Live data from Hacker News

LastPass autofill exploit

labs.detectify.com

391–400 of 443 posts

Re: LastPass autofill exploit

#391
post #57
post #4

It looks like there's more interesting stuff coming in soon: https://twitter.com/taviso/status/758074702589853696 (to save a click: Tavis Ormandy: "Are people really using this lastpass thing? I took a quick look and can see a bunch of obvious critical problems. I'll send a report asap.")

It seems that you didn't see: https://twitter.com/taviso/status/758143119409885185 Full report sent to LastPass, they're working on it now. Yes, it's a complete remote compromise. Yes, I promise I'll look at 1Password.

I did see it. Not sure what you mean by this.

Re: LastPass autofill exploit

#392

Earlier quoted context omitted.

I have never understood the password manager market honestly. To me it's very obvious that the CONCEPT of a "single point of failure" is a terrible idea. Putting faith in one or the other is just like humans backing politicians, they think they are backing something when really they just got manipulated into an opinion which they slowly defend more and more. Don't use a password manager, remember your passwords, or r…

Are you saying that you remember a unique and sufficiently random password for every website/app/etc you use? If so, you've got a far better memory that me.

What about this technique? https://support.mozilla.org/en-US/kb/create-secure-passwords...

Re: LastPass autofill exploit

#393
post #157
post #69

Earlier quoted context omitted.

Normally I like bike shedding about bug bounty payouts just about as much as complaints about paywalls. If you are going to go poking around someone's code for fun or profit, the terms of the bounty program are readily available [1] so you can't complain after the fact for earning the maximum payout. LastPass isn't Facebook, and they never claimed they would pay more than $1,000 even for a full compromise or RCE. On…

"On the other hand, using regexp to parse the URL when it's such an obviously security critical code path... just, why?!" Why not? URIs are at least able to be tokenized perfectly well by a regular expression. You have to do it right, but there's little guarantee that your non-regexp code will do it right either. I glanced at that regexp and immediately recognized several potential problems with it... will I be able…

Wait what?

"Why not? URIs are at least able to be tokenized perfectly well by a regular expression."

"5. Bonus critique, anything using regular expressions to URL-encode or decode is very suspicious; strongly prefer built-in functions that do this."

Re: LastPass autofill exploit

#394
Can we also discuss the fact that LastPass's two factor authentication is clearly done client-side (if you already have logged in on a machine, then you can fill in a login before it asks for your two factor authentication token). This is ridiculous. I need to switch to something else, is there a browser plugin for free software password managers like KeePassX?

Re: LastPass autofill exploit

#395

If autofill is potentially so dangerous, and in this instance, the prerequisite setting for this to work, why should it even be a feature? People who enable it might not understand the repercussions. I use 1Password and always invoke a shortcut to fill in my credentials.

It's a feature. It's got a bug. The logic for your conclusion is valid, but not practical.

Try this: Cars are dangerous. Why do they even exist? People who drive might not understand the repercussions.

If 1password has the same functionality, it may contain a similar vulnerability, whether you're expected to use a keyboard shortcut or not.

Re: LastPass autofill exploit

#396
post #73

Earlier quoted context omitted.

Perhaps LassPass users might like to donate to show their gratitude -- after all, you just protected an awful lot of people's passwords. Have you got a mechanism you could post here for them to do so?

You may donate by spreading the word about multi-factor auth :)

I wish I could upvote more than once. :-) Good on you, great reporting and all. Thanks for keeping my passwords more secure! And yes, I need Google Authenticator to log into my Lastpass.

Re: LastPass autofill exploit

#397

Earlier quoted context omitted.

It's not really very much more effort. I use KeeFox (Firefox) and Keepass2Android (you can guess). I love both tools, they've made password management trivial, and I used to be a die-hard "one password for everything is just so much more convenient" fan.

> I use KeeFox (Firefox) Integrating with the browser is probably a bad idea, it shortens the exploit path from a webpage to your password store. Using a standalone application and using the clipboard would require a malicious website to break out of the browser and then break into the password store process, which could in principle run under a different user and interact with the clipboard through some broker proce…

Given how broken clipboards are, using a clipboard isn't much more secure. Though, an extension can probably request credentials so it is a trade-off.

Re: LastPass autofill exploit

#398
Tavis Ormandy tweeted yesterday that he found something:

https://twitter.com/taviso/status/758143119409885185

Tavis has made quite a name for himself lately by going after AV vendors with no mercy. So when he tweeted, the community sat up and took notice. (Our own Slack was busy with discussion about this today)

Mathias, author of this post replied to Tavis with this:

https://twitter.com/avlidienbrunn/status/758232557829914624

The fix for the detectify exploit has already been pushed to users, so I'm guessing they were holding onto this public disclosure but Tavis putting his sights on lastpass too caused them to move the schedule up a little.

And the exploit from Tavis from 4 hours ago:

https://bugs.chromium.org/p/project-zero/issues/detail?id=88...

Re: LastPass autofill exploit

#399
post #82

Earlier quoted context omitted.

> 1. I can go to any computer with chrome and get access to all my passwords, so don't have to carry my passwords with me everywhere. Maybe a computer you can trust but I wouldn't say any computer. I consider the shared PC you'd find in a hotel business center to be the digital equivalent of a diseased hooker. I'd be impressed if it didn't have a key logger installed. > 2. Don't have to worry about storing passwords…

LastPass does at least provide a convenient on-screen keyboard to foil key loggers.

... to foil cheap keyloggers.

Re: LastPass autofill exploit

#400
post #157

Earlier quoted context omitted.

"On the other hand, using regexp to parse the URL when it's such an obviously security critical code path... just, why?!" Why not? URIs are at least able to be tokenized perfectly well by a regular expression. You have to do it right, but there's little guarantee that your non-regexp code will do it right either. I glanced at that regexp and immediately recognized several potential problems with it... will I be able…

Wait what? "Why not? URIs are at least able to be tokenized perfectly well by a regular expression." "5. Bonus critique, anything using regular expressions to URL-encode or decode is very suspicious; strongly prefer built-in functions that do this."

Encoding or decoding is not tokenization.

And the problem is probably more accurately stated as "be suspicious of any function implementing encoding or decoding" rather than focusing on the regex part. Use the correct standard function. Don't bash something together yourself. They're actually pretty easy functions to write if you know what you're doing, but it's even easier to use some tested already-existing function. In fact, it's so easy that the fact that you see someone bashing together a URL encoding or decoding function almost certainly proves that they don't know what they are doing, which in turn means the URL encoding or decoding function was written by someone who doesn't know what they are doing. Unsurprisingly, these are, well, to quote myself, "suspicious".

Yes, that logic applies to URL parsing as well! Unfortunately, browsers make URL parsing extra hard, which is really stupid, so you end up with more crap in Javascript than anywhere else. Even then you ought to prefer someone else's tested solution over just smashing out a regular expression; however, it is not a knock on the tested solution if it is a regular expression-based solution.

Post reply on HN