Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass autofill exploit

labs.detectify.com

Post reply on HN
Print view View original

71–80 of 443 posts

Re: LastPass autofill exploit

#71

Post by mabcat »

SaturateDK wrote: post #61
crdoconnor wrote: post #60

Earlier quoted context omitted.

Exactly this. I'm abandoning them now.

I want an alternative, got a good one?

I switched to 1Password after Lastpass got acquired. I obviously have no special knowledge how secure it is but it's serving me well. OSX browser integration excellent, iOS integration mediocre.

Re: LastPass autofill exploit

#72

Post by K0nserv »

zaroth wrote: post #69
mcs wrote: post #12

Please correct me if I am mistaken, but couldn't this have been implemented into an iframe that when ran could send the passwords to another remote server? If so, I am a little taken back by LastPass only offering $1,000 to the researcher that found and reported it for fixing. He or she could have taken a different path and resulted in this being used in some complex targeted attack against tech corporations via shor…

Normally I like bike shedding about bug bounty payouts just about as much as complaints about paywalls. If you are going to go poking around someone's code for fun or profit, the terms of the bounty program are readily available [1] so you can't complain after the fact for earning the maximum payout. LastPass isn't Facebook, and they never claimed they would pay more than $1,000 even for a full compromise or RCE. On…

The concern with the low payout is that it's supposed to be a way to compensate white hat hackers and dissuaded them from going to the black market with security problems like this. Given the business that LastPass is in wouldn't you agree that it's extremely crucial they make sure white hat hackers are aptly compensated for serious problems they find? In fact I'd think it'd be reasonable for them to pay more than Facebook for certain classes of bugs(like this one). After all all your passwords are more valuable than your Facebook account.

Re: LastPass autofill exploit

#73

Post by thruflo »

avlidienbrunn2 wrote: post #29
mcs wrote: post #12

Please correct me if I am mistaken, but couldn't this have been implemented into an iframe that when ran could send the passwords to another remote server? If so, I am a little taken back by LastPass only offering $1,000 to the researcher that found and reported it for fixing. He or she could have taken a different path and resulted in this being used in some complex targeted attack against tech corporations via shor…

At the time I submitted this, they didn't even have a bug bounty. Considering that, I think $1,000 is great :)

Perhaps LassPass users might like to donate to show their gratitude -- after all, you just protected an awful lot of people's passwords.

Have you got a mechanism you could post here for them to do so?

Re: LastPass autofill exploit

#75

Post by Alpacalex »

SaturateDK wrote: post #61
crdoconnor wrote: post #60

Earlier quoted context omitted.

Exactly this. I'm abandoning them now.

I want an alternative, got a good one?

If you're using a *nix system: https://www.passwordstore.org/ I switched over from LastPass a few months ago. It uses gpg for encryption and supports git for password syncing between systems. Pretty simple to set up and use. There are quite a few third party apps for it already (both desktop and mobile)

Re: LastPass autofill exploit

#76

Post by jrockway »

mcs wrote: post #12

Please correct me if I am mistaken, but couldn't this have been implemented into an iframe that when ran could send the passwords to another remote server? If so, I am a little taken back by LastPass only offering $1,000 to the researcher that found and reported it for fixing. He or she could have taken a different path and resulted in this being used in some complex targeted attack against tech corporations via shor…

Let's do a little calculation to see if the payout is worthwhile.

Using something illegally means you run the risk of going to prison. Let's say there's a 1% chance you get caught, the prison sentence is 10 years, and the evil hackers will pay you $20,000 for your bug. Let's also say that you're a mid-career software engineer in the US, and over the next 10 years you expect to make $2M (after taxes).

This means your expected outcome over 10 years is $20,000 + (0.99 * $2M) = $1.98M. With Lastpass's bounty you end up with $2.001M.

With these assumptions, you should be paying Lastpass to find bugs in their software! Of course, if you're not in the US, you probably make a more reasonable salary (read: less), taxes are higher, and the risk of getting caught is lower.

Re: LastPass autofill exploit

#78

Post by giuscri »

Could someone explain me better the posted code that was vulnerable? I don't understand it. What's the returned value?, what is URL and url?, why the extension is expecting there must be a @ inside the url?

Thanks! :-)

Re: LastPass autofill exploit

#79

Post by teekert »

jrockway wrote: post #76
mcs wrote: post #12

Please correct me if I am mistaken, but couldn't this have been implemented into an iframe that when ran could send the passwords to another remote server? If so, I am a little taken back by LastPass only offering $1,000 to the researcher that found and reported it for fixing. He or she could have taken a different path and resulted in this being used in some complex targeted attack against tech corporations via shor…

Let's do a little calculation to see if the payout is worthwhile. Using something illegally means you run the risk of going to prison. Let's say there's a 1% chance you get caught, the prison sentence is 10 years, and the evil hackers will pay you $20,000 for your bug. Let's also say that you're a mid-career software engineer in the US, and over the next 10 years you expect to make $2M (after taxes). This means your…

Is it still illegal when Lastpass actually stimulates you financially to pry into their systems?

Re: LastPass autofill exploit

#80

Post by Xylakant »

gourou wrote: post #67
SaturateDK wrote: post #61

Earlier quoted context omitted.

I want an alternative, got a good one?

Work on your memory, it's very hard to hack.

That's a very bad recommendation. Very few people are capable of remembering unique 10-character passwords for each site. I have like 100 passwords and accounts for various systems and I'm certainly not able to remember each of them. So either I start reusing passwords or I use a password manager.
Post reply on HN