Menu
LastPass phishing attack could have scooped up passwords

LastPass phishing attack could have scooped up passwords

The simple attack shows how software needs to be more phishing resistant

A relatively simple phishing attack could be used to compromise the widely used password manager LastPass, according to new research.

Notifications displayed by LastPass version 4.0 in a browser window can be spoofed, tricking people into divulging their login credentials and even snatching a one-time passcode, according to Sean Cassidy, who gave a presentation at the Shmoocon conference on Saturday.

Cassidy, who is CTO of Praesido Inc., notified LastPass of the issues. In a blog post, LastPass said it has made improvements that should make such an attack harder to pull off without a user knowing.

Cassidy released a tool on GitHub called LostPass that shows how an attacker can spoof alerts from LastPass, eventually tricking a user into giving up their login credentials.

In a blog post, Cassidy describes how LastPass will alert users if they're logged out of the application. But the alert is shown through the browser's viewport, and the exact same alert could be created and triggered by an attacker if someone can be lured to a malicious website.

For his proof-of-concept attack, he bought the domain "chrome-extension.pw," which looks similar to Chrome's protocol for browser extensions and unlikely raise eyebrows.

The bogus LostPass alert, if clicked on, could then lead to the malicious domain that asks for a user's credentials. If two-factor authentication is enabled, the access token could also be stolen. At that point, all of the victim's passwords can be collected using the LastPass API, Cassidy wrote.

Strangely, those LastPass customers who have two-factor authentication could have been more vulnerable to the attack.

Cassidy wrote that LastPass sent an email notification if a login attempt is made from a new IP address. But that alert is only sent if a person doesn't have two-factor authentication enabled, so those with it enabled wouldn't know of a suspicious login.

LastPass has since changed the notification to also go to people who have two-factor enabled if a login attempt is made from a new location or device.

Cassidy contends his research shows how software needs to be more resistant to phishing attacks.

"Many responses to the phishing problem are 'train the users,' as if it was their fault that they were phished," Cassidy wrote. "Training is not effective at combating LostPass because there is little to no difference in what is shown to the user."

Although Cassidy wrote that the problems are hard to fix, he decided to go public.

"As soon as I published details of this attack, criminals could make their own version in less than a day," he wrote. "I am publishing this tool so that companies can pen-test themselves to make an informed decision about this attack and respond appropriately."

LastPass has implemented some new defenses in response to Cassidy's research and also plans "to release additional notification options that bypass the viewport."

The company has also blocked web pages from logging someone out of LastPass. Even if users see a warning that they're logged out, in theory they should notice that LastPass is actually still logged in. 

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Slideshows

Meet the leading HP partners in New Zealand...

Meet the leading HP partners in New Zealand...

HP has recognised its top performing partners in New Zealand at the second annual 2016 HP Partner Awards, held at a glittering bash in Auckland. The HP Partner Awards recognises and celebrates excellence, growth, consistency and engagement of its top partners. This year also saw the addition of several new categories, resulting in 11 companies winning across 11 award categories.

Meet the leading HP partners in New Zealand...
Channel comes together as Ingram Micro Showcase hits Auckland

Channel comes together as Ingram Micro Showcase hits Auckland

Ingram Micro outlined its core focuses for 2017 at Showcase in Auckland, bringing together the channel for a day of engaging keynotes, compelling breakout sessions and new technologies.

Channel comes together as Ingram Micro Showcase hits Auckland
Show Comments