Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden Heist – How to break into password vaults without using passwords

blog.redteam-pentesting.de

Post reply on HN
Print view View original

161–170 of 209 posts

Re: Bitwarden Heist – How to break into password vaults without using passwords

#161

Post by oneshtein »

SSLy wrote: post #135
EvanAnderson wrote: post #70

Earlier quoted context omitted.

As a Windows sysadmin AppData has been an unmitigated shit show forever. Developers (including those inside Microsoft) don't give a damn about how Microsoft intends anything to work, and AppData has become a dumping ground of software installs to end-run IT departments. A lot of malware dumps into there but good luck limiting execution from that directory hierarchy because all your business-critical end user communic…

And converse, on Linux it's so hard to get every shitty tool to put files in XDG dirs, not spew them all over ~.

A maintainer can patch the package to store it configuration files into a XDG directory, then upstream the patch. If none of maintainers did this, then problem is deeper.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#162

Post by Robin_Message »

malfist wrote: post #41
RedTeamPT wrote: post #29

Earlier quoted context omitted.

No, but hardware keylogger require physical access.

What is the difference between "physical access" and "powerful position with local access"

It's the difference between the evil maid attack (someone sneaks a keylogger into your turned-off machine whilst cleaning your room) vs local privilege escalation (the sysadmin installs a game and now your entire network is owned).

Re: Bitwarden Heist – How to break into password vaults without using passwords

#163

Post by lxgr »

pixl97 wrote: post #137
cameronh90 wrote: post #91

Earlier quoted context omitted.

The point is that, nowadays, apps should by default be isolated from each other, rather than AppData and HKCU being a free-for-all. Windows makes it hard to whitelist known-safe apps (there’s WDAC but it’s poorly documented and a PITA) and every program you run has access to everything of importance on your system. Imagine how upset people would be if it turned out TikTok on your phone can access your entire iCloud D…

We accept it on the desktop because the desktop app model is from before the internet. There was only 'trusted' applications that had access to all the users data (and really most of the time the entire machine), and really there wasn't even the idea of an internet connection being built in at all. In addition desktop applications are based around the ability to read the users data files. Desktop users typically want…

There’s a difference between reading user data (i.e. “My Documents”) and reading other apps’ application data (e.g. Firefox’s cookie jar).

macOS has started disallowing the latter (i.e. restricting access to other sandboxed apps’ files from both sandboxed and unsandboxed apps) more than a decade after the OS was introduced, yet I don’t feel like my productivity has been ruined.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#164

Post by lxgr »

zelon88 wrote: post #96
bhdlr wrote: post #77

Earlier quoted context omitted.

Can't blame the programmer for that - Windows shouldn't allow the programmer to do stupid shit

See, I disagree with that. The computer is an arbitrary command execution machine. It does what you tell it to do. Don't tell the computer to do stupid shit and it won't. There are plenty of valid use cases where you want to use the capability of the computer without some arbitrary OS policy preventing you from doing it "because some programmers are irresponsible."

In a world of various medium-trusted apps that I don’t love but still have to use to get my job (or a bank transfer etc. done), that model doesn’t really work for me anymore.

Users aren’t “telling the computer what to do” anymore for the most part, third party app developers are; this puts a lot of responsibility on the OS for protecting the interests of its user against that of a malicious or careless app developer.

Of course I want to be able to fine-tune that protection, but restrictive defaults make sense.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#165

Post by lxgr »

guerby wrote: post #10

I wonder if biometric bitwarden unlock on Android has the same kind of issue or not.

Probably not, given that Android's security model sandboxes apps and accordingly can identify which one is trying to access a given keychain credential.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#166

Post by lxgr »

RedTeamPT wrote: post #24
harrygeez wrote: post #22

Earlier quoted context omitted.

There are a few convenient scapegoats here but ultimately in this case it is not biometric unlock that enabled this but rather characteristic of the Active Directory's design (I'm not sure I will call it a weakness). For Android and iOS if you forget your PIN code I believe you are screwed, as in no one can decrypt your device for you.

Actually it is not just an issue with AD design, but the AD design only makes it slightly worse. The underlying issue is that biometrics are not required to retrieve the biometric key from DPAPI and instead of authenticating with Windows Hello, any program could just simply ask DPAPI for the key.

Have you looked into how (whether?) Windows Hello actually checks which app is asking it to perform a private key operation?

On Android, this is tied to the app UID, and on iOS/macOS it's tied (I believe) to the developer team identifier. Hopefully there's a similar mechanism on Windows...?

Re: Bitwarden Heist – How to break into password vaults without using passwords

#167

Post by lxgr »

sjfjsjdjwvwvc wrote: post #112
bhdlr wrote: post #76

Earlier quoted context omitted.

So - the moral of the story is to never use Windows?

Or don’t use their „security“ features. AFAICT everything would have been fine if they used a hardware key as second factor.

How do you know which app is accessing your hardware key in the absence of any OS feature mediating access to it?

Re: Bitwarden Heist – How to break into password vaults without using passwords

#168

Post by southernplaces7 »

southernplaces7 wrote: post #143

I've always thought the trust placed in password managers was deeply misplaced. Like any company, it's only a question of time and circumstance until one of them is massively breached, but right here on HN, a whole bunch of people who should know better recommending them as if they were flowers from heaven. Because of course hey, "it's just convenient".

And why would this be downvoted? Is there some specific holy aspect to password management services that makes them immune to being the victims of the same massive data leaks that frequently affect a whole broad range of tech companies?

Re: Bitwarden Heist – How to break into password vaults without using passwords

#169

Post by lxgr »

mrguyorama wrote: post #65
AlienRobot wrote: post #58

Earlier quoted context omitted.

>if you run code on your computer, it can run code on your computer For the love of God will someone please just make a web browser that isn't a web browser and it's just a cross platform multimedia sandbox with a couple of APIs in it, and you can run programs written in rust or something on it, and it doesn't let the programs touch your file system unless it has explicit permission? That would solve 99% of the appli…

It's called iOS. Browsers are also NOT safe. You know what was safe? Not letting random endpoints ship you code to run. HTML was safe, though implementations at the time likely had security flaws. You cannot make a turing complete language that JIT compiles into machine code and verify it as "safe". Machine code is not safe, so anything that lets you generate arbitrary machine code cannot be proven to be safe. If you…

You're skipping over a lot of pragmatic middle ground between "full hardware access" and "verifiably safe" (i.e. formally proven?) here.

An absence of turing completeness and JIT compilation is neither necessary (see sandboxing) nor sufficient (see variousexploits against media codecs, PDF parsers etc.) to ensure safe processing of untrusted data, whether that data happens to be "actual data" or code.

You can make your own life easier or harder with your choice of sandboxing target, though: x86 Win32 binaries are probably harder to do sandbox in a working and secure way than e.g. WASM/WASI.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#170

Post by lxgr »

WalterBright wrote: post #42

I've always considered password vaults as a single point of failure that will compromise all of your passwords. I've had lots of intelligent, well-informed programmers argue that my concern is groundless.

I don't think anybody is arguing that password managers are the be-all and end-all of secure user authentication.

But what would you use instead for services that support only password authentication? And even for services with 2FA: If one of the factors is a password, where do you store it?

Post reply on HN