Menu
LastPass phishing attack could have scooped up passwords

LastPass phishing attack could have scooped up passwords

The simple attack shows how software needs to be more phishing resistant

A relatively simple phishing attack could be used to compromise the widely used password manager LastPass, according to new research.

Notifications displayed by LastPass version 4.0 in a browser window can be spoofed, tricking people into divulging their login credentials and even snatching a one-time passcode, according to Sean Cassidy, who gave a presentation at the Shmoocon conference on Saturday.

Cassidy, who is CTO of Praesido Inc., notified LastPass of the issues. In a blog post, LastPass said it has made improvements that should make such an attack harder to pull off without a user knowing.

Cassidy released a tool on GitHub called LostPass that shows how an attacker can spoof alerts from LastPass, eventually tricking a user into giving up their login credentials.

In a blog post, Cassidy describes how LastPass will alert users if they're logged out of the application. But the alert is shown through the browser's viewport, and the exact same alert could be created and triggered by an attacker if someone can be lured to a malicious website.

For his proof-of-concept attack, he bought the domain "chrome-extension.pw," which looks similar to Chrome's protocol for browser extensions and unlikely raise eyebrows.

The bogus LostPass alert, if clicked on, could then lead to the malicious domain that asks for a user's credentials. If two-factor authentication is enabled, the access token could also be stolen. At that point, all of the victim's passwords can be collected using the LastPass API, Cassidy wrote.

Strangely, those LastPass customers who have two-factor authentication could have been more vulnerable to the attack.

Cassidy wrote that LastPass sent an email notification if a login attempt is made from a new IP address. But that alert is only sent if a person doesn't have two-factor authentication enabled, so those with it enabled wouldn't know of a suspicious login.

LastPass has since changed the notification to also go to people who have two-factor enabled if a login attempt is made from a new location or device.

Cassidy contends his research shows how software needs to be more resistant to phishing attacks.

"Many responses to the phishing problem are 'train the users,' as if it was their fault that they were phished," Cassidy wrote. "Training is not effective at combating LostPass because there is little to no difference in what is shown to the user."

Although Cassidy wrote that the problems are hard to fix, he decided to go public.

"As soon as I published details of this attack, criminals could make their own version in less than a day," he wrote. "I am publishing this tool so that companies can pen-test themselves to make an informed decision about this attack and respond appropriately."

LastPass has implemented some new defenses in response to Cassidy's research and also plans "to release additional notification options that bypass the viewport."

The company has also blocked web pages from logging someone out of LastPass. Even if users see a warning that they're logged out, in theory they should notice that LastPass is actually still logged in. 


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Featured

Slideshows

Reseller News welcomes industry figures for 2019 Hall of Fame lunch

Reseller News welcomes industry figures for 2019 Hall of Fame lunch

Reseller News welcomed 2018 inductees - Chris Simpson, Kendra Ross and Phill Patton - to the third running of the Reseller News Hall of Fame lunch, held at the French Cafe in Auckland. The inductees discussed the changing landscape of the technology industry in New Zealand, while outlining ways to attract a new breed of players to the ecosystem. Photos by Gino Demeer.

Reseller News welcomes industry figures for 2019 Hall of Fame lunch
Upcoming tech talent share insights at inaugural Emerging Leaders Forum 2019

Upcoming tech talent share insights at inaugural Emerging Leaders Forum 2019

The channel came together for the inaugural Reseller News Emerging Leaders Forum in New Zealand, created to provide a program that identifies, educates and showcases the upcoming talent of the ICT industry. Hosted as a half day event, attendees heard from industry champions as keynoters and panelists talked about future opportunities and leadership paths and joined mentoring sessions with members of the ICT industry Hall of Fame. The forum concluded with 30 Under 30 Tech Awards across areas of Sales, Entrepreneur, Marketing, Management, Technical and Human Resources. Photos by Gino Demeer.

Upcoming tech talent share insights at inaugural Emerging Leaders Forum 2019
Show Comments