Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden Heist – How to break into password vaults without using passwords

blog.redteam-pentesting.de

Post reply on HN
Print view View original

171–180 of 209 posts

Re: Bitwarden Heist – How to break into password vaults without using passwords

#171

Post by lxgr »

firen777 wrote: post #138
WalterBright wrote: post #42

I've always considered password vaults as a single point of failure that will compromise all of your passwords. I've had lots of intelligent, well-informed programmers argue that my concern is groundless.

The way I look at it is, password vault is a single point of failure with a very VERY tiny attack surface that attacker will need to directly target you with a sniper rifle to actually hit you (assuming you are not using things like Lastpass. I personally use Keepass and synchronize the local vault across devices using Syncthing). Suffice to say, unless your last name is Snowden, it should not be a concern to you. Co…

> Suffice to say, unless your last name is Snowden, it should not be a concern to you.

I wouldn't be so sure about that. People store banking/payment credentials in them, so there is a large incentive to mount a scalable attack against an even moderately popular password manager. Crypto wallets are a popular target too for the same reason (although the risk is even more immediate there).

Re: Bitwarden Heist – How to break into password vaults without using passwords

#172

Post by lxgr »

dannyw wrote: post #160
rdl wrote: post #128

The complexity of deployed identification/auth chain/secrets management/ec. is pretty terrifying; even if you can somehow understand it for one OS and hardware platform, if your service needs to support multiple OSes plus web plus multiple auth technologies plus a recovery path and everything else, dragons. This is one of the few things cryptocurrency gets right in one specific way better than most other applications…

I'm not convinced crypto is inherently less secure; I'd argue it's more secure on average. Data breaches happen every day; whether in financial services or not. The difference is that a breach is catastrophic for crypto; but just bad for most businesses.

Have any of these catastrophic failures happened due to client/wallet-side user confusion, though?

I'm not a big fan of many things in crypto, but what I've seen in terms of "what you see is what you sign", clear user interfaces, secure user verification and confirmation etc. in some popular wallets is something that many existing banks could take a lesson from.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#173

Post by lxgr »

baldfat wrote: post #51
mrguyorama wrote: post #43

Earlier quoted context omitted.

>python script on GitHub that allows to decrypt passwords the browser stores locally in their %Appdata% directory. Yes, otherwise known as "if you run code on your computer, it can run code on your computer". If a random python program can "decrypt" the passwords, that's not encryption. And browser password management isn't about security, but convenience.

I tell myself and other people if you have it saved in your browser are you okay if bad people know that password. Also it makes it easy for people in authority to get to that password with a simple court order.

Passwords saved in browsers for most users only protect access to accounts that are also accessible with a simple court order, though.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#174

Post by vladvasiliu »

EvanAnderson wrote: post #70
zelon88 wrote: post #49

Earlier quoted context omitted.

"AppData" is where user specific application data is supposed to be stored. "The Registry" is where application configuration is supposed to be stored. "ProgramData" is where application specific data is supposed to be stored. "Program Files" is where read-only application binaries and code is supposed to be stored. It really is a simple concept from a Windows perspective. What ruins everything is overzealous and/or…

As a Windows sysadmin AppData has been an unmitigated shit show forever. Developers (including those inside Microsoft) don't give a damn about how Microsoft intends anything to work, and AppData has become a dumping ground of software installs to end-run IT departments. A lot of malware dumps into there but good luck limiting execution from that directory hierarchy because all your business-critical end user communic…

> was completely ruined by devs dumping piles of small files into "AppData\Roaming" (and completely not understanding that "AppData\Local" even exists, let alone what it's for

As someone who only occasionally uses Windows, I think `%AppData%` sending you to `~\AppData\Roaming` doesn't help.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#175

Post by sumedh »

malfist wrote: post #28
RedTeamPT wrote: post #23

Earlier quoted context omitted.

Yes, it requires an attacker in a powerful position with local access. However, it does not require special privileges or techniques that may trigger endpoint security (such as keyloggers or memory dumping). The only requirements are reading a JSON file and making a single Windows API call to retrieve the key.

Do hardware keyloggers trigger endpoint security?

I asked ChatGpt "where can I buy hardware keyloggers"

It just shut me down "I can't assist with that request."

Re: Bitwarden Heist – How to break into password vaults without using passwords

#176

Post by viraptor »

garaetjjte wrote: post #152
raggi wrote: post #140

Earlier quoted context omitted.

There are real integration challenges with the "simple file approach": - File locking and concurrency - Atomic writes / moves - Realtime change observations > clumsy use of regedit does have a chance of totally borking the entire system. So does a clumsy rm -rf, which shows up in stories here far more often than stories of people breaking their registry. Can you provide a recent reference to someone bricking their sy…

Then use SQLite.

That solves 1 out of the 3 issues... But at that point, why bother? The registry is a database already.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#177

Post by viraptor »

shortsunblack wrote: post #100
walki wrote: post #35

Microsoft's %Appdata% directory is a security nightmare in my opinion. Ideally applications should only have access to their own directories in %Appdata% by default. I recently came across a python script on GitHub that allows to decrypt passwords the browser stores locally in their %Appdata% directory. Many attacks could be prevented if access to %Appdata% was more restricted. I also found a post of an admin a few d…

Microsoft is trying to do that with msix and a new filesystem driver that transparently restricts file system access to app. Should land into Windows 11 this year. See https://youtu.be/8T6ClX-y2AE for the functionality explaination.

The msix story is really weird/incomplete so far. Let me just leave it at: creating services is part of msix on windows 11, but not windows server. Maybe it will be more then a toy in a few years, but we'll still have to wait for old server versions to get replaced.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#178

Post by viraptor »

o11c wrote: post #156
Pesthuf wrote: post #150

Earlier quoted context omitted.

Is there even a way to opt in to having a secret be accessible only for your process? Like, a way to maybe sign your executable and then use a windows api that then gets "oh. This process is made by the same vendor that created this secret, so it’ll be allowed access". It’s just ridiculous that the most trivial, unprivileged process can just steal any file and any secret accessible by the user it’s run as. Unless tha…

I don't think it's possible on Windows. It's trivial on Unix - just make the program setgid and change the folder permissions to only allow the group. This can be nested, though that requires that the relevant program be aware of the need to walk through several levels, though often a symlink can hide that. Note that when creating such a directory setup, `chown`ing away the user requires a privileged helper utility.…

Or use selinux/apparmor - those have supported app sandboxing without group tricks for a long time.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#179

Post by SSLy »

oneshtein wrote: post #161
SSLy wrote: post #135

Earlier quoted context omitted.

And converse, on Linux it's so hard to get every shitty tool to put files in XDG dirs, not spew them all over ~.

A maintainer can patch the package to store it configuration files into a XDG directory, then upstream the patch. If none of maintainers did this, then problem is deeper.

https://wiki.archlinux.org/title/XDG_Base_Directory#Hardcode... upstreams quite too often reject patches or let them languish

Re: Bitwarden Heist – How to break into password vaults without using passwords

#180

Post by Khaine »

thereddaikon wrote: post #105
zelon88 wrote: post #49

Earlier quoted context omitted.

"AppData" is where user specific application data is supposed to be stored. "The Registry" is where application configuration is supposed to be stored. "ProgramData" is where application specific data is supposed to be stored. "Program Files" is where read-only application binaries and code is supposed to be stored. It really is a simple concept from a Windows perspective. What ruins everything is overzealous and/or…

Microsoft themselves don't understand that. Teams installs itself to appdata in its entirety. One full install of teams for each user profile. Keeping it updated across one machine is impossible. How can we expect anyone else to do it right when Microsoft allows its own employees to abuse it?

I just hope they kill teams with fire. It is hot garbage.
Post reply on HN