Menu
LastPass phishing attack could have scooped up passwords

LastPass phishing attack could have scooped up passwords

The simple attack shows how software needs to be more phishing resistant

A relatively simple phishing attack could be used to compromise the widely used password manager LastPass, according to new research.

Notifications displayed by LastPass version 4.0 in a browser window can be spoofed, tricking people into divulging their login credentials and even snatching a one-time passcode, according to Sean Cassidy, who gave a presentation at the Shmoocon conference on Saturday.

Cassidy, who is CTO of Praesido Inc., notified LastPass of the issues. In a blog post, LastPass said it has made improvements that should make such an attack harder to pull off without a user knowing.

Cassidy released a tool on GitHub called LostPass that shows how an attacker can spoof alerts from LastPass, eventually tricking a user into giving up their login credentials.

In a blog post, Cassidy describes how LastPass will alert users if they're logged out of the application. But the alert is shown through the browser's viewport, and the exact same alert could be created and triggered by an attacker if someone can be lured to a malicious website.

For his proof-of-concept attack, he bought the domain "chrome-extension.pw," which looks similar to Chrome's protocol for browser extensions and unlikely raise eyebrows.

The bogus LostPass alert, if clicked on, could then lead to the malicious domain that asks for a user's credentials. If two-factor authentication is enabled, the access token could also be stolen. At that point, all of the victim's passwords can be collected using the LastPass API, Cassidy wrote.

Strangely, those LastPass customers who have two-factor authentication could have been more vulnerable to the attack.

Cassidy wrote that LastPass sent an email notification if a login attempt is made from a new IP address. But that alert is only sent if a person doesn't have two-factor authentication enabled, so those with it enabled wouldn't know of a suspicious login.

LastPass has since changed the notification to also go to people who have two-factor enabled if a login attempt is made from a new location or device.

Cassidy contends his research shows how software needs to be more resistant to phishing attacks.

"Many responses to the phishing problem are 'train the users,' as if it was their fault that they were phished," Cassidy wrote. "Training is not effective at combating LostPass because there is little to no difference in what is shown to the user."

Although Cassidy wrote that the problems are hard to fix, he decided to go public.

"As soon as I published details of this attack, criminals could make their own version in less than a day," he wrote. "I am publishing this tool so that companies can pen-test themselves to make an informed decision about this attack and respond appropriately."

LastPass has implemented some new defenses in response to Cassidy's research and also plans "to release additional notification options that bypass the viewport."

The company has also blocked web pages from logging someone out of LastPass. Even if users see a warning that they're logged out, in theory they should notice that LastPass is actually still logged in. 

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Slideshows

Top 50 defining moments of the New Zealand channel in 2016

Top 50 defining moments of the New Zealand channel in 2016

Reseller News looks back on a tumultuous 12 months for the New Zealand channel, assessing the fallout from a year of sizeable industry change. Whether it be local or global mergers and acquisitions, distribution deals or job changes, the channel that started the year differs somewhat to the one set to finish it - Reseller News assesses the key moments that made 2016.​

Top 50 defining moments of the New Zealand channel in 2016
​Hewlett Packard Enterprise honours high achieving NZ channel

​Hewlett Packard Enterprise honours high achieving NZ channel

Hewlett Packard Enterprise honoured its top performing Kiwi partners at the second running of its HPE Partner Awards in New Zealand, held at a glitzy ceremony in Auckland. Recognising excellence across eight categories - from distributors to resellers - the tech giant celebrated its first year as a standalone company, following its official split from HP in 2015.

​Hewlett Packard Enterprise honours high achieving NZ channel
Nutanix treats channel partners to Christmas cruise

Nutanix treats channel partners to Christmas cruise

Nutanix recently took to the seas for a Christmas Cruise around Sydney Harbour with its Australia and New Zealand staff, customers and partners to celebrate a stellar year for the vendor. With the sun out, they were all smiles and mingled over drinks and food.

Nutanix treats channel partners to Christmas cruise
Show Comments