Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden Heist – How to break into password vaults without using passwords

blog.redteam-pentesting.de

Post reply on HN
Print view View original

21–30 of 209 posts

Re: Bitwarden Heist – How to break into password vaults without using passwords

#21

Post by Zetobal »

elzbardico wrote: post #8
Dalewyn wrote: post #5

Earlier quoted context omitted.

>the attack already assumes access to the workstation of the victim I seldom can take "vulnerabilities" that require physical access seriously, because if a hostile is physically next to my computer I have more pressing concerns than some passwords.

The problem is that an unsophisticated user doesn't necessarily think like that, and could come to the conclusion that it is not a big deal to leave his workstation unlocked while going to fetch a coffee, after all, well... "I have a password manager, and to have access to it, it requires unlocking". Then some colleague calls them for an ongoing meeting so they can share some insight about some question that was rais…

If you have machines that have users logged in, are unlocked when none of your users are working on them and that are in reach of a 3rd party you have bigger problems than this.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#22

Post by harrygeez »

guerby wrote: post #10

I wonder if biometric bitwarden unlock on Android has the same kind of issue or not.

There are a few convenient scapegoats here but ultimately in this case it is not biometric unlock that enabled this but rather characteristic of the Active Directory's design (I'm not sure I will call it a weakness).

For Android and iOS if you forget your PIN code I believe you are screwed, as in no one can decrypt your device for you.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#23

Post by RedTeamPT »

hypeatei wrote: post #6

I'm glad they made some improvements to security as a result of this finding. This "attack" is still very specialized though and requires local access which (as mentioned) could've exposed the user to keyloggers and other malware.

Yes, it requires an attacker in a powerful position with local access. However, it does not require special privileges or techniques that may trigger endpoint security (such as keyloggers or memory dumping). The only requirements are reading a JSON file and making a single Windows API call to retrieve the key.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#24

Post by RedTeamPT »

harrygeez wrote: post #22
guerby wrote: post #10

I wonder if biometric bitwarden unlock on Android has the same kind of issue or not.

There are a few convenient scapegoats here but ultimately in this case it is not biometric unlock that enabled this but rather characteristic of the Active Directory's design (I'm not sure I will call it a weakness). For Android and iOS if you forget your PIN code I believe you are screwed, as in no one can decrypt your device for you.

Actually it is not just an issue with AD design, but the AD design only makes it slightly worse. The underlying issue is that biometrics are not required to retrieve the biometric key from DPAPI and instead of authenticating with Windows Hello, any program could just simply ask DPAPI for the key.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#25

Post by jabroni_salad »

gtirloni wrote: post #9

> As usual, we managed to get administrative access to the domain controller As usual? Is that the state of Windows Server security these days? I never managed a Windows-based network so I have no idea. I heard about these things back in the 2000's but I'm surprised this is "usual".

Yes. If you have LLMNR, NTLM enabled, unsigned SMB allowed, and nonencrypted LDAP bindings then your domain controller can be popped with zero effort by metasploit.

Legacy protocols can be very sticky and most repeat pentest engagements I am able to use the same exact method every time because they will never get addressed. Modern windows (since like vista-era) will use better stuff out of the box but will also allow downgrade attacks in the name of compatibility.

Hell, I still find SMBv1 in a lot of places.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#27

Post by hypeatei »

RedTeamPT wrote: post #23
hypeatei wrote: post #6

I'm glad they made some improvements to security as a result of this finding. This "attack" is still very specialized though and requires local access which (as mentioned) could've exposed the user to keyloggers and other malware.

Yes, it requires an attacker in a powerful position with local access. However, it does not require special privileges or techniques that may trigger endpoint security (such as keyloggers or memory dumping). The only requirements are reading a JSON file and making a single Windows API call to retrieve the key.

Good point.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#28

Post by malfist »

RedTeamPT wrote: post #23
hypeatei wrote: post #6

I'm glad they made some improvements to security as a result of this finding. This "attack" is still very specialized though and requires local access which (as mentioned) could've exposed the user to keyloggers and other malware.

Yes, it requires an attacker in a powerful position with local access. However, it does not require special privileges or techniques that may trigger endpoint security (such as keyloggers or memory dumping). The only requirements are reading a JSON file and making a single Windows API call to retrieve the key.

Do hardware keyloggers trigger endpoint security?

Re: Bitwarden Heist – How to break into password vaults without using passwords

#29

Post by RedTeamPT »

malfist wrote: post #28
RedTeamPT wrote: post #23

Earlier quoted context omitted.

Yes, it requires an attacker in a powerful position with local access. However, it does not require special privileges or techniques that may trigger endpoint security (such as keyloggers or memory dumping). The only requirements are reading a JSON file and making a single Windows API call to retrieve the key.

Do hardware keyloggers trigger endpoint security?

No, but hardware keylogger require physical access.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#30

Post by eddythompson80 »

malfist wrote: post #28
RedTeamPT wrote: post #23

Earlier quoted context omitted.

Yes, it requires an attacker in a powerful position with local access. However, it does not require special privileges or techniques that may trigger endpoint security (such as keyloggers or memory dumping). The only requirements are reading a JSON file and making a single Windows API call to retrieve the key.

Do hardware keyloggers trigger endpoint security?

They do not
Post reply on HN