That is shocking.
LastPass autofill exploit
51–60 of 443 posts
Re: LastPass autofill exploit
#52One should really consider using open source tools for such things. The good thing is that those are battle-tested real well and are, usually, more secure than the commercial offerings. An example is Vault [0]. Encryptr [1] is another alternative: it claims that "all of your data will be saved in encrypted format in our Zero Knowledge [2] cloud". [0] https://github.com/hashicorp/vault [1] https://spideroak.com/soluti…
Please correct me if I'm wrong, but lastpass uses the same 'zero-knowledge' method that spideroak uses, other than spider oak uses that term everywhere including their cloud backup offering. Zero knowledge is merely the fact that spider oak only holds encrypted backups of your files and it has no way of seeing them. LastPass tells us the same thing.
Maybe I shouldn't have mentioned Encryptr.
There are fair number of open source alternatives that allow you to store secrets in the cloud:
vault: https://github.com/hashicorp/vault
blackbox: https://github.com/StackExchange/blackbox
git-crypt: https://www.agwa.name/projects/git-crypt/
Pass: http://www.zx2c4.com/projects/password-store/
Transcrypt: https://github.com/elasticdog/transcrypt
Keyringer: https://keyringer.pw/
git-secret: https://github.com/sobolevn/git-secretRe: LastPass autofill exploit
#53I'm generally very sympathetic to regex bugs (especially in a language like JavaScript where you don't get nice expanded multiline regexes with comments), but I am wondering why they went with a regex in the first place. Did they decide `document.location.host` was too brittle for some reason?
Not using `document.location.host` stood out to me too. I think the takeaway here is don't use regex unless you absolutely have to and don't use it to parse things that have rigorous standards describing them. Emails, phone numbers, URLs come to mind.
Re: LastPass autofill exploit
#54If I read this article correctly, the headline should actually be: How I made LastPass give me all MY passwords Update: after a few answers to my badly thought through comment, I now feel enlightened. The attack scenario is a malicious web site which can gobble up my passwords. Thanks
This is just a PoC. Now imagine that the author instead: 1. Writes up that post. 2. Inserts an iframe in the post, which enumerates known sites. (hidden out of view with css tricks) 3. Instead of alerting on screen, sends the results back to their server. 4. Submits to HN.
It's also REALLY easy to deliver that malicious site through web ads, especially background pops.
Re: LastPass autofill exploit
#55Was this an issue with the browser extension? How (and how often) are updates pushed to the client?
[deleted]
Re: LastPass autofill exploit
#56Earlier quoted context omitted.
Where do you write yours down?
I memorised a very simple algorithm to construct passwords from the domain name of a site. Then I concatenate that with one of three fixed portions depending on how important I view the site (e.g. banks get the most secure one, then gmail, then everything else). It works pretty well. Different password for each site, I only have to remember a few things, and it would take several compromises (and a weirdly dedicated…
I do a vaguely similar thing but I don't share it with the world :)
Re: LastPass autofill exploit
#57It looks like there's more interesting stuff coming in soon: https://twitter.com/taviso/status/758074702589853696 (to save a click: Tavis Ormandy: "Are people really using this lastpass thing? I took a quick look and can see a bunch of obvious critical problems. I'll send a report asap.")
It seems that you didn't see: https://twitter.com/taviso/status/758143119409885185
Full report sent to LastPass, they're working on it now. Yes,
it's a complete remote compromise. Yes, I promise I'll look at
1Password.Re: LastPass autofill exploit
#58Earlier quoted context omitted.
Perhaps, but this particular exploit doesn't target the fact your passwords are stored in the cloud. It targets the local autofill functionality in the browser, so it could conceivably have occurred in any password manager with browser/autofill integration. Including those that use a local password store.
Do you mean it could happen with, say, Firefox's built-in password manager?
Yes, sir.
What's happening is that this extension auto filling the password in unintended sites. Where it is getting passwords from (offline or from cloud) is immaterial for this case.
Re: LastPass autofill exploit
#59I've been using LastPass for about 3 years, and now I'm seriously thinking about all the times people told me about how storing passwords in someone else's cloud is bad. I've been defending LastPass and recommending it to everyone till today. Now I'm thinking about how I might have to 'pay' for a software vulnerability in some private (read:unauditable by me) code. All the comments about offline, local backups make s…
I'd say some of the points could be easily covered by something like KeePass which, unlike cloud, doesn't have to depend on questionable security of third-party services. For example. I use KeePass to store all my password. I keep my KeePass database in Google Drive, so any change to the file will be updated. because of that I can use KeePass on any machine that has access to Google Drive (I also keep executables for…
It's not really very much more effort. I use KeeFox (Firefox) and Keepass2Android (you can guess). I love both tools, they've made password management trivial, and I used to be a die-hard "one password for everything is just so much more convenient" fan.
Re: LastPass autofill exploit
#60Please correct me if I am mistaken, but couldn't this have been implemented into an iframe that when ran could send the passwords to another remote server? If so, I am a little taken back by LastPass only offering $1,000 to the researcher that found and reported it for fixing. He or she could have taken a different path and resulted in this being used in some complex targeted attack against tech corporations via shor…
The fact that LastPass consider that a flaw in their system that could have put them on their knees is only worth 1K is quite frightening if you are relying on them for your security.
Exactly this. I'm abandoning them now.