LastPass vulnerability: Should LastPass users change all their passwords?

Question

Reading about the recent vulnerability in LastPass extensions for FireFox and Chrome. The published exploit allows arbitrary code execution. The vulnerability also allowed access to stored passwords. I can read that the arbitrary code execution won't work unless the binary extension is enabled. If my ..um friend used LastPass, I assume he was still vulnerable to a malicious script accessing passwords even without the binary Chrome extension enabled?

So, if this vulnerable extension has been out there and nobody has any idea if Project Zero was the first to find it, why isn't LastPass recommending that everyone change all their passwords?

Answer 1

Last pass suggesting people change their passwords depends on if the vulnerability was discovered before it was disclosed and solved and if users have visited an infected site in case it was. It also depends on how the vulnerability was solved.

Tavis Ormandy is a very good researcher that has been poking at Last Pass for quite a while, and while it is possible for someone else to have discovered the vulnerability before him, I find this unlikely. However, if it was discovered it was probably not very widely used, since we haven't seen any leaks in the media so far and I don't think a breach of Last Pass would last very long without being discovered. In my opinion, it's not very likely users have been hit with this.

The exploit only allows access to Last Passe's RPCs without the extension, so an attacker wouldn't be able to gain access to your master password, but to the password of a site (or possibly a few sites) you've stored in Last Pass. So if you do feel like changing your password, change the passwords of the sites you access via Last Pass, not the master password.

Finally, if the vulnerability was resolved by removing the DNS entry and not by taking down the service, a MITM could potentially obtain your account details, but the likelihood of a targeted attack is pretty low unless an attacker can manipulate a web page they know you frequent and can also position themselves as a MITM.

All of this aims to a pretty low risk of Last Pass users having been burned, if they were it was likely a small number of users. I think the media circus that would follow Last Pass suggesting all users change their passwords would create more harm than good to the company as a whole, while only having a few users being affected isn't ideal, it's more manageable from a PR standpoint.

Answer 2

It seems to me that this vulnerability allows for unauthorized access through the extension, and therefore provide access to your passwords. If you believe that there is a possibility that you are infected with a Remote Access Trojan (RAT), or other virus allowing remote access, than changing passwords may be a good idea. However, changing your passwords every now and then is a good security practice within itself. Personally, if I have any doubt in my mind, I usually play is on the safe side. Changing critical passwords (such as banking login) certainly wouldn't hurt.