1

I have recently started using a cloud gaming service. It provides me with control of a 'remote PC' (actually a virtual machine running in their data centre) accessed through an app or VNC console. The VM is switched on/off using a control webpage where a password must be entered.

This week the cloud gaming service was hacked (specifically, several people discovered that all users could access the control webpage back-end using their ordinary user password). An attacker had access to all of the virtual machines and is known to have accessed one of them (owned by someone we will call "Numpty") in order to take control of other accounts which were open on that VM at the time.

Using a password manager (1Password, LastPass, etc.) is often the top recommendation for secure computing. But in this specific case, it seems that using a password manager is no more secure. It would not have protected Numpty, since their other accounts were already open on the desktop to which the attacker had full access. Is that correct?

I even wonder whether a password manager would have been less secure than memorized passwords. If Numpty had been using a password manager, it seems that the attacker could have opened the web pages of popular websites (Amazon, Google, PayPal, etc.) and accessed those accounts without needing to know the password. Is that correct? I have never used a password manager, so I am not certain.

I am wondering about whether to discourage the other users of cloud gaming services from using password managers, so please point out any flaws in this argument.

1
  • Could you please link to any news discussing this occurence?
    – user163495
    Commented May 30, 2020 at 20:28

2 Answers 2

1

It all very much depends on the exact situation.

Situation 1: The VM was turned off.

You mentioned that the specific VM can be turned on and off. I'm going to assume turning it off through the control panel shuts the VM down, meaning all RAM will be wiped.

In such a case, if the attacker could have turned the VM on and logged in, they could have stolen the password manager data base. This database is encrypted with either a master password or a key file.

In case of a master password, it depends on the exact configuration of the Key-Derivation Function set before the database was compromised. With sufficiently strict parameters, and a reasonably long password/passphrase, brute-forcing the database is nigh-impossible.

If a keyfile was used, and the keyfile was never transferred to the VM while the attacker had access, then it is also virtually impossible for the attacker to attack the database.

This is generally the best-case scenario.

Situation 2: The VM was used during the time of compromise.

In this case, the attacker could have actively attempted to gather passwords through your password manager, by waiting for the required key material (password/passphrase, keyfile, etc.) to be supplied.

While this is certainly theoretically possible, it would require the attacker to specifically target password managers. It's not possible for me to say whether or not they did.

Are password managers less secure than memorized passwords?

Password managers are designed to protect against a different kind of attack. In the vast majority of cases, the servers where a password is used are hacked, and hashes of these passwords are stolen. In such a case, a long and completely random password generated by a password manager is virtually impossible to crack, while a humanly rememberable password is magnitudes easier to crack by comparison. Sure, there are passwords/passphrases that are extremely difficult to crack, but they pale in comparison to

QZHvqfxKU7MB9UU?KaktEC2^qe*-VF2W++%tqagj

In the case of the machine where a password is stored being compromised, the password database is still encrypted, meaning that an attacker either needs to wait for the password database to be decrypted or they need to crack the master password themselves.

In comparison, if one were to use humanly memorable passwords, an attacker would need to wait for a user to enter the password manually. Depending on your habits (re-using passwords, using patterns for passwords, etc.), this means an attacker only needs to grab a few passwords to have access to your accounts.

In this situation, the humanly memorable passwords that follow all guidelines (all unique, strong passwords) and are never used while the machine is compromised, would fare better than a password manager.

However, such situations are much less frequent than hashes being stolen via e.g. a SQL Injection vulnerability. As such, it is still best-practice to use a password manager.

How should you react now?

First of all, change all your passwords of all accounts in the compromised database. Enable Multi-Factor Authentication for any service that offers is. Even with a cracked password, an attacker cannot compromise your account if the second or third factor is not compromised.

Finally, don't host your password manager in the VM. If it is at all possible, host a password manager locally and configure them to auto-type keystrokes instead. This means an attacker never has direct access to your password manager database. Sure, they would still have access to any password you enter, but that is unavoidable if your VM is compromised.

2
  • Yeah, I think the most important point is that password managers solve a different problem than what was being asked about. Commented May 30, 2020 at 21:33
  • @multithr3at3d I put emphasis on that
    – user163495
    Commented May 30, 2020 at 21:39
0

This is a very specific case and a very generic question.

I'd suggest that yes it is still a benefit using a password manager even on a computer you don't own. I am assuming it is not a workstation for generic use (that would be a bad idea). The password manager to use on the cloud workstation would be one with only the passwords you need to use whilst on that platform, certainly leaving banking stuff out. This way you would be able to control your losses.

Would be better that a plaintext file or having passwords memorised, since we know what that ends up being.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .