A security researcher has released a tool that can steal the login details and two-factor authentication key for the popular LastPass password manager, leaving users potentially exposed.
LastPass, like many other password managers, stores user’s passwords in the cloud in an encrypted vault protected by a single username and password. The vault can also be protected using various forms of two-factor authentication.
The tool allows hackers to mimic the look and feel of the LastPass browser plugin and site, owing to the way the password manager uses browser pop-up boxes or banners called “viewports” to request a user’s password and two-factor authentication key.
Sean Cassidy, chief technology office for Praesidio, presented the attack at the hacker convention ShmooCon in Washington. He said: “I call this attack LostPass. LostPass works because LastPass displays messages in the browser that attackers can fake. Users can’t tell the difference between a fake LostPass message and the real thing because there is no difference. It’s pixel-for-pixel the same notification and login screen.”
The attack relies on a user visiting a malicious website or one that has been compromised with a malicious advert or code. It will detect if the browser is using LastPass, mimic a LastPass notification, remotely log-out the user and request their password and two-factor authentication key.
The hacker would then be able to gain full access to every password stored in a LastPass user’s vault, change settings, remove a user’s access or hide their access leaving the user none-the-wiser.
Catching even the most careful of users
Cassidy notified LastPass about the phishing attack, which has not yet been recorded as being used in the wild, in November. The company implemented a system to alert users when they type their LastPass master password on a site that is not run by the password manager, but Cassidy said that hackers can easily block that notification.
Cassidy said: “The attack works best against the Chrome browser because they use an HTML login page. Firefox actually pops up a window for its login page, so it looks like whatever operating system you’re on.”
The attack is not a vulnerability bug within LastPass itself, but highlights a major problem that could catch even the most careful users out, tricking them to give the attackers their login credentials.
LastPass said in a support document about phishing: “The [email] verification process significantly reduces the threat of this phishing attack. The attacker would need to gain access to the user’s email account as well, which could also be mitigated by two-factor authentication for their email account. Should a user see a verification request that they did not initiate, they can safely ignore it.”
LastPass has also implemented a fix that prevents the malicious website from logging a user out of their LastPass account. Neither changes prevent the attackers from stealing a user’s LastPass login details, but could prevent them from using those details to access the user’s password manager.
The company also said it would be revisiting its notification approach to make it harder to mimic and petitioned Google in 2012 to enable Chrome extensions to notify users beyond the scope of a browser viewport.
Comments (…)
Sign in or create your Guardian account to join the discussion