I lookedI've been looking into the security designissues of LastPass recentlyseveral password managers on a number of occasions. In particular, I reported twelve security issues to LastPass so far and it seems that I've gotwrote about the design decisions which led to those on a good idea where to look for issuesnumber of occasions. So while paj28 gave a very good general answer about password managers, I can provide some details.
It's important to understand thatWhen people talk about the main security token withof online password managers like LastPass is your master password, they usually focus on server security. If LastPass servers get compromised (or if a LastPass employee turns evil) then this master passwordThe focus is what prevents the attackers from decrypting all your passwords. If they manage to guesson how easy is it then all your passwordsto compromise the server and what will be gonehappen then. ConsequentlyThis is only one attack vector however, LastPass tries to make it hard to intercept or guessbecause attacking your masterlocal password. This means in particular that manager instance might lead to the LastPass login form doesn't actually sendsame results. In fact, attacking the master passwordbrowser extension might be a more promising course of action, as the data is already decrypted there and you entered it. Instead it uses PBKDF2won't leave traces in order to derive a new password that is then sent to LastPassany logs.
I can seeLet me look at these two potential weaknesses here. First one is the login form available on lastpass.com. If we don't trust LastPass servers (and we don't, because why else would we encrypt the password data?) then this login form should never be used. If the servers are compromised the attackers could manipulate this login form in order to get your master password before PBKDF2 is applied - it's unlikely that you will notice anything weird, yet the attackers will be able to get the password and decrypt your data stored on the server. Unfortunately, LastPass browser extensions currently use pages from lastpass.com for some of their user interface - so when you see a login form, it might be non-trivial to verify that it doesn't come from the webaspects separately.
Attacking the browser extension
The more complicated approach requires bruteforcing your master password, particularly ifThere is a lot of historical data on vulnerabilities in the password youLastPass browser extension. All these vulnerabilities could be exploited by arbitrary webpages. At the very least, these are using:
Did you notice a pattern here? LastPass has been struggling for years to secure their AutoFill functionality and to restrict access to their internal API. Each time a new report proved that their previous fix was incomplete.
Now it isn't very strongunusual that password managers fail to implement AutoFill securely, most of them had issues in this area when I checked. PBKDF2 cannot be reversedWhile totally avoidable, sothese issues are common enough that I even compiled a list with recommendations to avoid the traps.
But the internal API issues are quite remarkable. LastPass exposes this involves generating lotsAPI to websites in a number of guessesdifferent ways. It's meant to be restricted to lastpass.com but the logic is so complex that the restrictions have been circumvented several times in the past. And while LastPass did their best to downplay the severity in their official announcements, applying PBKDF2each of these issues allowed websites to read out all passwords at once. Worse yet, the guesses and checking whether you getlast report by Tavis Ormandy proved that the expected resultinternal API could be used to make the binary LastPass component execute arbitrary code on user's machine. Same could probably be done with anyall the previous flaws which exposed internal API.
One could of themcourse ask why LastPass failed to restrict access to the internal API properly. PBKDF2But the better question is designedwhy this API is exposed to be computationally intensivewebsites at all. That's because a significant part of the LastPass functionality isn't contained in the extension but rather relies on the LastPass website to work. That's a very problematic design decision but so far LastPass didn't seem interested in fixing it.
Attacking server-side data
Let's state this very clearly: we don't trust the server. It's not that bruteforcing won't succeedwe particularly distrust LogMeIn, yet it is essentialInc. - at least not more than any other company. But our passwords are very sensitive data, and even the most ethical company might have a rogue employee. Add to this the possibility that US authorities demand them to produce your data, something that isn't even necessarily associated with a criminal investigation. Never mind the possibility that their servers get hacked, like it already choose the number of iterations used by the algorithm as high as possiblehappened once.
How many iterations does LastPass use? On the client sideSo it is very important that your data on the defaultserver is merely 5,000 iterations. We have year 2016,encrypted and this number should be considered way too low when confronted with contemporary hardware. Documentation explains this default with the necessityuseless to support Internet Explorer 7 and smartphonesanybody who can get hold of it. Well, IBut what can possibly stop the attackers from decrypting it? Exactly one thing: they don't think that Internet Explorer 7know your master password which is still supported, and even if you use a smartphone you should definitely change this setting and test whether it will be ableused to handle at least 100,000 iterationsderive the encryption key. So the essential question is: does LastPass sufficiently protect your master password and encryption key?
There is a tweak toIn this: LastPass claims to add another 100,000 iterations on the server side! So before storing your derived password they will apply PBKDF2 to it again. This definitely makes sense, and it is a good measure if a successful attacker merely copies the data from the LastPass server. However area, the attacker could also start intercepting passwords as these are being received by the LastPass serverI am not aware of any publicized research but my own, before additional hashing is applied. So when you logmost of it written down in with yourthis blog post. My conclusion here: LastPass extension they will interceptsuffers from a derived password with merely 5number of design flaws here,000 iterations which will be considerably easier to bruteforce some being resolved by now while others are still active.
So much for the general architecture, it has its weak spots but all in all it is pretty solid and your passwords are unlikely to be compromised at this level (or maybe they are, see update below). However, as described in my blog post the browser integration turned out to be a massive weakness. The LastPass extension on your computer works with decrypted data, so it needs to be extra careful - and at the moment it isn't.
Bruteforcing the master password
This starts with Auto Fill functionality which is known to be a bad idea since at least 2006. A password manager filling in passwords automatically means that any reflected XSS vulnerability in a website immediately exposesIf the user's passwordattackers got their hands on a bunch of encrypted data, whichthe most straightforward decryption approach is why password managers usually require user interaction before: guess the master password is filled inused to derive the encryption key. The blog post also goes into how URL parsing componentYou can try an unlimited number of this critical functionality is unnecessarily error-proneguesses locally, which in the past resulted in exposure of passwords for websites that the attacker didn't controlon whatever hardware you can afford, so this process will be comparably quick.
It's obviously a good idea for such an extension to limit interaction with websitesLastPass uses PBKDF2 algorithm to derive the bare minimum and review parts touching websites very carefullyencryption key from the master password. This doesn't appearWhile being inferior to have happenednewer algorithms like bcrypt, with all kinds of LastPass functionality acting within websites' domain. Sometimes this is completely unnecessaryscrypt or Argon2, like different parts ofthis algorithm has the extension communicating via window.postMessage() rather than using extension-specific messaging APIsimportant property of making key derivation slow, so attackers doing guessing locally will be slowed down. Sometimes itThe time required is merely semi-unnecessaryproportional to the number of iterations, such asmeaning: the complex messaging API for communication with lastpass.com (something that wouldn't be necessary ifhigher the entire user interface were contained withinnumber of iterations, the extension). Butharder it look like in all cases the security implications weren't thought through properlywill be to guess a master password.
I have to stress that this is merely capturing the current state of LastPass. They might get their act together: get rid of mixing web pages with extension pages, adjust security-relevant defaults for modern hardwareFor a long time, limit the number of communication channels within the extension exposed to websiteLastPass default was 5, stop generating HTML code dynamically etc000 iterations. What they have there can be secure, andThis is an extremely low value that provides very little protection. I also looked atcalculated that a competing extension which does mostlysingle GeForce GTX 1080 Ti graphics card could be used to test 346,000 guesses per second. That’s enough to go through the same thing without any potential security issuesdatabase with over a billion passwords known from various website leaks in barely more than one hour.
Update (2018 Following my reports, LastPass increased the default to 100,000 iterations mid-012018 which is far more adequate. Of course, if you are an important target who could expect state-30): Originallylevel resources being thrown at guessing your master password, I looked mostly intoyou should still choose an extremely strong master password.
Getting hold of data to bruteforce
One of my findings in early 2018 was that the script https://lastpass.com/newvault/websiteBackgroundScript.php could be loaded by any website. That script contained both your LastPass browser extensionsusername and it seemsa piece of encrypted data (private RSA key). With your LastPass username being also the password derivation salt, that's all someone needs to bruteforce your master password locally.
This issue was resolved quickly of course. However, the flaw was obvious enough that I'm left wondering whether I relied too much on the official documentation as far aswas the server's inner workings gofirst to discover it. NowWhile I triedurged LastPass to understandcheck their logs for signs of this vulnerability being exploited in the server-side mechanisms better and realized thatwild, to my knowledge this investigation never happened.
"Server-side rounds" as useless protection
Following a number of issues could exposesecurity incident in 2011, LastPass implemented an additional security mechanism: in addition to your data here as wellPBKDF2 iterations on the client side they would add another 100,000 iterations on the server. I'm listingSo in theory, if somebody could get data off the less serious and/or already publicly documented issues hereserver, this would increase the effort required to guess your master password.
In practice, I could conclusively prove that these additional 100,000 iterations are only applied to the password hash. All the other ones being still under investigation by LastPasspieces of user data (passwords, RSA keys, OTPs and more) are only encrypted using the encryption key derived locally from your master password, no additional protection here. Conclusion: this additional "protection" is a complete waste of server resources and doesn't provide any value whatsoever.
Getting in through the back door
No matter how weak the protection, brute force attacks will always be ineffective against the strongest master passwords. However, the design of LastPass contains plenty of backdoors that would allow decrypting the data without expending any effort. I'll describe three backdoors here, one more report is still being worked on by LastPass.
The web interface
LastPass conveniently provides you with a web interface to access your passwords without the help of a browser extension. This feature is a trap however: whenever you enter your master password into a login form on the web, there is no way of knowing whether it will hash your master password with PBKDF2 before sending it to the server or whether it will transmit it as clear text.
Remember that we don't trust the server? Yet a trivial modification of the JavaScript code served up by the server is enough to compromise all your passwords. Even if you inspect that JavaScript code, there is too much of it for you to notice anything. And it would be possible to serve up the modified code only to specific users.
Account settings
Even if you use the browser extension consistently, whenever you go to the account settings it will load up the lastpass.com website. Here again, there is no way for you to know that this website isn't compromise and won't steal your data in the background.
Several other pieces of the extension functionality are also implemented by falling back to the lastpass.com website, and LastPass doesn't see the issue here.
Recovery OTP
LastPass has the concept of One-Time Passwords (OTPs) that you can use to recover data from your account if you ever forget the master password. These OTPs allow decrypting your data but aren't normally known to the server.
To make recovery even more reliable, LastPass will create a recovery OTP automatically by default and store it in the extension data. The issue here: the recovery process has been designed in such a way that the extension would immediately give lastpass.com that recovery OTP on demand, without even notifying you. So a compromised LastPass server could ask the extension for your recovery OTP and use it to decrypt your data.
According to LastPass, this issue has been resolved in August 2018. I don't know how they resolved it however, at least I couldn't see any of the obvious solutions in their code.
More design flaws
- As you can see by yourself by opening up https://lastpass.com/getaccts.php while logged in, the LastPass vault is by no means an encrypted blob of data. It rather has encrypted data here and there, while other fields like the URL corresponding to the account merely use hex encoding. This issue was pointed out in this 2015 presentation and more fields became encrypted since then - still by far not all of them however. In particular, a report I filed pointed out that Equivalent Domains not being encrypted allowed LastPass server to modify that list and extract your passwords in that way. This particular issue has been resolved in August 2018 according to LastPass.
- Same presentation scolds LastPass for their use of AES-ECB for encryption. Among other things, it gives away which of your passwords are identical. LastPass has been transitioning to AES-CBC ever since, yet when I looked at my "vault" I saw a bunch of AES-ECB-encrypted credentials there (you can tell because AES-ECB is merely a base64-encoded blob whereas the LastPass variant of AES-CBC starts with an exclamation mark).
- One Time Passwords should be handled with care, these are backdoors into your vault. Yet LastPass considers it to be a good idea to create oneRecovery OTP being created automatically without telling you and hide the corresponding setting rather far. If you look atstored in the documentation you will learnextension data means that somebodyanybody with access to both your device and email will be able to take overaddress can access your LastPass account, something that. This is actually documented and considered a low risk. Maybe one of your co-workers played a prank on you by sending an email in your name because you forgot to lock your computer - next time they might take over your LastPass account even if you are logged out of LastPass.
- Speaking of being logged out, the default session expiration time is two weeks. While certainly being convenient, there is a reason why most products handling sensitive data have much shorter session expiration intervals, typically well below one day.
- For combining a value with a secret (e.g. as a signature) one would usually use SHA256-HMAC. LastPass uses a custom approach instead, applying SHA256 hashing twice. While the attacks that HMAC is meant to address don't seem to play a role here, I wouldn't bet on somebody with better crypto knowledge than me not finding a vulnerability here after all. Also, the server side will occasionally produce some SHA256 tokens as well - I wonder what kind of humbug is going on where I cannot see it and whether it's really secure.
