Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden Heist – How to break into password vaults without using passwords

blog.redteam-pentesting.de

Post reply on HN
Print view View original

51–60 of 209 posts

Re: Bitwarden Heist – How to break into password vaults without using passwords

#51

Post by baldfat »

mrguyorama wrote: post #43
walki wrote: post #35

Microsoft's %Appdata% directory is a security nightmare in my opinion. Ideally applications should only have access to their own directories in %Appdata% by default. I recently came across a python script on GitHub that allows to decrypt passwords the browser stores locally in their %Appdata% directory. Many attacks could be prevented if access to %Appdata% was more restricted. I also found a post of an admin a few d…

>python script on GitHub that allows to decrypt passwords the browser stores locally in their %Appdata% directory. Yes, otherwise known as "if you run code on your computer, it can run code on your computer". If a random python program can "decrypt" the passwords, that's not encryption. And browser password management isn't about security, but convenience.

I tell myself and other people if you have it saved in your browser are you okay if bad people know that password. Also it makes it easy for people in authority to get to that password with a simple court order.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#52

Post by tamimio »

Ok but it assumes the domain is compromised as stated in the article, and if the domain controller is compromised, it’s a game over for connected machines hence these attacks usually focus on domain admin or schema admin. Edit: it seems the second non-biometric method doesn’t need domain, it’s still however need that local access

> S-1-5-21-505269936…

Kind of off topic but around 20years ago when I had my first portable harddisk, I used this method by creating these type of folders and remembering the numbers sequence in a creative way to hide my files when traveling/crossing borders while putting some decoy files in the plain sight, before knowing/using data encryptions, and it worked, I remember the agent taking my hdd and seeing him going through the decoy files and then returning my hdd normally.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#53

Post by AlienRobot »

walki wrote: post #35

Microsoft's %Appdata% directory is a security nightmare in my opinion. Ideally applications should only have access to their own directories in %Appdata% by default. I recently came across a python script on GitHub that allows to decrypt passwords the browser stores locally in their %Appdata% directory. Many attacks could be prevented if access to %Appdata% was more restricted. I also found a post of an admin a few d…

There's probably nothing that I hate in programming more than having full access to the file system. Any time I write a program that has to delete a file I just make it move into a trash folder instead just in case I mess up somewhere and accidentally delete the entire file system.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#54

Post by paulpauper »

WalterBright wrote: post #42

I've always considered password vaults as a single point of failure that will compromise all of your passwords. I've had lots of intelligent, well-informed programmers argue that my concern is groundless.

If done correctly it works. correctly being the operative word.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#55

Post by dist-epoch »

walki wrote: post #35

Microsoft's %Appdata% directory is a security nightmare in my opinion. Ideally applications should only have access to their own directories in %Appdata% by default. I recently came across a python script on GitHub that allows to decrypt passwords the browser stores locally in their %Appdata% directory. Many attacks could be prevented if access to %Appdata% was more restricted. I also found a post of an admin a few d…

AppData is the Windows equivalent to Linux home directory dotfiles.

> Ideally applications should only have access to their own directories

This happens for Windows Store apps, which are sandboxed similarly to mobile phone apps.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#56

Post by WalterBright »

lordofmoria wrote: post #50
WalterBright wrote: post #42

I've always considered password vaults as a single point of failure that will compromise all of your passwords. I've had lots of intelligent, well-informed programmers argue that my concern is groundless.

Everything is a tradeoff - but the basic balance is very strongly in favor of password managers: 1. without a password manager that is shared on all your devices, you WILL re-use passwords out of frustration. 2. without a password manager, if you do any sort of regular sharing passwords with a engineering team, friends & family, you'll resort to pretty insecure channels. 3. true E2E encryption, while still providing…

With a keylogger, you lose passwords you typed in since the keylogger was installed, but that is rarely all of your passwords.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#57

Post by lordofmoria »

WalterBright wrote: post #56
lordofmoria wrote: post #50

Earlier quoted context omitted.

Everything is a tradeoff - but the basic balance is very strongly in favor of password managers: 1. without a password manager that is shared on all your devices, you WILL re-use passwords out of frustration. 2. without a password manager, if you do any sort of regular sharing passwords with a engineering team, friends & family, you'll resort to pretty insecure channels. 3. true E2E encryption, while still providing…

With a keylogger, you lose passwords you typed in since the keylogger was installed, but that is rarely all of your passwords.

Absolutely agree - that's why I said "so the real difference is you've conveniently pre-loaded all your sensitive information in one go for the bad actor."

Re: Bitwarden Heist – How to break into password vaults without using passwords

#58

Post by AlienRobot »

mrguyorama wrote: post #43
walki wrote: post #35

Microsoft's %Appdata% directory is a security nightmare in my opinion. Ideally applications should only have access to their own directories in %Appdata% by default. I recently came across a python script on GitHub that allows to decrypt passwords the browser stores locally in their %Appdata% directory. Many attacks could be prevented if access to %Appdata% was more restricted. I also found a post of an admin a few d…

>python script on GitHub that allows to decrypt passwords the browser stores locally in their %Appdata% directory. Yes, otherwise known as "if you run code on your computer, it can run code on your computer". If a random python program can "decrypt" the passwords, that's not encryption. And browser password management isn't about security, but convenience.

>if you run code on your computer, it can run code on your computer

For the love of God will someone please just make a web browser that isn't a web browser and it's just a cross platform multimedia sandbox with a couple of APIs in it, and you can run programs written in rust or something on it, and it doesn't let the programs touch your file system unless it has explicit permission? That would solve 99% of the application use cases. That's literally everything I want. I want the safety of the browser, outside the hell that is web development.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#59

Post by mrguyorama »

lukevp wrote: post #48
mrguyorama wrote: post #43

Earlier quoted context omitted.

>python script on GitHub that allows to decrypt passwords the browser stores locally in their %Appdata% directory. Yes, otherwise known as "if you run code on your computer, it can run code on your computer". If a random python program can "decrypt" the passwords, that's not encryption. And browser password management isn't about security, but convenience.

Full unrestricted disk access for all users and code isn’t the only way an OS can be designed.

AppData is specifically where apps store data, and there are and were plenty of legitimate examples where you want some code to access data from an app in there.

The entire point is that it is not meant to be a secure location, was never meant to be a secure location, has no intended security features etc. If you store your passwords in a text file on the desktop, that is also insecure but you would be wrong to say Notepad has a security vulnerability. Similarly, if you stored your passwords in the Windows registry unencrypted, that would also be insecure, but does not demonstrate a flaw in the Windows registry.

If you want to be able to leave your secrets in the open without them being compromised, then you encrypt them.

Browser password managers are not secure. That is not Window's fault.

Re: Bitwarden Heist – How to break into password vaults without using passwords

#60

Post by alberth »

tamimio wrote: post #52

Ok but it assumes the domain is compromised as stated in the article, and if the domain controller is compromised, it’s a game over for connected machines hence these attacks usually focus on domain admin or schema admin. Edit: it seems the second non-biometric method doesn’t need domain, it’s still however need that local access > S-1-5-21-505269936… Kind of off topic but around 20years ago when I had my first porta…

Agreed.

> "We recently conducted a penetration test with the goal of compromising the internal network of a client in a Windows environment. As usual, we managed to get administrative access to the domain controller"

This article feels like click-bait, when they buried the lede.

Post reply on HN