1

I am a LastPass user, which I use with the browser extensions.

Lately it occurred to me that it should not be too hard to create a fishing browser extension that

  1. would replace LastPass upon install,
  2. look exactly like last pass,
  3. Behave like LastPass up to the submission of your password, and
  4. Simply send your login information to some email address upon submission.

My questions are:

  1. Is that a known hack?
  2. If not, why wouldn't it work/be easy to implement (beyond making the user install the extension, which can be done using traditional fishing techniques)?
  3. If it is, is there any ways to protect oneself against that kind of threats? Does LastPass recommend something in this matter?

My question is about LastPass in particular, but I guess the same issue occurs for any keychain software, and I'd be happy to hear about those (for example, 4. if there is a threat at all, does any keychain software offers a better protection than LastPass?)

  • I have wondered the same. Why is the Chrome extension so aggressively pushed by LastPass if Chrome isn't as safe. – Guy T Saywell Nov 15 '16 at 9:25
1

First installing extension is not a harmless operation. Common usages say:

Once you have installed an unwanted software on your computer, it is no longer your computer

But the attack should be slightly more complex than what you describe (after all Lastpass is a well known security solution). The master password that you type into the password extension is only the password of the keyfile used to decrypt locally the content of the vault stored on Lastpass server.

So the fake extension should have to:

  • either to install itself between the browser and the real extension - not that easy
  • either to fully reproduce all the decoding operations of the true extension - indeed possible but still a fair amount of word - meaning
    • locate and unlock the keyfile with the master password
    • download the vault
    • decode the vault

Such an extension would be a major attack against Lastpass, and as such with a great risk of being identified and de-activated soon.

Following in only my own opinion:

This is still a serious threat that should be considered, mainly in case of a targetted attack, meaning if the attacker can manage to activate his software only on a small number of machines to limit to risk of being identified soon. That assumes that the attacker is a strong organization and you as the target represent a high value because in any other case the ratio gain/cost is low and the whole operation does not worth it.


Anyway, the rule here is that Lastpass can allow you to securely use passwords from a local machine, as long as the local machine is secure. If the local machine is compromised - and having an unwanted extension in your browser is a serious compromission - anything can happen (keyloggers, theft or suppression of files, etc.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.