Slashdot Mirror
LastPass Vulnerable To Extremely Simple Phishing Attack (softpedia.com)
An anonymous reader writes: Security researcher Sean Cassidy has developed a fairly trivial attack on the LastPass password management service that allows attackers an easy method for collecting the victim's master password. He developed a tool called LostPass that automates phishing attacks against LastPass, and even allows attackers to collect password vaults from the LastPass API.
I read through the details and this is pretty significant. It would help some if Lastpass switched to only using a native OS window rather than prompting for authentication within the browser, but it was demonstrated that even that isn't sufficient. This looks like a significant problem for Lastpass and any others with a similar UI.
For anyone who doesn't care to read the details, here's the crux of the problem:
Lastpass prompts for the master password -within- the browser window. Any web page can easily pop up a pixel-perfect copy of the Lastpass login dialog, so users can't tell the difference. Once the attacker has the master password, they can download all passwords that the user has stored in Lastpass.
Everybody can write stupid comments, and nothing at all can stop them!
Either you can remember a lot of passwords or you can't. If you can't, just use the same password everywhere. It's as effective as using a "master" password.
Putting 2fa on the vault seems like a sane thing to do... Also it's fewer places that can leak your "master" password... Ie. only lastpass has your master password, so it's only if they get compromised that it is leaked.. .And they hopefully hash passwords properly... Can't say I believe every other random site hashes passwords correctly.
Also once the browser session is authenticated you shouldn't need to do lastpass again, right?... So you type your master password fewer times.
Honestly, I've been planning to move to password manageing system... like lastpass. It doesn't magically fix all attack vectors, but reduces a lot.
Either you can remember a lot of passwords or you can't. If you can't, just use the same password everywhere. It's as effective as using a "master" password.
Putting 2fa on the vault seems like a sane thing to do... Also it's fewer places that can leak your "master" password... Ie. only lastpass has your master password, so it's only if they get compromised that it is leaked.. .And they hopefully hash passwords properly... Can't say I believe every other random site hashes passwords correctly.
Also once the browser session is authenticated you shouldn't need to do lastpass again, right?... So you type your master password fewer times.
Honestly, I've been planning to move to password manageing system... like lastpass. It doesn't magically fix all attack vectors, but reduces a lot.
^ This. I have 2FA on my email and on lastpass. Email and LastPass both have separate passwords. I also have 2FA on the banks I care about. I also receive instant text/email about significant transactions.
Every site has its own, extremely complex unique password. Most of the sites I really care about also require email confirmation of any security-significant changes.
So to really do anything with my accounts, you need all of my lastpass passwords, my 2FA for email, my email password, and you have to do it in such a way that I won't notice (either receiving the email notifications or losing access to my email) before I can stop you.
I'll call this "good enough"
I also click on the lastpass icon to login... not sure how anyone could fake the login modal coming out of the extension like that. I'm guessing this doesn't apply to me because I'd hit cancel and go to my normal method.
SWM seeks new sig for a brief fling
I laughed when I went to his page and saw the description of the attack. We were timesharing on a B5500 at a major university and found the way to find active but un-logged in terminals and take control. When the login sequence was keyed in, we'd pop up a page identical to the proper login screen and ask for credentials. We'd write to a file, post the proper user ID but a wrong password to the system, and disconnect. The system would reply with the standard wrong password prompt, and the user would figure they just fat fingered the password and was none the wiser. We collected user IDs and passwords of nearly 90% of the people on the system, before we chickened out and deleted the application and the database. I don't think the system folks ever knew it happened.
keepass is cross platform, using the same file on Linux/Win/Android/MacOS. You can store the encrypted database in a cloud-based service like dropbox and have a highly portable system for password storage on-line & off-line.
That's what I do. For added security, I have a key file that I never put online and only stored locally on my laptop/phone. That way, even if someone gets my database AND somehow intercepts my password they're still out in the cold.
KeeCloud is a good place to start. Then just pick a browser integration plugin and you're off. For android, Keepass2Android is a good choice, too. It has an integrated keyboard that will directly type the username and password into the browser (or app) so you can avoid all those clipboard stealing exploits.
The way Lastpass implements 2-factor, it actually makes the hack EASIER.
The blog entry in which the guy describes the attack has a screenshot of the attack in Firefox. The screenshot also includes a legitimate Lastpass dialog, showing that the fake looks -exactly- like the real Lastpass dialog.
The thing is, the browser can draw something that looks exactly the same as an OS dialog, and it can be dragged around just like the OS dialog. The difference shows up only if you minimize the browser, or already have the browser window small and you then try to drag "the Lastpass" dialog far enough that it's no longer "in front of" the browser window.
If you have physical access to the terminal, eventually you can come up with a system to defeat almost all security.
Here's the response from LastPass:
https://lastpass.com/support.p...
(I think this link should be in the main summary for balance)
As for Google Chrome, LastPass asks that you star Issue 39511 for extension infobars outside the DOM. Specifically here's LastPass asking for improvement in Chrome January 12th, 2012:
https://code.google.com/p/chro...
I am NOT affiliated with LastPass.
Check out the Firefox screenshot that the researcher included. On Firefox the fake dialog still looks exactly like the legitimate dialog. It looks just like an OS window that has popped up in front of the browser window. You'd only know something was amiss if you tried to drag out to a different part of the desktop so it was no longer "in front of" (actualy within) the browser.
Slashdot requests a password in the browser, but it's not affected the same way. First, Lastpass throws up a password prompt ON OTHER WEB SITES. You wouldn't enter your banking password on Slashdot.org. However, if Lastpass stores your bank Slashdot password, Lastpass will pop a dialog on Slashdot. You'll then enter your master password into "Lastpass" while you're on Slashdot. With any web-based service, you'd enter your password only on the legitimate site. Lastpass users enter their master password on arbitrary sites.
Secondly , getting the user to enter their ONE Lastpass master password allows the attacker to retrieve ALL of the passwords, for all other sites. So if you use Lastpass, an XSS attack against Slashdot would reveal your banking password.
Keep /home on luks, use a screen locker, and configure LastPass to remember the master password. It will tell you that's less secure. Yeah, for less likely attacks - spoofing predictable chrome has been around for more than a decade. x11 apps can already steal your passwords, so minimizing keyboard input of them is important until Wayland.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)