Slashdot Mirror
LastPass Bugs Allow Malicious Websites To Steal Passwords (bleepingcomputer.com)
Earlier this month, a Slashdot reader asked fellow Slashdotters what they recommended regarding the use of password managers. In their post, they voiced their uncertainty with password managers as they have been hacked in the past, citing an incident in early 2016 where LastPass was hacked due to a bug that allowed users to extract passwords stored in the autofill feature. Flash forward to present time and we now have news that three separate bugs "would have allowed a third-party to extract passwords from users visiting a malicious website." An anonymous Slashdot reader writes via BleepingComputer: LastPass patched three bugs that affected the Chrome and Firefox browser extensions, which if exploited, would have allowed a third-party to extract passwords from users visiting a malicious website. All bugs were reported by Google security researcher Tavis Ormandy, and all allowed the theft of user credentials, one bug affecting the LastPass Chrome extension, while two impacted the LastPass Firefox extension [1, 2]. The exploitation vector was malicious JavaScript code that could be very well hidden in any online website, owned by the attacker or via a compromised legitimate site.
......your local 3-letter government agency.
also, first post!
I am surprised that anyone serious about security would ever install a web browser password plugin for their password management software. It seems logical that it is just a bug away from password compromise.
Don't use an online password manager. Copy and paste your password when needed, then clear the clipboard. It's not perfect, but I'll take mSecure over some of these other password managers any day. And I don't back up my passwords in the cloud. They're encrypted on an SD card.
Has simply never been hacked.
Comment removed based on user account deletion
Comment removed based on user account deletion
Nobody has to hack YOU, they hack the website you log into and download all their passwords then just keep trying those password/username combinations on other websites until they crack another one over and over again. You individually aren't worth much other than a shim to try to break into the next web server. Your accounts could be shared all over Russian hacking circles and you'd never know until the website you use reports a break in that might include your login.
Smug people are just victims who don't know it yet.
The exploits mentioned weren't closed based, but locally in the browser though?
Change is certain; progress is not obligatory.
This is the sort of thing why I've never let any sort of browser thing do autofill. I have a password manager on my phone and when I need to, I look it up and *type* it in. A minor nuisance, but for frequently used passwords, I then don't need it as I actually remember them. The others are by definition infrequently used.
Though I have to admit, it's the most used feature of my phone. It also means I don't have to worry about synchronizing across many different browsers and computers, or the lack of security having all that in multiple places.
Bugs have already been patched. Stop with the FUD please. Yea it's bad they existed, but they're gone.
"Oh my God. This is terrible. This is the end of my Presidency. I'm fucked."; ~ Donald J. Trump
As i said, Variations. I know a few of the black hatters. and that's now how they work. now if there was a large dump they would run the credentials at a few sites(would effect me none) that they want to gain access to. and it is completely about personal info. in case you didn't know and want to do some research sometime before you talk to somebody that used to be involved. the personal information is the part that's worth money. the trying user/pass to other sites is to get MORE personal info. like credit card number zip expiration and CCV. So next time you want to talk blackhat i suggest you select your target better.
Looks like they already patched it.
Using 1337speak does very little in making your password safer.
It's a question of how fast you can build a wall before someone tears a hole though it. Security is only temporary.
To you, the douchebag that said use password manager or your will be hacked. I have been using the same formula for generating passwords for almost 2 decades and I have not had any issues. Enjoy your increased threat level by using additional software to store your password. You almost convinced me.
I know of companies (perhaps even my current) which recommends people use LastPass over KeePass/KeePassX. The fact that they recommend a person use a password generator is good, but anything in the Cloud means that you _DO_NOT_ have physical control of the system storing passwords. The First rule of security is that you must have physical control of everything. All other Security rules come after that one.
The Company problem is a symptom of promoting "marketing geniuses" and "number crunchers" to be in charge of Security, instead of promoting Security geniuses to be in charge of Security. As a security expert I have some great horror stories about bad decisions, and can tell you that stock options are constantly ready to be sold.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
The three articles you posted were all about what Lorrie Cranor said, but you seem to misunderstand what she said. Cranor did NOT say that it's a bad idea to change YOUR password.
What Cranor said is that there are downsides to forcing everyone to change their password every month or so.
People will not remember a new password every month, so if forced to "change" it monthly they'll either write it on a Post-It note or just use [password]1, [password]2, [password]3, etc, not really changing the password, Cranor said. She's not wrong - there absolutely is a limit to how *often* you should *force* people to change their password.
Also, leaks happen, leaks with millions of accounts, so you will be safer if you change your password *ocassionally*. I use a system in which I can change my password 6-12 months, without having to remember a new password. Another fact about passwords is that the safe length for a password keeps getting longer - I now normally call it a "pass phrase". When I started in security, an eight-character password was considered secure. So what I do is every so often I add a couple characters to my base password.
Imagine in 1998 maybe I could have used "pallFurt" as my base password. In 2000 I'd start using "pallFurt!?". In 2002, "4pallFurt!?". In 2004, "4pallFurt!?Dh". So I don't have to remember something completely different each time, but password changes, meaning dumps from old sites don't have my current password (besides it's slightly different for each site).
Desk drawer? I'm writing on post-its and sticking them all around my monitor.
#DeleteFacebook
I too have a password I've used over ten years.
I only use this for low security accounts that don't have any financial implications associated to them. But yes, that password got hacked.
I know this because I typed it into a 'has your password been hacked' site and it said yep, and told me what had happened. These sites exist because lists of passwords that have been hacked exist.
IRC I think it got cracked on yahoo or something; it wasn't like anything I'd done wrong.
-WolfWithoutAClause
"Gravity is only a theory, not a fact!"depending on the words you use it will fool almost all password list files, and bruteforce becomes a lot harder with multiple numbers letters lengths capitols and special characters.
Passwords are easy. variations of a few passwords works. and when it comes to brute force, length and numbers capitol and special characters add a lot of time to that process. years on current hardware. password managers are a bad idea because of being hacked and like articles say people are lazy. it defaults to ease over security so there is really no argument here. if you dont want to be hacked because of silliness like this dont be an incompetent fool when it comes to security. i dont have this problem i'm just trying to help people see the issue.
I know this because I typed it into a 'has your password been hacked' site and it said yep
Thanks for the great laugh before bed. thanks for adding your password to a password file that a few, probably not many have. but those people are not fools. Please do not do that ever again. lol
Correction, ONLINE password managers are a bad idea. I don't think there is anything wrong with OFFLINE password managers. For instance, I use KeyPass, and it keeps the password vault file encrypted on my HDD. That file can get backed up locally and to the cloud in an already encrypted state so that [CloudProvider] can't access the file.
correction: KeyPass = KeePass
FYI, on Twitter, someone asked Ormandy what was the best password manager. His reply was "KeePass or KeePassX are both perfectly reasonable choices." Source: https://twitter.com/taviso/sta...
Okay, I'll admit it, I'm the maker of a lesser known password manager that has been around for ages. The weakest part is the operating system's handling of the clipboard - there is no OS-level support for clipboard wiping and no guarantee that sensitive data isn't written to disk. Moreover, there is generally not enough protection against keystroke loggers, who are the #1 method for obtaining the master passphrase.Apart from these obvious vulnerabilities against which I cannot do anything, my application works fine, is cross-platform, has high data integrity and is fairly secure, primarily because it stores everything locally, validates every file written to disk, uses standard encryption libraries and does not use the browser at all.
But here's the catch: There really is no need for a password manager at all. What's important is to use a random password generator. You can then store your passwords in a text file on an encrypted disk image, which is more convenient and easier to use than the vast majority of password managers out there.
As for password managers that use the 'cloud' or browser extensions, in my opinion they're mostly crap and #1 hacking targets anyway.
I am surprised that anyone serious about security would ever install a web browser password plugin for their password management software. It seems logical that it is just a bug away from password compromise.
Oh I agree. I think people have been recommending password managers despite the, "all your eggs in one internet connected basket" thing.
Unfortunately there aren't many options. All I can think of is an air-gapped encrypted tablet whose sole purpose is to keep passwords. And then physically typing them.
Which makes the bunch of random words the much more attractive way; easy to read and type.
I can see if your bank account has been hacked for you. Just send me the account number, routing number, and your name, address and SSN and I'll let you know in my own special way ASAP!
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
Why would anyone with even pretensions of being a geek link their password manager to a browser, beyond the two applications sharing the same OS install? I've been using a password manager for years, and it would NEVER have occurred to me to make it easy for my browser to access it directly. I don't consider myself terribly security conscious; but dangling a LOT of low-hanging fruit in front of would-be attackers was just never even on my radar. Goes without saying that the first thing I did when browsers introduced 'remember passwords' was to turn the damned thing off.
Security and convenience will always be at odds. But most people who don't have alarm systems will at least lock up their houses and cars. When it comes to The Interwebs, they should also go at least that far.
'The Economy' is a giant Ponzi scheme whose most pitiable suckers are the youngest among us and the yet-unborn.
Ok thats a bit safer, but still not fully. You have to always assume your pc has been hacked. Anything on that pc is up for grabs, as soon as keepass unencrypts in memory, and has all your passwords there while it chooses which one it needs, or if it only pulls the one and decrypts it. i can still use a memory leak exploit thats in almost every piece of software for windows, and now i still have the password you were trying to hide and keep secure. passwords themselfs are inherently insecure. thats why the security field is trying to get rid of them. as far as practice goes. i would say offline encrypted passwords is second to using your brain as the vault. but i hope everybody learns from this and stops using online password managers.
It is spelled KeePass.
-- ssoorrrryy,, dduupplleexx sswwiittcchh oonn.. -Quote found on actual fortune cookie.
To me, the scariest part of the numerous vulnerabilities report is not the bugs themselves, but rather the response that LastPass had to project-zero #1209. See Comment #4 at https://bugs.chromium.org/p/pr... : "[LastPass] also said they couldn't get my exploit to work, but I checked my apache access logs and they were using a Mac. Naturally, calc.exe will not appear on a Mac." If this is the level of scrutiny that LastPass is putting into its security incidents, I'm losing confidence in their ability to safeguard user data.
One thing LastPass will do for you that the copy/paste solutions won't is that LastPass will not autofill your wellsfargo.com credentials into a login page at wallsfergo.com. (Substitute less obvious domain-squatting combination.) For the even slightly security-aware, the "no domains match" is a speedbump between you and total pwnage.
You know what? You're not nearly as smart as you think you are. I first typed in random 'passwords' that weren't my LOW security password, and it said that those hadn't been hacked. And I didn't type in any of my high security passwords, and those are different on each site anyway, so there wouldn't be any point.
"Use a few passwords and variations of those. add caps and exchange letters for numbers aka "l33t"
Hahaha. Don't do that, moron.
-WolfWithoutAClause
"Gravity is only a theory, not a fact!"Bruce Schneier disagrees with you.
Note that online password managers use your password to encrypt the list of passwords, and then they back that up for you to the cloud. It's the self-same process you use, and has the same vulnerabilities.
-WolfWithoutAClause
"Gravity is only a theory, not a fact!"> You have to always assume your pc has been hacked.
LOL. You can't polish a turd. If your PC is hacked they can grab your password as you type it in anyway, so using an online password storage makes no material difference to security as opposed to using your brain, but the online security is much more convenient, and the online stored passwords are much longer and more random, whereas you've admitted that your passwords are total shit.
-WolfWithoutAClause
"Gravity is only a theory, not a fact!"yes. 8-16 character passwords with upper lower numbers and special characters is shit. I'm glad you know my passwords. as ive said before. I dont worry about it because i use strong passwords and dont open myself up to attack vectors that are poorly protected. it seems like alot of people do so im trying to help people learn good practice. online password managers, as this example shows is not good practice. And it depends on what kind of infection your pc may have, if their payload doesnt include a keylogger, and alot dont. it can only pull your passwords from programs like steam and chrome and edge and wotnot. i used to be one of the people that did such activitys. but apparently nobody here wants to hear from somebody with experience on the other side of the fence. and people wonder why this world is turning to shit. you obviously know more about everything than i do. so please do tell.
Well than your "low security" passwords were probably commonly used. i know mine arent and i dont worry. im trying to give people advice from an ex black hat. I try to help now, but MOST of those "is your pasword hacked" lists are nothing but a honeypot for more passwords. the only trust worthy ones are the ones that you enter the username and if its in a dump it will show you your password. and theres not many of those. take it how you will. but putting a password into the wild to "see if it was stolen" is a very bad idea. did the site even use SSL or did they transfer your passwords in plain text??
Didn't matter a lot. Maybe it was a honeypot, maybe it checked a whole bunch of sites in a man in the middle attack- but I DIDN'T type in my username, so they would have had to check all the lists of millions of entries and do it very quickly, so I don't think so. And it listed out which breach it was, and it matched up. And I think it used a rainbow table for checking it, so they (allegedly) weren't sending my password in the clear.
It makes little difference, I didn't give a shit about any of the accounts, and I changed them all using LastPass to random 16 mixed character passwords.
-WolfWithoutAClause
"Gravity is only a theory, not a fact!"as i said if it was a honeypot, your password went into a password list. and there are some very sophisticated honeypots out there. i have a friend setting one up for whitehat purposes and you cant tell it from a real machine. it even lets you ddos from it. the fact of the matter is that password managers aren't a good idea. local encrypted ones are better, but the best is using strong memorable passwords. its harder for some people than others. i dont have an issue with it. im just trying to help people
LOL you still don't seem to hear or understand- LastPass's passwords are specifically being stored FOR steam and chrome and edge etc- if your web browser is sufficiently subverted, the game is lost anyway.
-WolfWithoutAClause
"Gravity is only a theory, not a fact!"Memorable passwords are usually not secure, particularly if you reuse those passwords in any way, and swapping characters, and replacing letters with numbers are really stupid things to do, since they are trivially easy to brute force. Then if you lose any account, they're likely all blown.
-WolfWithoutAClause
"Gravity is only a theory, not a fact!"