Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden Heist – How to break into password vaults without using passwords

blog.redteam-pentesting.de

Post reply on HN
Print view View original

181–190 of 209 posts

Re: Bitwarden Heist – How to break into password vaults without using passwords

#181

Post by iudqnolq »

giancarlostoro wrote: post #44
walki wrote: post #35

Microsoft's %Appdata% directory is a security nightmare in my opinion. Ideally applications should only have access to their own directories in %Appdata% by default. I recently came across a python script on GitHub that allows to decrypt passwords the browser stores locally in their %Appdata% directory. Many attacks could be prevented if access to %Appdata% was more restricted. I also found a post of an admin a few d…

> The response was that if access to %Appdata% is completely blocked Windows won't work anymore. Yikes. I really wish that instead of Microsoft wasting resources on telemetry nonsense, they would focus on optimizing their OS and modernizing some of these blatant security issues. I guess it wont happen until we have another wave of ransomware malware or something of the sort.

That's like saying Linux doesn't have sandboxed apps because chmod -R 000 /var will break your system. Technically sort of right, but not a useful or interesting observation.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#182

Post by lysp »

hinkley wrote: post #80
zelon88 wrote: post #49

Earlier quoted context omitted.

"AppData" is where user specific application data is supposed to be stored. "The Registry" is where application configuration is supposed to be stored. "ProgramData" is where application specific data is supposed to be stored. "Program Files" is where read-only application binaries and code is supposed to be stored. It really is a simple concept from a Windows perspective. What ruins everything is overzealous and/or…

> "AppData" is where user specific application data is supposed to be stored. > "ProgramData" is where application specific data is supposed to be stored. Simple maybe. Coherent, no.

It was confusing for me too.

Basically:

- AppData = User (interactive) application storage - ProgramData = Service / Background (non-interactive) application storage

Re: Bitwarden Heist – How to break into password vaults without using passwords

#183

Post by _moof »

WalterBright wrote: post #42

I've always considered password vaults as a single point of failure that will compromise all of your passwords. I've had lots of intelligent, well-informed programmers argue that my concern is groundless.

Before password managers people used the same password on every site. Vaults being a SPOF is true but not really relevant. They're still an improvement over what people did before.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#184

Post by gruez »

lxgr wrote: post #171
firen777 wrote: post #138

Earlier quoted context omitted.

The way I look at it is, password vault is a single point of failure with a very VERY tiny attack surface that attacker will need to directly target you with a sniper rifle to actually hit you (assuming you are not using things like Lastpass. I personally use Keepass and synchronize the local vault across devices using Syncthing). Suffice to say, unless your last name is Snowden, it should not be a concern to you. Co…

> Suffice to say, unless your last name is Snowden, it should not be a concern to you. I wouldn't be so sure about that. People store banking/payment credentials in them, so there is a large incentive to mount a scalable attack against an even moderately popular password manager. Crypto wallets are a popular target too for the same reason (although the risk is even more immediate there).

How are you going to "mount a scalable attack" against a local-only password manager?

Re: Bitwarden Heist – How to break into password vaults without using passwords

#185

Post by gruez »

charcircuit wrote: post #38
jabroni_salad wrote: post #25

Earlier quoted context omitted.

Yes. If you have LLMNR, NTLM enabled, unsigned SMB allowed, and nonencrypted LDAP bindings then your domain controller can be popped with zero effort by metasploit. Legacy protocols can be very sticky and most repeat pentest engagements I am able to use the same exact method every time because they will never get addressed. Modern windows (since like vista-era) will use better stuff out of the box but will also allow…

Why hasn't Microsoft at least sandboxed these protocols if they are so bad in regards to security?

It's not broken in terms of the implementation (eg. buffer overflows). The protocol itself is fundamentally broken. Sandboxing http isn't going to protect your credit card information, and sandboxing md5 isn't going to prevent people from finding collisions.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#186

Post by thereddaikon »

whoisthemachine wrote: post #111
thereddaikon wrote: post #106

Earlier quoted context omitted.

That makes managing a user's application specific data difficult though. For one you have different user's data intermingling which potentially causes new problems. But on top of that you make managing and backing up that data more difficult. As it works now with appdata you can back up a user's profile folder under C:\users and get everything they have assuming they haven't gone out of their way to save data to a st…

Ideally a new instance of the application is installed for each user. This also provides better isolation if one user upgrades/removes/breaks their application instance. I, for one, have really come around to the AppImage model [0] in the last couple of years. [0] https://appimage.org/

I don't like the solution being to just make containers out of everything. That introduces its own problems and lets developers be lazy in other ways.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#187

Post by thereddaikon »

pbhjpbhj wrote: post #132
thereddaikon wrote: post #106

Earlier quoted context omitted.

That makes managing a user's application specific data difficult though. For one you have different user's data intermingling which potentially causes new problems. But on top of that you make managing and backing up that data more difficult. As it works now with appdata you can back up a user's profile folder under C:\users and get everything they have assuming they haven't gone out of their way to save data to a st…

I guess the OS keeping track of .../programs/NameOfProgram/user settings/NameOfUser is just impossible? Or having an app install create a link in /users/NameOfUser/program-config/NameOfProgram to the config folder is equally impossible magic ...?

That's asking a lot of windows. But as a former sys admin, that sounds like it would make things harder to manage. So its linked. But its not really there. So existing userdata backup automation wouldn't catch it. Sorry your Outlook psts are gone. User data should live with users. The problem isn't with that paradigm. Its that its abused and wide open.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#188

Post by thereddaikon »

JackeJR wrote: post #144
thereddaikon wrote: post #105

Earlier quoted context omitted.

Microsoft themselves don't understand that. Teams installs itself to appdata in its entirety. One full install of teams for each user profile. Keeping it updated across one machine is impossible. How can we expect anyone else to do it right when Microsoft allows its own employees to abuse it?

Teams was kept in appdata like Chrome so that these programs can update themselves without admin privileges and I suppose that is how they keep users on a recent version.

Except it completely backfires when you have a workstation with multiple users who infrequently use it. Existing patching solutions, like microsoft's own system center have a hard time coping with applications that live in app data. So you end up with 8 instances of teams on a system. 6 of which are months out of date.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#189

Post by Aerroon »

johnny22 wrote: post #123
Aerroon wrote: post #99

Earlier quoted context omitted.

But why split up the application like that? Why not have a folder for each application that just contains everything? Everything being in one place by default also means that a user can just copy the entire application folder as a backup.

Because it'd be really nice to have a place with just application data to backup. no configs, no application state. Or alternatively it's nice to have a place to just factory reset all your app config, but keep all the data.

But would you trust that you would actually get all the app's configs? Ie window position and all that.

And would you trust that you would only affect that one application and not any others?

And wouldn't you just unusual and reinstall the application anyway?

Re: Bitwarden Heist – How to break into password vaults without using passwords

#190

Post by ametrau »

sumedh wrote: post #175
malfist wrote: post #28

Earlier quoted context omitted.

Do hardware keyloggers trigger endpoint security?

I asked ChatGpt "where can I buy hardware keyloggers" It just shut me down "I can't assist with that request."

This company makes nice ones:

https://shop.hak5.org/blogs/payloads/duckylogger

Post reply on HN