It looks like there's more interesting stuff coming in soon: https://twitter.com/taviso/status/758074702589853696 (to save a click: Tavis Ormandy: "Are people really using this lastpass thing? I took a quick look and can see a bunch of obvious critical problems. I'll send a report asap.")
It seems that you didn't see: https://twitter.com/taviso/status/758143119409885185 Full report sent to LastPass, they're working on it now. Yes, it's a complete remote compromise. Yes, I promise I'll look at 1Password.
LastPass autofill exploit
391–400 of 443 posts
Re: LastPass autofill exploit
#392Earlier quoted context omitted.
I have never understood the password manager market honestly. To me it's very obvious that the CONCEPT of a "single point of failure" is a terrible idea. Putting faith in one or the other is just like humans backing politicians, they think they are backing something when really they just got manipulated into an opinion which they slowly defend more and more. Don't use a password manager, remember your passwords, or r…
Are you saying that you remember a unique and sufficiently random password for every website/app/etc you use? If so, you've got a far better memory that me.
Re: LastPass autofill exploit
#393Earlier quoted context omitted.
Normally I like bike shedding about bug bounty payouts just about as much as complaints about paywalls. If you are going to go poking around someone's code for fun or profit, the terms of the bounty program are readily available [1] so you can't complain after the fact for earning the maximum payout. LastPass isn't Facebook, and they never claimed they would pay more than $1,000 even for a full compromise or RCE. On…
"On the other hand, using regexp to parse the URL when it's such an obviously security critical code path... just, why?!" Why not? URIs are at least able to be tokenized perfectly well by a regular expression. You have to do it right, but there's little guarantee that your non-regexp code will do it right either. I glanced at that regexp and immediately recognized several potential problems with it... will I be able…
"Why not? URIs are at least able to be tokenized perfectly well by a regular expression."
"5. Bonus critique, anything using regular expressions to URL-encode or decode is very suspicious; strongly prefer built-in functions that do this."
Re: LastPass autofill exploit
#394Re: LastPass autofill exploit
#395If autofill is potentially so dangerous, and in this instance, the prerequisite setting for this to work, why should it even be a feature? People who enable it might not understand the repercussions. I use 1Password and always invoke a shortcut to fill in my credentials.
Try this: Cars are dangerous. Why do they even exist? People who drive might not understand the repercussions.
If 1password has the same functionality, it may contain a similar vulnerability, whether you're expected to use a keyboard shortcut or not.
Re: LastPass autofill exploit
#396Earlier quoted context omitted.
Perhaps LassPass users might like to donate to show their gratitude -- after all, you just protected an awful lot of people's passwords. Have you got a mechanism you could post here for them to do so?
You may donate by spreading the word about multi-factor auth :)
Re: LastPass autofill exploit
#397Earlier quoted context omitted.
It's not really very much more effort. I use KeeFox (Firefox) and Keepass2Android (you can guess). I love both tools, they've made password management trivial, and I used to be a die-hard "one password for everything is just so much more convenient" fan.
> I use KeeFox (Firefox) Integrating with the browser is probably a bad idea, it shortens the exploit path from a webpage to your password store. Using a standalone application and using the clipboard would require a malicious website to break out of the browser and then break into the password store process, which could in principle run under a different user and interact with the clipboard through some broker proce…
Re: LastPass autofill exploit
#398https://twitter.com/taviso/status/758143119409885185
Tavis has made quite a name for himself lately by going after AV vendors with no mercy. So when he tweeted, the community sat up and took notice. (Our own Slack was busy with discussion about this today)
Mathias, author of this post replied to Tavis with this:
https://twitter.com/avlidienbrunn/status/758232557829914624
The fix for the detectify exploit has already been pushed to users, so I'm guessing they were holding onto this public disclosure but Tavis putting his sights on lastpass too caused them to move the schedule up a little.
And the exploit from Tavis from 4 hours ago:
https://bugs.chromium.org/p/project-zero/issues/detail?id=88...
Re: LastPass autofill exploit
#399Earlier quoted context omitted.
> 1. I can go to any computer with chrome and get access to all my passwords, so don't have to carry my passwords with me everywhere. Maybe a computer you can trust but I wouldn't say any computer. I consider the shared PC you'd find in a hotel business center to be the digital equivalent of a diseased hooker. I'd be impressed if it didn't have a key logger installed. > 2. Don't have to worry about storing passwords…
LastPass does at least provide a convenient on-screen keyboard to foil key loggers.
Re: LastPass autofill exploit
#400Earlier quoted context omitted.
"On the other hand, using regexp to parse the URL when it's such an obviously security critical code path... just, why?!" Why not? URIs are at least able to be tokenized perfectly well by a regular expression. You have to do it right, but there's little guarantee that your non-regexp code will do it right either. I glanced at that regexp and immediately recognized several potential problems with it... will I be able…
Wait what? "Why not? URIs are at least able to be tokenized perfectly well by a regular expression." "5. Bonus critique, anything using regular expressions to URL-encode or decode is very suspicious; strongly prefer built-in functions that do this."
And the problem is probably more accurately stated as "be suspicious of any function implementing encoding or decoding" rather than focusing on the regex part. Use the correct standard function. Don't bash something together yourself. They're actually pretty easy functions to write if you know what you're doing, but it's even easier to use some tested already-existing function. In fact, it's so easy that the fact that you see someone bashing together a URL encoding or decoding function almost certainly proves that they don't know what they are doing, which in turn means the URL encoding or decoding function was written by someone who doesn't know what they are doing. Unsurprisingly, these are, well, to quote myself, "suspicious".
Yes, that logic applies to URL parsing as well! Unfortunately, browsers make URL parsing extra hard, which is really stupid, so you end up with more crap in Javascript than anywhere else. Even then you ought to prefer someone else's tested solution over just smashing out a regular expression; however, it is not a knock on the tested solution if it is a regular expression-based solution.