Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How did LastPass master passwords get compromised?

palant.info

Post reply on HN
Print view View original

61–70 of 189 posts

Re: How did LastPass master passwords get compromised?

#61

Post by palant »

overlordalex wrote: post #3
palant wrote: post #2

I am the author of this article. I’ve kept it short, some points made there could have been expanded considerably. So if there are questions, feel free to ask here.

What is your opinion of the analysis from LastPass themselves?[0] It seems to have been some internal alerting that went wrong, which does happen from time to time. > Our initial findings led us to believe that these alerts were triggered in response to attempted “credential stuffing” activity [...] We quickly worked to investigate this activity and, at this time, have no indication that any LastPass accounts were co…

The formulation is vague enough that it could mean anything. Maybe the alerts were sent out by mistake which would be good news. But they don’t quite say that. Their statement might also mean that they rather disabled legitimate alerts so that people don’t get concerned. So they might have “cured” the symptoms without addressing the actual issue.

It certainly isn’t reassuring that they keep talking about credential stuffing, even though it’s quite unlikely to be the culprit here.

Re: How did LastPass master passwords get compromised?

#62

Post by chrisfosterelli »

yuliyp wrote: post #58
chrisfosterelli wrote: post #51

Earlier quoted context omitted.

There's little security advantage to doing this other than some obscurity, because a well informed attacker can still implement all the same attacks: * An attacker with access to the database will know they can reduce the "hashing algorithm" to two sequential hashing algorithms and still bruteforce a series of plaintext passwords to check to see if the hash matches what is in the database. * An attacker with access t…

It does prevent inadvertent logging of passwords, though: no piece of software on the server side will have the user's password in memory at any point. Which does mean the user's actual password (if they're reusing passwords) stays more secure (by "more secure" I mean "has a lower probability of leaking to a malicious actor", not necessarily "has some additional security properties").

Ah yes that's a good point. It can still leak the "password" that's used for authentication so it doesn't protect their account on that service but logs wouldn't leak the original password that might be reused elsewhere so it could protect their account on other services marginally more.

Re: How did LastPass master passwords get compromised?

#63

Post by 8organicbits »

chrisfosterelli wrote: post #51
8organicbits wrote: post #16

Earlier quoted context omitted.

I wish there was a good way to implement this sort of double hashing in web apps. Doing the extra salted hash client side ensures that the value the server sees is globally unique, even when the user is reusing passwords across sites. Unfortunately the only way I know how to implement that is to have the server send JS down to the browser that instructs it to perform the hashing. For certain types of compromises serv…

There's little security advantage to doing this other than some obscurity, because a well informed attacker can still implement all the same attacks: * An attacker with access to the database will know they can reduce the "hashing algorithm" to two sequential hashing algorithms and still bruteforce a series of plaintext passwords to check to see if the hash matches what is in the database. * An attacker with access t…

If we add client side hashing, it does nothing to prevent hash replay attacks. Agreed.

However, it prevents the attacker from immediately trying the same raw password on other sites (i.e. credential stuffing). They would need to perform additional offline attack of the first hash. This adds cost to something that would have previously been trivial.

Given that about 65% of users reuse passwords and 76% don't even use a password manager [1], I think that slowing down credential stuffing attacks is important.

Protecting against some attacks is valuable even if you don't protect against all attacks. Layered security.

1. https://services.google.com/fh/files/blogs/google_security_i...

Re: How did LastPass master passwords get compromised?

#64

Post by chowells »

chrisfosterelli wrote: post #51
8organicbits wrote: post #16

Earlier quoted context omitted.

I wish there was a good way to implement this sort of double hashing in web apps. Doing the extra salted hash client side ensures that the value the server sees is globally unique, even when the user is reusing passwords across sites. Unfortunately the only way I know how to implement that is to have the server send JS down to the browser that instructs it to perform the hashing. For certain types of compromises serv…

There's little security advantage to doing this other than some obscurity, because a well informed attacker can still implement all the same attacks: * An attacker with access to the database will know they can reduce the "hashing algorithm" to two sequential hashing algorithms and still bruteforce a series of plaintext passwords to check to see if the hash matches what is in the database. * An attacker with access t…

Your analysis seems to overlook an important detail in that first bullet point - dictionary attacks are only feasible when the KDF is fast. Authentication servers tend to require the KDF to be fast so they aren't constantly performing a denial of service attack on themselves. What people are looking for is a way to make the combined KDF slow by pushing most of the work to the client side. If this succeeds, you have made dictionary attacks very difficult without making your authentication process a denial of service vector.

The web browser ecosystem makes this a pretty hard task, unfortunately. You need fallbacks that weaken the process to the point where it is basically useless in a lot of cases. But the goal of a client/server split in the KDF is actually quite sensible. The client side does the large amount of work to protect users from dictionary attacks. The server side does a relatively much smaller amount of work to protect itself from being easily exploited if its hashes are exfiltrated when the hashes aren't themselves vulnerable to dictionary attacks.

Re: How did LastPass master passwords get compromised?

#65

Post by palant »

trajcek wrote: post #40
palant wrote: post #2

I am the author of this article. I’ve kept it short, some points made there could have been expanded considerably. So if there are questions, feel free to ask here.

Thanks for writing this up! After reading LastPass' very vague response, they did not inspire confidence for me to stick around as a paying customer. I am unsure if this is too small of a compromise for them to be able to a) care or b) spend resources on investigating or that they just don't know what's happening.

It’s vacation time, they simply don’t have the people on site to investigate the issue quickly. So far not surprising, and certainly intended by the timing of this attack.

That their first reaction is to downplay rather than to admit that they don’t know much yet – that’s rather typical of LastPass unfortunately. Sadly, with this approach they aren’t exactly an outlier in the industry.

Re: How did LastPass master passwords get compromised?

#66

Post by md_ »

SavantIdiot wrote: post #54
md_ wrote: post #41

Earlier quoted context omitted.

> There exists no computer system than can crack an AES256 encrypted document. The weaknesses are in the protocol. Well, or in the human-chosen passphrase. There are plenty of systems that can brute force an 8-character alphanumeric password run through PBKDF2 for 100,000 rounds. Per https://support.1password.com/pbkdf2/ , that costs...about $60k. So keeping the ciphertext safe is in fact a very reasonable precaution…

You are correct: if the password used to create the key is trivial, then there definitely exists hardware that can guess AES256 passwords even if a KDF is used weakly. I'm not sure how to read that table. Is that really the cost for a 100,000 iteration PBKDF2?!?

I have not checked 1Password's math--they just come up in the results for "PBKDF2 cost of brute forcing". ;)

But yes, it matches my intuition--brute forcing human-strength keys is surprisingly cheap. (And I don't know if they're taking into account the discount if you have custom ASICs for this, defend against which is the argument made for scrypt instead.)

Re: How did LastPass master passwords get compromised?

#67

Post by roozbeh18 »

skarz wrote: post #30

Passwords were NOT compromised. It is hackers using existing compromised email/password combinations on brute force attempts at Lastpass. That is why your Lastpass password should be a password that you have not nor will ever use on any other site.

OP blog suggests users receiving similar email even after changing their master password. two possibilities for LP. either their servers were hacked and hashed master passwords were dumped somewhere or as LP said, system error due to a bug.

Re: How did LastPass master passwords get compromised?

#68

Post by md_ »

shkkmo wrote: post #59
md_ wrote: post #37

Earlier quoted context omitted.

It's easy for me to imagine how you get here. - Eng are still writing the postmortem - Marketing want to put out a statement - Eng know or suspect a bug exists that can trigger spurious notifications, but don't have sufficient logs to be able to reconstruct if that bug was in fact in play in production - Legal advises not to say anything definitive that they can't stand behind later I don't see any of that as particu…

Then why not say: "We have identified and fixed bugs that could result in incorrect masterpassword use notifications being sent but we have not yet been able to determine which if any of the recent wave of notifications were caused by those bugs. We are still investigating the issue". Instead of communicating clearly around a serious security incident they are using mealy mouthed PR speak which does nothing to improv…

Sure, I'm with you, but this is pretty par for the course on incident comms.

Re: How did LastPass master passwords get compromised?

#69

Post by palant »

kurthr wrote: post #18
palant wrote: post #2

I am the author of this article. I’ve kept it short, some points made there could have been expanded considerably. So if there are questions, feel free to ask here.

You say that the LastPass protocol is subject to hash replay attacks (my description). I'd be surprised if there wasn't some time dependent pepper (e.g. challenge/response) in the hash, since this seems like a huge vulnerability, and storage of the hash allows for off-line attacks. Normally, I'd think diffie-hellman for this.

No, there is nothing. The complication with challenge/response schemes is that the server doesn’t know the master password – it only has that one hash, so it’s always comparing against it. There are PAKE protocols which work around this issue, but LastPass didn’t implement any of them (probably for historical reasons already, I think LastPass is older than most of these approaches).

Normally, it isn’t such a huge vulnerability. TLS encryption is there, so nobody should be able to catch that hash in transition. And even if they did, the most sensitive data is encrypted so that you still need the master password. Still, this is rather suboptimal.

Re: How did LastPass master passwords get compromised?

#70

Post by palant »

wwkeyboard wrote: post #6
palant wrote: post #2

I am the author of this article. I’ve kept it short, some points made there could have been expanded considerably. So if there are questions, feel free to ask here.

They claim to have 30,000,000 users but we've only seen a handful of reports about this, why such a small percentage? Wouldn't someone with a full list of passwords want to exfiltrate as much data as possible before it became obvious they had the creds?

First of all: I don’t think that all accounts are affected. For example, my own account didn’t receive this message. Assuming that indeed a logging server was compromised, we don’t know under which conditions the password hash is logged. Maybe it’s only people who used the web interface to log in, or only people who changed their master password, or people who hit a particular error condition.

Second: People only notice the failed login attempts. I don’t know what exactly this attack looks like, but I doubt that the point is triggering these alerts for as many people as possible. They rather want to log in successfully, meaning without any alerts being produced. Who knows how often this happened without anybody noticing?

Finally: We only know about people who were concerned enough about these alerts to write about it on Hacker News (or in some cases Twitter). That’s a tiny fraction of all LastPass users.

Post reply on HN