Slashdot Mirror
Severe Vulnerabilities Uncovered In Popular Password Managers (zdnet.com)
chiefcrash shares a report from ZDNet: Independent Security Evaluators (ISE) published an assessment on Tuesday with the results of testing with several popular password managers, including LastPass and KeePass. The team said that each password management solution "failed to provide the security to safeguard a user's passwords as advertised" and "fundamental flaws" were found that "exposed the data they are designed to protect."
The vulnerabilities were found in software operating on Windows 10 systems. In one example, the master password which users need to use to access their cache of credentials was stored in PC RAM in a plaintext, readable format. ISE was able to extract these passwords and other login credentials from memory while the password manager in question was locked. It may be possible that malicious programs downloaded to the same machine by threat actors could do the same. The report has summarized the main findings based on each password management solution. Here's what ISE had to say about LastPass and KeePass -- two of the most popular password managers available:
"LastPass obfuscates the master password while users are typing in the entry, and when the password manager enters an unlocked state, database entries are only decrypted into memory when there is user interaction. However, ISE reported that these entries persist in memory after the software enters a locked state. It was also possible for the researchers to extract the master password and interacted-with password entries due to a memory leak."
"KeePass scrubs the master password from memory and is not recoverable. However, errors in workflows permitted the researchers from extracting credential entries which have been interacted with. In the case of Windows APIs, sometimes, various memory buffers which contain decrypted entries may not be scrubbed correctly."
The vulnerabilities were found in software operating on Windows 10 systems. In one example, the master password which users need to use to access their cache of credentials was stored in PC RAM in a plaintext, readable format. ISE was able to extract these passwords and other login credentials from memory while the password manager in question was locked. It may be possible that malicious programs downloaded to the same machine by threat actors could do the same. The report has summarized the main findings based on each password management solution. Here's what ISE had to say about LastPass and KeePass -- two of the most popular password managers available:
"LastPass obfuscates the master password while users are typing in the entry, and when the password manager enters an unlocked state, database entries are only decrypted into memory when there is user interaction. However, ISE reported that these entries persist in memory after the software enters a locked state. It was also possible for the researchers to extract the master password and interacted-with password entries due to a memory leak."
"KeePass scrubs the master password from memory and is not recoverable. However, errors in workflows permitted the researchers from extracting credential entries which have been interacted with. In the case of Windows APIs, sometimes, various memory buffers which contain decrypted entries may not be scrubbed correctly."
Fuck lazy horse batteries.
Are there any decent USB stick based password vaults? Something that stores credentials internally and manages decryption after entering the master password. You’d still need to take care that the master password or decrypted credentials don’t linger in memory, but I’d feel better having the master data offline instead of having everything floating around in the cloud.
Even better would be an unlock pin (or fingerprint) to be entered on the USB stick itself.
If construction was anything like programming, an incorrectly fitted lock would bring down the entire building...
So security researchers are scraping the bottom of the barrel to such an extent that having access to program data when you have total control over a computers memory is a severe vulnerability now?
If I understand these two "vulnerabilities" properly, they require a piece of software installed/running locally which will steal/grab these passwords from RAM. However no normal/legitimate software will ever steal your passwords or access the RAM regions of other applications, which means this software is in essence malware which means you're already completely fucked and this software may just steal your master passwords, retreive all files, etc. etc. etc.
That's why I always use a yuge password: 1234abcd. It's a very good password. The best password, really.
Corruption is convincing someone that the selfless ideal is the same as their selfish ideal.
As long as the computer is off, it's also pretty secure in Lastpass and Keepass.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
That's why I keep my passwords on a sticky note on my monitor! Never trust the cloud!
Are you kidding? That's easy, don't use system fonts to display the password on-screen. It takes a bit of effort to create letters from graphic elements like lines and semi-circles but it's much safer (/-\ = A, etc). You could even randomize the angles and lengths of the line segments slightly (like a captcha) to prevent automated pattern recognition.
Support Right To Repair Legislation.
Apple? Thats all good right? And Linux? All good?
Domestic spying is now "Benign Information Gathering"
While true, that also means that it would have to wait until you actually copy/type the password in order to steal it, and there is still the task of identifying the password out of all the other data you copy or words you type through out the day.
Or, since you have access to the RAM, just snag it from the password manager whenever the process appears. Then you get all the passwords at once, along with usernames or other important info, and you don't have to sift through junk data to find them.
=Smidge=
Bruce Schneier, thank you for the fish!
The user is usually copying and pasting in the case of using a password manager, so the keyboard buffer will not have what you are looking for.
There are two types of attacks against systems like this.
1 where the attacker modifies the system, hopes the victim doesn't notice and then steals information when the victim next uses the system
2 where the attacker steals the system and then tries to extract information
These attacks are against the latter, where I steal your laptop and then try and extract your passwords from the running machine. If your password manager is open and unlocked, then I can trivially get your passwords, but if the manager has been closed, then these attacks could reveal your passwords.
I once tried to bid on writing the standard for Canadian Interac point of sale devices. The spec at the time failed to make this distinction.
I have a couple of schemes which I use for a lot of my passwords, but there are enough unique ones that I find Keepass extremely useful. Not to mention that I keep note of a bunch of other data and my kids' passwords there too. Also my wife could use it if she needed to if I get hit by a bus.
I've helped a bunch of people set up Keepass, and I have never seen the data disappear. But if you don't need it, your way is probably better!
Yes, of course. The good, old TLA infinite-budget porn.
Your position in the security food chain determines how much they are willing to spend. Even well-healed Q-class spooks answer to an ROI at scale.
Of course, part of the signal about your rung on the security food chain is determined by how effectively you armour yourself with effective prophylaxis.
This is why security culture can only work as a public good, wherein everyone on principle uses the highest caliber of security practical. When security is practiced exclusively on an as-needed basis, it only helps to paint a more accurate bull's eye on your backside.
All the TLAs must surely love the useful idiots who distract from the economic model that prevails here, by ranting at high pitch about naked capabilities, as there are no endemic constraints on their side of the fence.
The standard unix password manager is in many aspects more secure than the bloated ones: https://www.passwordstore.org/
- It is minimal. It is a short bash script, that you can read completely before using it.
- It uses standard tools like gpg for storage and pwgen for password generation
-It has a simple command line with some uncomplicated graphical frontends
- It does not leave anything in memory, as it terminates when it finished copying the password to your clipboard or writing it to the console (or in the pipe of some other program).