5

Reading about the recent vulnerability in LastPass extensions for FireFox and Chrome. The published exploit allows arbitrary code execution. The vulnerability also allowed access to stored passwords. I can read that the arbitrary code execution won't work unless the binary extension is enabled. If my ..um friend used LastPass, I assume he was still vulnerable to a malicious script accessing passwords even without the binary Chrome extension enabled?

So, if this vulnerable extension has been out there and nobody has any idea if Project Zero was the first to find it, why isn't LastPass recommending that everyone change all their passwords?

  • If the vulnerability is only in the extension, isn't anyone not using the extension safe? – Gudradain Mar 24 '17 at 19:31
  • I'm not asking about not using the extension. There are two modes of the extension. The binary mode enabled allows more features and more vulnerabilities. One can use the extension without binary enabled. – mcgyver5 Mar 24 '17 at 19:39
  • I have the full-connection system running on my Androids, but on the PCs only use the extensions. Note that from the link poster here that this was discovered and fixed last month, and only exposed a single password if someone grabbed your memory while you were logging into a site. So if you are worried about this, change pwds for any sites you have used in the last month or two. – SDsolar May 24 '17 at 6:58
3

Last pass suggesting people change their passwords depends on if the vulnerability was discovered before it was disclosed and solved and if users have visited an infected site in case it was. It also depends on how the vulnerability was solved.

Tavis Ormandy is a very good researcher that has been poking at Last Pass for quite a while, and while it is possible for someone else to have discovered the vulnerability before him, I find this unlikely. However, if it was discovered it was probably not very widely used, since we haven't seen any leaks in the media so far and I don't think a breach of Last Pass would last very long without being discovered. In my opinion, it's not very likely users have been hit with this.

The exploit only allows access to Last Passe's RPCs without the extension, so an attacker wouldn't be able to gain access to your master password, but to the password of a site (or possibly a few sites) you've stored in Last Pass. So if you do feel like changing your password, change the passwords of the sites you access via Last Pass, not the master password.

Finally, if the vulnerability was resolved by removing the DNS entry and not by taking down the service, a MITM could potentially obtain your account details, but the likelihood of a targeted attack is pretty low unless an attacker can manipulate a web page they know you frequent and can also position themselves as a MITM.

All of this aims to a pretty low risk of Last Pass users having been burned, if they were it was likely a small number of users. I think the media circus that would follow Last Pass suggesting all users change their passwords would create more harm than good to the company as a whole, while only having a few users being affected isn't ideal, it's more manageable from a PR standpoint.

0

It seems to me that this vulnerability allows for unauthorized access through the extension, and therefore provide access to your passwords. If you believe that there is a possibility that you are infected with a Remote Access Trojan (RAT), or other virus allowing remote access, than changing passwords may be a good idea. However, changing your passwords every now and then is a good security practice within itself. Personally, if I have any doubt in my mind, I usually play is on the safe side. Changing critical passwords (such as banking login) certainly wouldn't hurt.

  • Read the link in the OP - it only exposed a single password for a site you were logging into right then. Once you are logged in it is gone. – SDsolar May 24 '17 at 6:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.