[ZuGgY]

A security researcher has released a tool that can steal the login details and two-factor authentication key for the popular LastPass password manager, leaving users potentially exposed.

LastPass, like many other password managers, stores user’s passwords in the cloud in an encrypted vault protected by a single username and password. The vault can also be protected using various forms of two-factor authentication.

The tool allows hackers to mimic the look and feel of the LastPass browser plugin and site, owing to the way the password manager uses browser pop-up boxes or banners called “viewports” to request a user’s password and two-factor authentication key.

Sean Cassidy, chief technology office for Praesidio, presented the attack at the hacker convention ShmooCon in Washington. He said: “I call this attack LostPass. LostPass works because LastPass displays messages in the browser that attackers can fake. Users can’t tell the difference between a fake LostPass message and the real thing because there is no difference. It’s pixel-for-pixel the same notification and login screen.”

The attack relies on a user visiting a malicious website or one that has been compromised with a malicious advert or code. It will detect if the browser is using LastPass, mimic a LastPass notification, remotely log-out the user and request their password and two-factor authentication key.

The hacker would then be able to gain full access to every password stored in a LastPass user’s vault, change settings, remove a user’s access or hide their access leaving the user none-the-wiser.

Catching even the most careful of users
Cassidy notified LastPass about the phishing attack, which has not yet been recorded as being used in the wild, in November. The company implemented a system to alert users when they type their LastPass master password on a site that is not run by the password manager, but Cassidy said that hackers can easily block that notification.

Cassidy said: “The attack works best against the Chrome browser because they use an HTML login page. Firefox actually pops up a window for its login page, so it looks like whatever operating system you’re on.”

The attack is not a vulnerability bug within LastPass itself, but highlights a major problem that could catch even the most careful users out, tricking them to give the attackers their login credentials.

LastPass said in a support document about phishing: “The [email] verification process significantly reduces the threat of this phishing attack. The attacker would need to gain access to the user’s email account as well, which could also be mitigated by two-factor authentication for their email account. Should a user see a verification request that they did not initiate, they can safely ignore it.”

LastPass has also implemented a fix that prevents the malicious website from logging a user out of their LastPass account. Neither changes prevent the attackers from stealing a user’s LastPass login details, but could prevent them from using those details to access the user’s password manager.

The company also said it would be revisiting its notification approach to make it harder to mimic and petitioned Google in 2012 to enable Chrome extensions to notify users beyond the scope of a browser viewport.

Source

Don't even use this, so I'm all good! :)

[fnatic440]

Source

Don't even use this, so I'm all good! :)

All LastPass accounts are at default to never skip email verification of unknown devices and locations. So essentially, anyone that tries to log in from an unknown device will first trigger an email alert on my end.

But YubiKey - and you're good to go.

[Autocorrect]

I can't use password managers for this reason. I don't like the idea of one password protecting every single one of my accounts/bank information/personal information etc. Pass phrases work better.

[Senpie]

They have released a document about this here: I read that LastPass is vulnerable to phishing attacks - should I be concerned?

[wiz]

They have released a document about this here: I read that LastPass is vulnerable to phishing attacks - should I be concerned?

I've done a lot of research.
Absolutely everything can and might be hacked / attacked. Lastpass was attacked before, but only the encrypted data was leaked.

For you to stay as secure as possible you should do the following:
Use a complex password for LastPass master password
Use 2 step authentication, I personally use YubiKey: YubiKey NEO
Make sure your master email address is secure with 2 Step authentication, again I use YubiKey.
For shits and giggles, change your master password once every month or 2.

Write down your password physically and keep it somewhere safe.

LastPass also makes sure whenever you're logging in from somewhere new, you have to use the 2Step authentication.