Slashdot Mirror
LastPass Vulnerable To Extremely Simple Phishing Attack (softpedia.com)
An anonymous reader writes: Security researcher Sean Cassidy has developed a fairly trivial attack on the LastPass password management service that allows attackers an easy method for collecting the victim's master password. He developed a tool called LostPass that automates phishing attacks against LastPass, and even allows attackers to collect password vaults from the LastPass API.
I read through the details and this is pretty significant. It would help some if Lastpass switched to only using a native OS window rather than prompting for authentication within the browser, but it was demonstrated that even that isn't sufficient. This looks like a significant problem for Lastpass and any others with a similar UI.
For anyone who doesn't care to read the details, here's the crux of the problem:
Lastpass prompts for the master password -within- the browser window. Any web page can easily pop up a pixel-perfect copy of the Lastpass login dialog, so users can't tell the difference. Once the attacker has the master password, they can download all passwords that the user has stored in Lastpass.
Systems like Lastpass are designed to keep passwords in an online repository and allow users to have different passwords for each service. In principle, this might actually be a better security model. However, it really isn't because it creates a single point of failure and provides a false sense of security. Keyloggers make it pretty easy to collect passwords from unsuspecting users who might not take security as seriously when Lastpass makes them feel secure. You're also placing your trust in the security of online repositories, which you have no way to audit. I'd actually rather have users reuse passwords across multiple services and be more aware of security than put their trust in a single point of failure that's a prime target for attacks. There's also potentially a lot more damage to clean up when a service like Lastpass gets compromised than if users simply reuse a few passwords across multiple sites. Perhaps people ought to reuse a few passwords instead of putting their trust in a service like Lastpass.
Suggestions for alternative password managers that work on all the same platforms? So Linux would need to be included (meaning 1password is out), and iOS and Android as well.
I know there's keepass for the desktop, though I seem to recall the Linux client being a choice of either using some old file format or the Windows version on WINE, and don't know how it'd conveniently sync with a mobile.
Either you can remember a lot of passwords or you can't. If you can't, just use the same password everywhere. It's as effective as using a "master" password.
Everybody can write stupid comments, and nothing at all can stop them!
the cloud, that is....
sticky notes are more secure than the cloud...
Anyone know if there is a password manager similar to LastPass, but that you host and can run on your internal network only? My predecessor was clearly in love with lastpass and currently, every key to my IT kingdom exists on there, which I'm not entirely too fond of, especially now. It is kinda nice, but for my situation, I have absolutely no reason for it to be publicly accessible. I would love to run something like this on my own linux VM, hidden behind the safety of my firewall and my management VLAN. Does it exist or did I just give someone an idea that they'll turn into an enterprise software package and make millions?
Switching to 2 form factor will elevate any issues here
Use last pass with 2 factor authentication and these issues go away
Something about 'online' password managers really irks me. I've tried lastpass before but didn't really trust it and the plugins became more annoying than useful. So, I switched to keepass and just sync that file on my cloud storage. It's much easier to manage imo and I can use it both on my android and my computer for free.
I laughed when I went to his page and saw the description of the attack. We were timesharing on a B5500 at a major university and found the way to find active but un-logged in terminals and take control. When the login sequence was keyed in, we'd pop up a page identical to the proper login screen and ask for credentials. We'd write to a file, post the proper user ID but a wrong password to the system, and disconnect. The system would reply with the standard wrong password prompt, and the user would figure they just fat fingered the password and was none the wiser. We collected user IDs and passwords of nearly 90% of the people on the system, before we chickened out and deleted the application and the database. I don't think the system folks ever knew it happened.
I switched back to FF about 6 months ago. Chrome for me, started slowing down.
Hackaday was forever working on some "mooltipass" hardware/software/iso7816 card password box thing. The website is too convoluted for my short attention span to understand if it is a product now available for purchase or not. Update... I tried my hardest to focus and I guess they are $130. Meh. If you are a rich b*h or a OSX user (same?), I suppose. It seems like a pretty cool option though.
LastPass Da Do Run Run Run away from this.
This is just "if you can take control, you can get them to enter their password". No shit sherlock.
The way Lastpass implements 2-factor, it actually makes the hack EASIER.
I always believed that people who use LastPass are, plain-and-simple, just idiots with no understanding of good security practices, glad to see I've not been disappointed. I would never use such a service, just too many unknowns around who really holds or can access your passwords.
Google Authenticator etc. is the way to solve these kinds of issues with multi-factor auth.
The blog entry in which the guy describes the attack has a screenshot of the attack in Firefox. The screenshot also includes a legitimate Lastpass dialog, showing that the fake looks -exactly- like the real Lastpass dialog.
The thing is, the browser can draw something that looks exactly the same as an OS dialog, and it can be dragged around just like the OS dialog. The difference shows up only if you minimize the browser, or already have the browser window small and you then try to drag "the Lastpass" dialog far enough that it's no longer "in front of" the browser window.
If you have physical access to the terminal, eventually you can come up with a system to defeat almost all security.
Here's the response from LastPass:
https://lastpass.com/support.p...
(I think this link should be in the main summary for balance)
As for Google Chrome, LastPass asks that you star Issue 39511 for extension infobars outside the DOM. Specifically here's LastPass asking for improvement in Chrome January 12th, 2012:
https://code.google.com/p/chro...
I am NOT affiliated with LastPass.
Check out the Firefox screenshot that the researcher included. On Firefox the fake dialog still looks exactly like the legitimate dialog. It looks just like an OS window that has popped up in front of the browser window. You'd only know something was amiss if you tried to drag out to a different part of the desktop so it was no longer "in front of" (actualy within) the browser.
Yes I'm laughing at all you LastPass users. You said LastPass employees care about security, they do everything properly, they won't get hacked, it's safe to store everything with a single 3rd party. And yet a very simple and extremely old phishing attack can completely compromise your account.
Though to be a little fair, its mainly the browsers' fault for pushing everything to be HTML based.
In other words business as usual
Slashdot requests a password in the browser, but it's not affected the same way. First, Lastpass throws up a password prompt ON OTHER WEB SITES. You wouldn't enter your banking password on Slashdot.org. However, if Lastpass stores your bank Slashdot password, Lastpass will pop a dialog on Slashdot. You'll then enter your master password into "Lastpass" while you're on Slashdot. With any web-based service, you'd enter your password only on the legitimate site. Lastpass users enter their master password on arbitrary sites.
Secondly , getting the user to enter their ONE Lastpass master password allows the attacker to retrieve ALL of the passwords, for all other sites. So if you use Lastpass, an XSS attack against Slashdot would reveal your banking password.
RTFA or even comments. It's not about user ignorance. there is no way for anyone to detect a pixel-perfect copy of a login page that has no URL.
Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion. -- Spazmania (174582)
I've used it for a while and only ever seen Lastpass ask for login details when the browser is first opened, not in the middle of a browsing session, so the timing of it would give away that it's a fake.
It's still a good attack, easy enough to have a quick brain fart and type creds into such a window.
There is an idle logout setting, if you need that enabled then would be more vulnerable to this as you would have login windows popping up during normal browsing.
"login to LastPass account fails, but it still gives you access to stored credentials." http://blog.digitalbabylon.eu/...
I just store all my passwords in a VeraCrypt volume.
Physical access was not actually (definitely) implied.
We did similar in late 80s on unix / X-Windows boxen - the uni had set them up with a nifty graphical login because command line was so-last-year, but no security (standard in those days) on the X display connections. All you needed was a program that showed the same password prompt window and grabbed the username/pw. Even when display security was added it was bodged so any "local" process could connect to :0, and anyone could remote into any workstation any time...
I'm sure later years of students had the same fun with xdm (which was eventually implemented IIRC) and xspy, but by then we'd moved on to popping up (half-tone or ascii art) topless pictures on unsuspecting colleagues' workstations, preferably when lecturer / supervisor was behind them.
It was all good learning, but seems as an industry as a whole, we never learn and the old tricks still work...
https://lastpass.com/support.p...
It seems they've turned on email confirmation even for users with 2FA, along with a couple of other in-browser measures.
This was entirely software-based. We didn't need physical access to the terminals. There was a pre-processor unit that multiplexed the terminals to a machine that was basically designed to be a batch-processing machine. This is where we were able to intercept the session.
As may know, most small security applications have not been reviewed by someone truly qualified. Issues like what we see here with Last Pass are commonplace. It is very likely, almost certain, that you missed -something- when you developed your software.
If you haven't already, or maybe even if you have, I strongly suggest spending a couple hundred dollars to have another set of experienced eyes review your code. If your application is relatively simple, it probably wouldn't take more than a couple of hours for someone to review it and point out any points of concern.
As may know, most small security applications have not been reviewed by someone truly qualified. Issues like what we see here with Last Pass are commonplace. It is very likely, almost certain, that you missed -something- when you developed your software. In fact, according to the little bit of text on your web site, you've made a grave mistake. Whoever wrote the text on the web site doesn't understand some basics of security, so if the same person who wrote the web site copy also designed the code, you have a problem.
If you haven't already, or maybe even if you have, I strongly suggest spending a few hundred dollars to have another set of experienced eyes review your code and design. If your application is relatively simple, it probably wouldn't take more than a few hours for someone to review it and point out any points of concern.
If the user uses ANY customized desktop theme on Windows, these pop-ups are going to look totally alien to the user.
Finally, a valid use for the Windows Classic theme.
" but seems as an industry as a whole, we never learn and the old tricks still work" too true; I blame the PHB who want stock dividends and profits over long-term security and see IT as a money sink that the newest buzz words will magically fix.
Ah. I did something similar in the early 90's when my high school got their first LAN. You could control-break out of the login script and get dropped into a prompt that had read access to the login paths. Re-wrote the script to "error out" and prompt for the teachers login again and wrote it to the local drive...it was only a matter of time before we had multiple credentials. We found the software they had bought also came with an internal BBS / posting board that they never implemented...much fun was had and the faculty never noticed it at all.
The problem with regenerating a hash every time you choose to log in to a particular site is that sites' minimum and maximum length and complexity for user passwords varies so widely. It would have to store the length, set of permitted characters, and set of required characters for each site.
Don't use chrome for anything except for its development tools which do excel at testing and hacking web pages.