Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass autofill exploit

labs.detectify.com

Post reply on HN
Print view View original

271–280 of 443 posts

Re: LastPass autofill exploit

#271

Post by throwanem »

tedmiston wrote: post #247
throwanem wrote: post #242

Earlier quoted context omitted.

Why not take a look at the code injected by 1Password's browser extension and find out for yourself whether it handles URLs safely? That shouldn't be hard to do, and it's a lot healthier for the community than discouraging devs to participate by taking their presence as an opportunity for drive-by pot shots.

I'm sorry, but I don't see how asking an employee of the company that makes the product that I use every day is "discouraging devs to participate by taking their presence as an opportunity for drive-by pot shots". I think an official word holds more clout and is more valuable than any one person confirming for themselves in one version of one browser on one version of one OS.

I did speak rather harshly in my prior comment, and for that I apologize. Worse, I did a very poor job of expressing the concern that motivated me to respond. But I think it's still fair to ask whether your initial comment has value.

I understand that, as a user of 1Password's browser extension(s), you may well feel some concern that a similar vulnerability exists, and I don't think it's unreasonable to want reassurance on that score.

But I think your phrasing and framing of the question feels a lot more like a "gotcha" than anything else, and it's that feeling which motivated my prior comment - I'm not an AgileBits dev myself, but if I were, I'd feel strongly inclined to shy away from that question rather than trying to frame an answer that doesn't leave me open to a potentially hostile followup.

Re: LastPass autofill exploit

#272

Post by ghurtado »

mcs wrote: post #12

Please correct me if I am mistaken, but couldn't this have been implemented into an iframe that when ran could send the passwords to another remote server? If so, I am a little taken back by LastPass only offering $1,000 to the researcher that found and reported it for fixing. He or she could have taken a different path and resulted in this being used in some complex targeted attack against tech corporations via shor…

I don't think of the bounty as a reward for choosing not to break the law. Staying out of jail is the reward for not breaking the law; the $1000 is just a token of appreciation for someone that could have otherwise not bothered to report the bug.

Re: LastPass autofill exploit

#273

Post by johnl1479 »

xur17 wrote: post #263

The end of this article mentions that "Also, this would not work if multi factor authentication was on, so you should probably enable that as well." Does anyone know why that is the case? It seems like this exploit is just taking advantage of the js that autofills forms on the page based on domain. You can still use autofill if you have multifactor enabled.

Likely in the sense that the attacker cannot login into your account using the stolen credentials, as the second factor would not be in their possession.

Re: LastPass autofill exploit

#274

Post by ghurtado »

tptacek wrote: post #163
PeterisP wrote: post #160

Earlier quoted context omitted.

In practice, in many cases, bug bounties are de facto a bid in an auction against organized crime. It doesn't need to be 1-to-1 equivalent bid, and it's not for all sources of found bugs, but the intent and the effect is definitely there.

No, they are virtually never a bid against organized crime. There are two kinds of vulnerabilities in the world: The kind organized criminals will pay tens of thousands of dollars for, and the kind they, like any Internet rando, will pay $50 for lulz. If you think this dumb regex bug is worth the same to organized criminals as a Chrome sandbox escape or drive-by reliable Flash RCE... well, people think that about a l…

> you can smash a car with a sledgehammer, but that doesn't make the sledgehammer worth the value of the car.

Perfect analogy, I'm putting that in my back pocket.

Re: LastPass autofill exploit

#275

Post by xur17 »

johnl1479 wrote: post #273
xur17 wrote: post #263

The end of this article mentions that "Also, this would not work if multi factor authentication was on, so you should probably enable that as well." Does anyone know why that is the case? It seems like this exploit is just taking advantage of the js that autofills forms on the page based on domain. You can still use autofill if you have multifactor enabled.

Likely in the sense that the attacker cannot login into your account using the stolen credentials, as the second factor would not be in their possession.

The article links to lastpass multifactor [0] though. I agree that having multifactor enabled on the site the credentials were stolen for would block this attack.

[0] https://helpdesk.lastpass.com/multifactor-authentication-opt...

Re: LastPass autofill exploit

#276

Post by jontas »

julsimon wrote: post #153
SaturateDK wrote: post #61

Earlier quoted context omitted.

I want an alternative, got a good one?

Dashlane is really good. Running 100% in AWS and leveraging a lot of their security features. Here is their security white paper : https://www.dashlane.com/download/Dashlane-Security-Whitepap...

I just read the whitepaper (I am a long time Dashlane user) and they have a section on security of their javascript/browser extensions. They say that their extensions all use c++ so execute entirely outside of the javascript context. This would not have prevented the Lastpass exploit since all that was required as a malformed URL, but it is nice to see that Dashlane is thinking about this stuff. Also, had Lastpass not used js this exploit would've been harder to find (though not impossible).

Re: LastPass autofill exploit

#277

Post by estefan »

tptacek wrote: post #233
estefan wrote: post #228

Earlier quoted context omitted.

How do you know it hasn't already been found and actively exploited? Regardless, if a company isn't willing to demonstrate they value security to my satisfaction I won't be a customer.

I am absolutely OK with the idea that you'd stop using LastPass because they have a bug this dumb. I'm even OK with you believing that LastPass should pay more than other companies because they are so clearly reliant on external researchers to work on spec to find the simplest possible flaws in their code. The only problem I have is with the virulently bogus meme that companies should pay more for vulnerabilities bec…

> I am absolutely OK with...

That's a weight off...

I have no idea who you think you're replying to, but they're not my points dude...

Re: LastPass autofill exploit

#278

Post by tyleraldrich »

xur17 wrote: post #263

The end of this article mentions that "Also, this would not work if multi factor authentication was on, so you should probably enable that as well." Does anyone know why that is the case? It seems like this exploit is just taking advantage of the js that autofills forms on the page based on domain. You can still use autofill if you have multifactor enabled.

I assume it's because LastPass sends you the multi factor auth request before accessing your passwords (and therefore before allowing the autofill js stuff to use your password).

I don't actually use LastPass so I'm not 100% sure, but this would be the most likely case imo

Re: LastPass autofill exploit

#279

Post by necessity »

>They are still much better than the alternative (password reuse).

I'm not sure if it is, bugs like that are a serious threat. Personally I use the same (long) password for every website, except one of the characters which I replace by the website's first letter. One could think of similar, more sophisticated schemes of password reuse that yield a slightly different password for each website.

It would be even better if websites started using a public key authentication system, though.

Re: LastPass autofill exploit

#280

Post by balls187 »

tedmiston wrote: post #244
kordless wrote: post #232

Earlier quoted context omitted.

What you are really "asking" is logically equivalent to this blaming statement: "I see you are posting about LastPass' vulnerability, but you work for 1Password. Please confirm there exists a regex vulnerability in 1Password which is similar in nature to the one that occurred with LastPass." Put this way, the insanity of the statement is obvious. In questions, it becomes less obvious to the majority of the population…

Here's some context: I am a former LastPass user for many years and current (concerned) 1Password user wondering if I should be changing all of my passwords again. My goal was to settle concern for myself and other 1Password users. That's why I wrote whether a similar vulnerability "does not affect 1Password" instead of "does". My apologies if this was unclear.

Why did you switch from LastPass to 1Password?

I recently started using LastPass after years of reusing the same uncrackable password: !p@ssword123

Post reply on HN