5

Normally LastPass servers won't send out encrypted passwords unless the client proves it knows the master password. With the hashes leaked, does it become possible for an attacker to retrieve encrypted passwords (i.e. ciphertexts, which are useless without the master password) without first cracking the leaked hash to obtain the master key?

I realise that at this point LastPass won't send encrypted passwords to new IPs, but there must have been a window in which they would have. If this is possible, then we must assume that the attackers managed to pull at least some percentage of the encrypted passwords.

This would be bad news for anyone with a sub-optimal master password, because if there is any chance that it might fall to an offline attack then changing your master password alone won't help: you'd need to also change the actual passwords before your weak master password is cracked.

Conversely, if you don't think your master password can fall to an offline attack given what we know about the hashing algorithm, then there is no point in changing anything at all. The only scenario in which you would change your master password but not the actual passwords is if you believe that your ciphertexts didn't get downloaded by the attacker. Otherwise you either change everything or you change nothing.

Is this a plausible scenario? Would you expect that the attackers managed to retrieve some percentage of the encrypted password ciphertexts?

Improve this question
3
  • Interesting question. Would you mind putting a reference, or at least a date, for the patch that fixed LastPass' behaviour so that other readers know the time window you're talking about?
    – Mike Ounsworth
    Commented Jun 16, 2015 at 13:24
  • @MikeOunsworth Unfortunately all the information I have comes from the LastPass blog post, and they don't specify how long it was between the leak and the time when they started requiring new IPs to verify by email.
    – RomanSt
    Commented Jun 16, 2015 at 13:28
  • OK I now understand that this scenario is implausible. LastPass would be silly to simply compare the hash they receive against the hash they store. I imagine what actually happens is: master password is hashed client-side. Hash is sent to LastPass. The hash is then hashed with those server-side 100k rounds. The result of that is compared to the database that leaked. Therefore to obtain encrypted passwords, the leaked hash is insufficient, and would be very difficult to crack within the window of opportunity that has now been closed.
    – RomanSt
    Commented Jun 16, 2015 at 13:45

2 Answers 2

Reset to default
2

Assuming that, at some point after the breach, LastPass would have provided password databases to anyone who only knew an account's username and password, regardless of which computer they connected from, then the answer is basically "yes, it's possible".

Under those conditions, if an attacker was able to crack a user's master password and log in to that user's LastPass account before LastPass changed their security, a user's password database could certainly have been compromised.

However, that window of time was (presumably) small. With proper security practices in place regarding the hashing & storage of master passwords, it would be generally unlikely that anyone with a strong master password would have had their account compromised within that window. Accounts with extremely weak and/or common master passwords may have had their hashes cracked, but anyone else would probably be "safe".

That said, it is even still very possible that some users may have their accounts broken into even with the new security measures. LastPass is falling back to e-mail verification for new systems that access an account. If a user's master password is cracked, and that same password is all that protects their e-mail account, then it would be fairly trivial for an attacker to work around the new security measure.

Improve this answer
6
  • "Under those conditions, if an attacker was able to crack a user's master password" - but my question is whether with the leaked hashes they could retrieve the (encrypted) database without cracking anything, or perhaps by hacking only the client-side hashing rounds, of which there are significantly fewer.
    – RomanSt
    Commented Jun 16, 2015 at 13:31
  • @romkyns Ah. That's a little unclear in your question. If an un-cracked hash is enough to access an account, then there's really no point in hashing the password to begin with. The only case where an un-cracked hash would be a concern is if the application hashes the passwords client-side before performing authentication. I don't think LastPass has specified that they don't do this, but it would be woefully incompetent of them if they did.
    – Iszi
    Commented Jun 16, 2015 at 13:35
  • Surely it must hash the password client-side before performing authentication, because they cannot send the password itself (that's part of the promise: they don't know your master password). But I see a way out now: client sends a hash, server hashes it with 100,000 rounds and compares that against the stored hash. This makes my entire question redundant. I think I should close it.
    – RomanSt
    Commented Jun 16, 2015 at 13:39
  • @romkyns Even if you're sending an un-hashed password, LastPass still wouldn't (or shouldn't) know it. That is, not in any permanent sense. The server would only retain it in memory long enough to hash it before storing it, or comparing it against the stored hash. What you suggest (client-side hash, plus server-side hash before storing/comparing) is certainly possible. You can use web debuggers like Firebug or Fiddler (with SSL intercept enabled) to verify if you like.
    – Iszi
    Commented Jun 16, 2015 at 14:03
  • @romkyns According to this Ars article there's 5,000 rounds of hashing done client-side and then 100,000 server-side. One commenter quipped: PBKDF2(HMAC-SHA256, sha256(PBKDF2(HMAC-SHA256, password, salt, rounds)), salt, 100000) Ain't nobody got time for that.
    – Iszi
    Commented Jun 16, 2015 at 19:44
1

Lastpass only gives encrypted passwords to those who have authenticated.

Lastpass encrypts passwords using your master password and stores them in the "user vault". The "user vault" is only available after a user authenticates. That master password is stored in a hash. The master password hash(among some other details) is what is known to have been taken.

According to the Lastpass Blog:

In our investigation, we have found no evidence that encrypted user vault data was taken, nor that LastPass user accounts were accessed.

Because the master hash was compromised, Lastpass is requiring logins from new devices or IP addresses to first be verified by email. Before this additional control was put into place, the attackers could have logged onto your account (provided you don't have two factor authentication in place), but only after they cracked your hash. Because of the salt and number of rounds in place, cracking the hash for a sufficiently complex password is difficult.

Improve this answer
2
  • This relies on them being able to distinguish legitimate requests from attackers' requests. They may or may not be able to detect a well-planned attack where a large botnet is used to pull the ciphertexts slowly.
    – RomanSt
    Commented Jun 16, 2015 at 13:29
  • What do you mean by "Pull the ciphertexts"? Do you mean the attacker was able to crack multiple user credentials and then log in and download the dataset?
    – amccormack
    Commented Jun 16, 2015 at 13:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .