LastPass autofill exploit

Post by giuscri » Wed, Jul 27, 2016, 2:02 PM UTC

edent wrote: post #110

giuscri wrote: post #78

Could someone explain me better the posted code that was vulnerable? I don't understand it. What's the returned value?, what is URL and url?, why the extension is expecting there must be a @ inside the url? Thanks! :-)

Very simply, I have a password stored for "login.example.com". LastPass knows that companies like to change URLs - so next week it might be "userlogin.example.com" or "secure.example.com/login" or "www2.uk.vpn1.example.com" etc. Essentially, LastPass made the mistake of writing code which said "If you see `example.com` anywhere in the URL - assume that you're on the right site. LastPass will allow you to automaticall…

Post by spion » Wed, Jul 27, 2016, 2:04 PM UTC

ktta wrote: post #13

I've been using LastPass for about 3 years, and now I'm seriously thinking about all the times people told me about how storing passwords in someone else's cloud is bad. I've been defending LastPass and recommending it to everyone till today. Now I'm thinking about how I might have to 'pay' for a software vulnerability in some private (read:unauditable by me) code. All the comments about offline, local backups make s…

Post by ebbv » Wed, Jul 27, 2016, 2:07 PM UTC

jerf wrote: post #157

zaroth wrote: post #69

Earlier quoted context omitted.

Normally I like bike shedding about bug bounty payouts just about as much as complaints about paywalls. If you are going to go poking around someone's code for fun or profit, the terms of the bounty program are readily available [1] so you can't complain after the fact for earning the maximum payout. LastPass isn't Facebook, and they never claimed they would pay more than $1,000 even for a full compromise or RCE. On…

"On the other hand, using regexp to parse the URL when it's such an obviously security critical code path... just, why?!" Why not? URIs are at least able to be tokenized perfectly well by a regular expression. You have to do it right, but there's little guarantee that your non-regexp code will do it right either. I glanced at that regexp and immediately recognized several potential problems with it... will I be able…

Post by estefan » Wed, Jul 27, 2016, 2:07 PM UTC

tptacek wrote: post #175

embik wrote: post #167

Earlier quoted context omitted.

I guess the point people (including me) are making is that it should pay off to do the right thing and report a bug that is capable of killing your (core) business. While OP obviously is a honourable person, others might not be and are more interested in getting money than doing the right thing. Of course it's illegal/wrong to sell an exploit to third parties, but that doesn't stop people from doing illegal things as…

This doesn't make any sense logically. We don't need to pay people to prevent them from committing felonies. The suggestion that we do is actually pretty offensive to people who find vulnerabilities. Most of us --- in fact, the overwhelming majority of us --- are not torn at all about whether we should sell flaws to the black market. (This is of course orthogonal to the fact that the black market does not want these…

Post by tedmiston » Wed, Jul 27, 2016, 2:11 PM UTC

jxpx777 wrote: post #141

cyberpanther wrote: post #114

Great catch and everyone should know there is an easy way to parse URLs in JS. Just create an anchor element and let the browser parse it for you. Like so: var parser = document.createElement('a'); parser.href = " http://example.com:3000/pathname/?search=test#hash "; parser.protocol; // => "http:" parser.hostname; // => "example.com" parser.port; // => "3000" parser.pathname; // => "/pathname/" parser.search; // => "…

Disclosure: I work for AgileBits, makers of 1Password. For browser extensions, the URL constructor would be even easier: https://developer.mozilla.org/en-US/docs/Web/API/URL/URL (Yes, I know it says that IE doesn't support it, but IE doesn't have a proper extensions framework, so it's irrelevant to this topic.)