Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass autofill exploit

labs.detectify.com

Post reply on HN
Print view View original

311–320 of 443 posts

Re: LastPass autofill exploit

#311

Post by Domenic_S »

jacobsladder wrote: post #307

$1000 for the bug bounty? This is incredibly stupid! How can you make a living off that? You could make hundreds of thousands of US$ from exploiting this. You could sell it on the black market. I am surprised that most of the corporations, even respectable ones, are awarding peanuts for something that is so important to their business process. This makes my blood boil. I operate a small business website and I awarded…

Someone always makes a comment like this. Honestly, the black market value (if any) has nothing to do with the whitehat bounty amount. Why should it? The person who's going to do legitimate whitehat work isn't the same person who's going to sell on the black market.

I think of it like drugs. $50k street value of cocaine is not going to do me a lot of good because 1) I'd have no idea where to sell it, 2) if I did know where, I wouldn't have the relationships built and would probably get ripped off/killed/what-have-you, and 3) selling drugs isn't something I'd like to do. So, if there were an option of turning in the drugs to the police for $500, I would take that instead.

Re: LastPass autofill exploit

#312

Post by mod »

jacobsladder wrote: post #307

$1000 for the bug bounty? This is incredibly stupid! How can you make a living off that? You could make hundreds of thousands of US$ from exploiting this. You could sell it on the black market. I am surprised that most of the corporations, even respectable ones, are awarding peanuts for something that is so important to their business process. This makes my blood boil. I operate a small business website and I awarded…

I tend to agree. LastPass is literally in the business of securing passwords, and was giving them away.

I think the bounty should be: 10000 This bug would have been exploited, sooner or later, and would have had massively disastrous results. Those results are now avoided, and that's worth a lot more than 1k.

Re: LastPass autofill exploit

#313

Post by mod »

Domenic_S wrote: post #311
jacobsladder wrote: post #307

$1000 for the bug bounty? This is incredibly stupid! How can you make a living off that? You could make hundreds of thousands of US$ from exploiting this. You could sell it on the black market. I am surprised that most of the corporations, even respectable ones, are awarding peanuts for something that is so important to their business process. This makes my blood boil. I operate a small business website and I awarded…

Someone always makes a comment like this. Honestly, the black market value (if any) has nothing to do with the whitehat bounty amount. Why should it? The person who's going to do legitimate whitehat work isn't the same person who's going to sell on the black market. I think of it like drugs. $50k street value of cocaine is not going to do me a lot of good because 1) I'd have no idea where to sell it, 2) if I did know…

Your logic is sound. I agree with the GP post about the increased value, though not for his same reasoning.

Fixing this bug before an exploit is worth a LOT to the company. I think they have a moral obligation to pay more than 1k to fix it.

I also think it makes sense to award good-sized bounties, as at this point I would have no interest in their bounty program, were I hunting bounties.

Re: LastPass autofill exploit

#314

Post by niij »

sergioisidoro wrote: post #287

Last pass also has a flaw on 2Fa. They cache local copies of the encrypted files, and the auto-fill populates the fields after password, before promoting 2fa. It does erase the fields and promoted 2fa, but passwords are available briefly. I Sent a ticket to their supportthey, they acknowledged the issue and just asked me to disable local cache... (Chrome extension)

I've received nothing but disregard from their terrible support as well.

Re: LastPass autofill exploit

#315

Post by gtirloni »

yonilevy wrote: post #230

The autofill feature starts sounding like the benefit isn't worth the risk. It's kind of odd when thinking about it, that my passwords can be decrypted without me explicitly asking for them. I hope there aren't other mechanisms aside from autofill that allow that. While we're here - is there a way to disable autofill in LastPass entirely?

Edit the extension's preferences and disable "Automatically Fill Login Information".

Re: LastPass autofill exploit

#316

Post by mod »

tptacek wrote: post #163
PeterisP wrote: post #160

Earlier quoted context omitted.

In practice, in many cases, bug bounties are de facto a bid in an auction against organized crime. It doesn't need to be 1-to-1 equivalent bid, and it's not for all sources of found bugs, but the intent and the effect is definitely there.

No, they are virtually never a bid against organized crime. There are two kinds of vulnerabilities in the world: The kind organized criminals will pay tens of thousands of dollars for, and the kind they, like any Internet rando, will pay $50 for lulz. If you think this dumb regex bug is worth the same to organized criminals as a Chrome sandbox escape or drive-by reliable Flash RCE... well, people think that about a l…

No, but it makes sledgehammer-prevention worth something greater than zero and something less than the cost of sledgehammer repairs.

Bug bounty programs, presumably, prevent unsavory exploits at some point in the future. Having this responsibly disclosed was damaging still, but cost LastPass less money than having it exploited later.

I'm not sure where that falls on your "significance" scale.

Re: LastPass autofill exploit

#317

Post by thieving_magpie »

jacobsladder wrote: post #307

$1000 for the bug bounty? This is incredibly stupid! How can you make a living off that? You could make hundreds of thousands of US$ from exploiting this. You could sell it on the black market. I am surprised that most of the corporations, even respectable ones, are awarding peanuts for something that is so important to their business process. This makes my blood boil. I operate a small business website and I awarded…

>You could make hundreds of thousands of US$ from exploiting this.

And all you have to do is risk your freedom.

Re: LastPass autofill exploit

#318

Post by dmix »

jacobsladder wrote: post #307

$1000 for the bug bounty? This is incredibly stupid! How can you make a living off that? You could make hundreds of thousands of US$ from exploiting this. You could sell it on the black market. I am surprised that most of the corporations, even respectable ones, are awarding peanuts for something that is so important to their business process. This makes my blood boil. I operate a small business website and I awarded…

> You could make hundreds of thousands of US$ from exploiting this

Oh no, not this type of comment again. Infosec people always make fun of HN for this exact type of comment. The total lack of understanding of the economics of bug hunting doesn't stop people from commenting here.

Noone is paying $100k in some imaginary black market for web exploits. I mean have you even considered who buys exploits and what type of attacks they conduct? There isn't an active market looking to noisily grab passwords from a low-grade consumer password manager that no enterprise or governments uses. Your XSS/SQLi are only worth a marginal amount of money to the corporation you're pen testing.

And supply/demand is always what drives prices, not the potential damage (or benefit) you can imagine a particular exploit doing. This is as true for vulnerabilities as it is for some business software or mobile app your create. Just because in a perfect situation it could generate x value for a customer doesn't mean there is either demand or an untapped market for it.

A browser-based iPhone zero-day on the other hand can fetch some money. But even then your grey market for this is tiny and most likely not going to be some criminal overlord paying out $100k in bitcoin to kids on a darknet forum.

Re: LastPass autofill exploit

#319

Post by dashlanesupport »

julsimon wrote: post #153
SaturateDK wrote: post #61

Earlier quoted context omitted.

I want an alternative, got a good one?

Dashlane is really good. Running 100% in AWS and leveraging a lot of their security features. Here is their security white paper : https://www.dashlane.com/download/Dashlane-Security-Whitepap...

Hello Julsimon, this is Simon from Dashlane's Support team. Thank you for your feedback. We have indeed ran multiple checks on our end and can confirm that we are not vulnerable to this type of issue. The code used for our auto-fill functions is shared on all our platforms and has been audited multiple times.

Re: LastPass autofill exploit

#320

Post by arcticfox »

Domenic_S wrote: post #311
jacobsladder wrote: post #307

$1000 for the bug bounty? This is incredibly stupid! How can you make a living off that? You could make hundreds of thousands of US$ from exploiting this. You could sell it on the black market. I am surprised that most of the corporations, even respectable ones, are awarding peanuts for something that is so important to their business process. This makes my blood boil. I operate a small business website and I awarded…

Someone always makes a comment like this. Honestly, the black market value (if any) has nothing to do with the whitehat bounty amount. Why should it? The person who's going to do legitimate whitehat work isn't the same person who's going to sell on the black market. I think of it like drugs. $50k street value of cocaine is not going to do me a lot of good because 1) I'd have no idea where to sell it, 2) if I did know…

But if the police want to incentivize you to find cocaine, how hard are you going to look for only $500?

In the sense that "Oh yeah, I just casually stumbled on an enormous exploit of security software" the bounty is a good deal. In the sense that "Should I look for holes in this thing? Is it worth my time?" it's absolutely not unless the person is interested in it academically or for reputation.

Post reply on HN