LastPass autofill exploit

#1

Post by detectify » Wed, Jul 27, 2016, 9:38 AM UTC

LastPass autofill exploit
labs.detectify.com

Re: LastPass autofill exploit

#2

Post by diziet » Wed, Jul 27, 2016, 9:56 AM UTC

To my best knowledge LastPass comes with Autofill disabled by default on at least Chrome (or I was paranoid enough to turn it off myself)

Re: LastPass autofill exploit

#3

Post by pbininda » Wed, Jul 27, 2016, 9:58 AM UTC

If I read this article correctly, the headline should actually be: How I made LastPass give me all MY passwords

Update: after a few answers to my badly thought through comment, I now feel enlightened. The attack scenario is a malicious web site which can gobble up my passwords. Thanks

Re: LastPass autofill exploit

#4

Post by viraptor » Wed, Jul 27, 2016, 10:00 AM UTC

It looks like there's more interesting stuff coming in soon: https://twitter.com/taviso/status/758074702589853696

(to save a click: Tavis Ormandy: "Are people really using this lastpass thing? I took a quick look and can see a bunch of obvious critical problems. I'll send a report asap.")

Re: LastPass autofill exploit

#5

Post by avolcano » Wed, Jul 27, 2016, 10:01 AM UTC

I'm generally very sympathetic to regex bugs (especially in a language like JavaScript where you don't get nice expanded multiline regexes with comments), but I am wondering why they went with a regex in the first place. Did they decide `document.location.host` was too brittle for some reason?

Re: LastPass autofill exploit

#6

Post by viraptor » Wed, Jul 27, 2016, 10:03 AM UTC

pbininda wrote: post #3

If I read this article correctly, the headline should actually be: How I made LastPass give me all MY passwords Update: after a few answers to my badly thought through comment, I now feel enlightened. The attack scenario is a malicious web site which can gobble up my passwords. Thanks

This is just a PoC. Now imagine that the author instead:

1. Writes up that post.

2. Inserts an iframe in the post, which enumerates known sites. (hidden out of view with css tricks)

3. Instead of alerting on screen, sends the results back to their server.

4. Submits to HN.

Re: LastPass autofill exploit

#7

Post by raverbashing » Wed, Jul 27, 2016, 10:03 AM UTC

Was this an issue with the browser extension?

How (and how often) are updates pushed to the client?

Re: LastPass autofill exploit

#8

Post by martin-adams » Wed, Jul 27, 2016, 10:06 AM UTC

pbininda wrote: post #3

If I read this article correctly, the headline should actually be: How I made LastPass give me all MY passwords Update: after a few answers to my badly thought through comment, I now feel enlightened. The attack scenario is a malicious web site which can gobble up my passwords. Thanks

My interpretation is. How I could create a web page that give ME all the commonly used site's passwords for ANY last pass visitor who has autofill enabled.

So no, I don't think it will only give you your own passwords.

Re: LastPass autofill exploit

#9

Post by zaxomi » Wed, Jul 27, 2016, 10:09 AM UTC

pbininda wrote: post #3

If I read this article correctly, the headline should actually be: How I made LastPass give me all MY passwords Update: after a few answers to my badly thought through comment, I now feel enlightened. The attack scenario is a malicious web site which can gobble up my passwords. Thanks

If you where using LastPass, and visited any page controlled by an attacker on any domain, they could get your passwords to all sites that they tested for, for example twitter, gmail etc.

Re: LastPass autofill exploit

#10

Post by serf » Wed, Jul 27, 2016, 10:12 AM UTC

diziet wrote: post #2

To my best knowledge LastPass comes with Autofill disabled by default on at least Chrome (or I was paranoid enough to turn it off myself)

it's a suggested default by the LP installer to disable whatever browsers' built-in password manager.