Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass autofill exploit

labs.detectify.com

Post reply on HN
Print view View original

171–180 of 443 posts

Re: LastPass autofill exploit

#171

Post by skrebbel »

icebraining wrote: post #111
starquake wrote: post #20

Earlier quoted context omitted.

I do not use LastPass exactly because of what you describe. I use a KeePass Password safe without autofill. I use other software to sync the file. It used to be Dropbox, later I was using BitTorrent Sync, but what tool sync shouldn't really matter. As I see it: the tool only gets to see and sync an encrypted file. You could even use a USB stick and not sync at all. Or only sync on LANs. I love it how I get to decide…

Lastpass also only syncs data after it's encrypted locally, so the threat model is the same.

Not entirely, since you download the encryption code way more often (for example, when you open the "Lastpass Vault", which is just a website like any other). Parts of Lastpass are simply a website, not part of the browser extension, and as an avid Lastpass user in all honesty I don't know which parts.

This matters because even if it's client-side encryption, the encryption code just got downloaded when you opened the site so if the server or the network was compromised, you got compromised. [0]

With Keepass, the only time you run that risk is when you download Keepass.

[0] As far as I can tell, this is the core argument of tptacek's "javascript crypto considered harmful" rant (https://www.nccgroup.trust/us/about-us/newsroom-and-events/b...). I'm not sure, because it's written worse than his most drunken HN comment, but I believe it is.

Re: LastPass autofill exploit

#172

Post by nilved »

veeti wrote: post #138
Alpacalex wrote: post #75

Earlier quoted context omitted.

If you're using a *nix system: https://www.passwordstore.org/ I switched over from LastPass a few months ago. It uses gpg for encryption and supports git for password syncing between systems. Pretty simple to set up and use. There are quite a few third party apps for it already (both desktop and mobile)

Does this still have the problem of leaking metadata (site names, etc.) in plain text? I don't want to manually obfuscate them.

If you don't like manually obfuscating things, just keep your passwords in a txt file.

Re: LastPass autofill exploit

#173

Post by baby »

Does someone understand the snippet?

  var fixedURL = URL.match(/^(.*:\/\/[^\/]+\/.*)@/);

  fixedURL && (url = url.substring(0, fixedURL[1].length) + url.substring(fixedURL[1].length).replace(/@/g, "%40"));
It looks like:

* fidexURL is whatever is after :// and up until the very last @ (greediness)

* the second line fixedURL && is going to complete if fixedURL is not undefined

* url = this fixedURL, then the rest of it where @ was replaced by %40

so basically, entering http://avlidienbrunn.se/@twitter.com/@hehe.php will give

url = avlidienbrunn.se/@twitter.com/%40hehe.php

if I understand correctly. What happens after?

EDIT: it must be that the last [^/.]* before @ is taken as the domain name. But why splitting the URL before a @ sign? I'm confused

Re: LastPass autofill exploit

#175

Post by tptacek »

embik wrote: post #167
tptacek wrote: post #155

Earlier quoted context omitted.

How does paying extra money address the underlying concern that LastPass has absolutely trivial regex bugs that entirely defeat the security of the product? I agree that the bug is terrible, but the bounty and the impact of the bug to the company are largely orthogonal, unless the bounty includes a confidentiality term.

I guess the point people (including me) are making is that it should pay off to do the right thing and report a bug that is capable of killing your (core) business. While OP obviously is a honourable person, others might not be and are more interested in getting money than doing the right thing. Of course it's illegal/wrong to sell an exploit to third parties, but that doesn't stop people from doing illegal things as…

This doesn't make any sense logically. We don't need to pay people to prevent them from committing felonies. The suggestion that we do is actually pretty offensive to people who find vulnerabilities. Most of us --- in fact, the overwhelming majority of us --- are not torn at all about whether we should sell flaws to the black market.

(This is of course orthogonal to the fact that the black market does not want these vulnerabilities.)

Re: LastPass autofill exploit

#176

Post by dpark »

techdragon wrote: post #41
avolcano wrote: post #5

I'm generally very sympathetic to regex bugs (especially in a language like JavaScript where you don't get nice expanded multiline regexes with comments), but I am wondering why they went with a regex in the first place. Did they decide `document.location.host` was too brittle for some reason?

I'd agree if there wasn't an extremely good solution to this problem. Verbal Expressions - It's an extremely good higher level interface to the underlying regular expressions tools, in MANY languages. Including: JavaScript - https://github.com/VerbalExpressions/JSVerbalExpressions ActionScript 3 - https://github.com/VerbalExpressions/AS3VerbalExpressions Clojure - https://github.com/VerbalExpressions/ClojureVerbalExp…

I don't see how this would have prevented this problem. The issue was not that regular expressions were "too hard" for the lastpass team, but that URLs are hard to parse correctly. To put it another way, if you don't know how to parse a URL correctly, you'll probably write an incorrect parser no matter what parsing tool you use. That's why you generally shouldn't write parsers for URLs.

Re: LastPass autofill exploit

#177

Post by lkbm »

tptacek wrote: post #156
K0nserv wrote: post #154

Earlier quoted context omitted.

I think it's a bit of bucket A and bit of bucket B. Still even if one accept the definition you put forth the argument that having such low bounties makes LastPass look bad/like they're not caring is still valid.

No, it is not at all "bucket A" and "bucket B", and suggesting otherwise is a grave insult to hundreds of researchers who would never dream of attempting (and, of course, inevitably failing) to "sell bugs to the black market". Finding interesting vulnerabilities in software makes you clever and talented, not sociopathic.

> and suggesting otherwise is a grave insult to hundreds of researchers who would never dream of attempting (and, of course, inevitably failing) to "sell bugs to the black market".

No, suggesting otherwise is saying that a bounty program with high enough rewards can reach both legitimate security researchers and sketchy folks. This is in no way a slight on the first group.

Re: LastPass autofill exploit

#179

Post by overcast »

jrockway wrote: post #76
mcs wrote: post #12

Please correct me if I am mistaken, but couldn't this have been implemented into an iframe that when ran could send the passwords to another remote server? If so, I am a little taken back by LastPass only offering $1,000 to the researcher that found and reported it for fixing. He or she could have taken a different path and resulted in this being used in some complex targeted attack against tech corporations via shor…

Let's do a little calculation to see if the payout is worthwhile. Using something illegally means you run the risk of going to prison. Let's say there's a 1% chance you get caught, the prison sentence is 10 years, and the evil hackers will pay you $20,000 for your bug. Let's also say that you're a mid-career software engineer in the US, and over the next 10 years you expect to make $2M (after taxes). This means your…

Now let's bring that salary estimate back down from outer space. $200,000 per year TAKE HOME, is not realistic, except for the very top percent of developers. And I'm talking the very top.

Re: LastPass autofill exploit

#180

Post by tptacek »

lkbm wrote: post #177
tptacek wrote: post #156

Earlier quoted context omitted.

No, it is not at all "bucket A" and "bucket B", and suggesting otherwise is a grave insult to hundreds of researchers who would never dream of attempting (and, of course, inevitably failing) to "sell bugs to the black market". Finding interesting vulnerabilities in software makes you clever and talented, not sociopathic.

> and suggesting otherwise is a grave insult to hundreds of researchers who would never dream of attempting (and, of course, inevitably failing) to "sell bugs to the black market". No, suggesting otherwise is saying that a bounty program with high enough rewards can reach both legitimate security researchers and sketchy folks. This is in no way a slight on the first group.

So the people on this thread saying that this particular researcher didn't get paid enough to "do the right thing" just mean that this person seems a little sketchy?
Post reply on HN