer, but that doesn't make the sledgehammer worth the value of the car.

Re: LastPass autofill exploit

#164

Post by rando444 »

thrwawayask wrote: post #128
mcs wrote: post #12

Please correct me if I am mistaken, but couldn't this have been implemented into an iframe that when ran could send the passwords to another remote server? If so, I am a little taken back by LastPass only offering $1,000 to the researcher that found and reported it for fixing. He or she could have taken a different path and resulted in this being used in some complex targeted attack against tech corporations via shor…

Hi, newbie sec researcher here. Just wanna ask, how do we actually ask for a bounty considering that sometimes the severity of the breach is BIG (this, Shell Access, etc). I really don't wanna ask the companies for money but it just seem so... underwhelming for me. (3 out of 3 rather big companies just gave some thanks)

No matter what it is, you don't just give someone something they didn't ask for, and then expect money in return.

It would be like someone walking up to you on the street, handing you something they think is valuable, and then hoping that you'll want it and pay them for it.

The first thing you should do is check and see if they have an official bug bounty, if they don't then contact them and ask them if they had one.. say something like "because you saw some things on their site that concerned you, but wanted to know if it was worth the time exploring further" .. this is assuming you already found something. The goal of this is to get them to try and offer a bounty.

If they don't offer a bounty, then if you want to be responsible, you can just disclose their vulnerabilities to them, and accept whatever thanks you get.

If you're explicitly doing what you're doing to try and get some money out of it, then your time would be better spent focusing on companies that have well published bug bounties.

Re: LastPass autofill exploit

#165

Post by mohsinr »

LastPass user here, thanks for getting this fixed. For any other bug/attack like this in future, I suggest we uncheck this option: "Automatically Fill Login Information" in preferences tab. Will this would have helped in case of this attack? Or information still would have been leaked?

Re: LastPass autofill exploit

#166

Post by Dwolb »

mcs wrote: post #12

Please correct me if I am mistaken, but couldn't this have been implemented into an iframe that when ran could send the passwords to another remote server? If so, I am a little taken back by LastPass only offering $1,000 to the researcher that found and reported it for fixing. He or she could have taken a different path and resulted in this being used in some complex targeted attack against tech corporations via shor…

Something to consider is a mis-alignment of incentives.

When LastPass gets breached, they're not directly responsible for what an attacker does with the passwords.

When another site/service gets breached, they have to spend a lot of time making it right to the customer again (e.g. rolling back transactions, compensating for lost or stolen funds, etc.)

Re: LastPass autofill exploit

#167

Post by embik »

tptacek wrote: post #155
embik wrote: post #152

Earlier quoted context omitted.

To be fair, this bug is pretty nasty because it allows anyone to get all your stored passwords. That's like the core business of LastPass. LastPass leaking your login credentials for e.g. online banking is really not comparable to deleting Facebook photos.

How does paying extra money address the underlying concern that LastPass has absolutely trivial regex bugs that entirely defeat the security of the product? I agree that the bug is terrible, but the bounty and the impact of the bug to the company are largely orthogonal, unless the bounty includes a confidentiality term.

I guess the point people (including me) are making is that it should pay off to do the right thing and report a bug that is capable of killing your (core) business. While OP obviously is a honourable person, others might not be and are more interested in getting money than doing the right thing.

Of course it's illegal/wrong to sell an exploit to third parties, but that doesn't stop people from doing illegal things as long as they get money for it. You just don't know about the issues that are sold because that's obviously not going public.

Re: LastPass autofill exploit

#168

Post by [deleted] »

kmiroslav wrote: post #112
rietta wrote: post #102

Earlier quoted context omitted.

A bug that tricks the secure password management tool into revealing your Twitter password to a website that is not Twitter! That's a pretty major security vulnerability due to a bug in URL parsing.

But the information is not sent to the server, it's simply pasted in the text field.

[deleted]

Re: LastPass autofill exploit

#169

Post by ronnier »

tombert wrote: post #162

I never fully trusted any centralized password managers. Since I'm a paranoid goober, I've ended up dumping LastPass and using the Unix "pass" tool. Anyway, I'm glad that LastPass has resolved this; last thing I want in the news is another big password breach.

I do the same. I wrote up a wiki on how I use it:

http://ronnie.me/store-encrypted-passwords-in-an-encrypted-f...

The issue I had with 'pass' was that it leaked info via the file names, but I found a nice way around that.

Re: LastPass autofill exploit

#170

Post by starquake »

icebraining wrote: post #111
starquake wrote: post #20

Earlier quoted context omitted.

I do not use LastPass exactly because of what you describe. I use a KeePass Password safe without autofill. I use other software to sync the file. It used to be Dropbox, later I was using BitTorrent Sync, but what tool sync shouldn't really matter. As I see it: the tool only gets to see and sync an encrypted file. You could even use a USB stick and not sync at all. Or only sync on LANs. I love it how I get to decide…

Lastpass also only syncs data after it's encrypted locally, so the threat model is the same.

You're right about that. The threat model is equal when using Dropbox. It's still different when you use a local LAN share or a USB stick though.
Post reply on HN