LastPass and the Heartbleed Bug

http://blog.lastpass.com/2014/04/lastpass-and-heartbleed-bug.html

by mjhoy • 12 years ago

104 70 12 years ago

blog.lastpass.com

mjhoy• 12 years ago

LastPass puts vulnerable in scare quotes.

But to my understanding, with this bug session information to the website could have leaked, and they don't seem to address this. Could an attacker have hijacked logins?

pgrote2• 12 years ago

No. Here is the explanation:

"However, LastPass is unique in that your data is also encrypted with a key that LastPass servers don’t have access to. Your sensitive data is never transmitted over SSL unencrypted - it’s already encrypted when it is transmitted, with a key LastPass never receives. While this bug is still very serious, it could not expose LastPass customers’ encrypted data due to our extra layers of protection. On the majority of the web, user data is not encrypted before being transmitted over SSL, hence the widespread concern."

jbinto2• 12 years ago

This means "your passwords are safe, because they're encrypted with a key that only you have".

It still means people could have hijacked your session, which is what GP was referring to.

I don't use LastPass, but I speculate even if your data isn't vulnerable, people could use your ID/password to do malicious things (denial of service to your passwords being the first thought).

jbinto2• 12 years ago

It seems some servers had some combination of nginx+openssl that caused the memory location being dumped to always be a recent HTTP request/response. Keep hitting that enough times and you'll get all sorts of goodies (session cookies, cleartext passwords).

This tweet shows someone getting credentials from Yahoo Mail: https://twitter.com/markloman/status/453502888447586304

I think any service who suspects they've been vulnerable should issue a forced password reset email to their users. Even if there's only an infinitesimal chance of credential disclosure, how can you be sure, and why not take precautions?

EGreg• 12 years ago

Also, LastPass has employed a feature called “perfect forward secrecy”. This ensures that when security keys are changed, past and future traffic also can’t be decrypted even when a particular security key is compromised.

I thought perfect forward secrecy simply gives you plausible deniability, or is that in the particular case of Off The Record messaging? How is it that a key I could have used yesterday to decrypt all the traffic I was capturing until yesterday suddely cannot be used to decrypt the same data, if none of it has changed in my vault?

jnbiche• 12 years ago

No, they're using the term correctly. The plausible deniability in OTR comes as a result of forward security. Since past and future traffic can't be decrypted with a certain captured key, the entity that captures that key can't cryptographically tie an identity to the previous messages.

mandalar12• 12 years ago

It goes futher than that in OTR. After the ephemeral keys are out of use, the public keys (used for encryption, not decryption) are broadcasted so if later someone gets an old encrypted message, it could "effectively" have be written by anyone.

blueskin_4• 12 years ago

Plausible deniability is when you have a hidden datastream inside another encrypted one, as there's no way to prove it is or isn't there without the key. See: TrueCrypt.

PFS means "If the server's private key is later compromised, it can't be used to decrypt past captured traffic".

icebraining4• 12 years ago

I don't get it. If someone capture the SSL cert, they could be MITMing the server. Which means they could be serving poisoned JavaScript code to everyone who was using the website or the bookmarklets, code that could send the master password to the attacker's servers.

How is this not vulnerable?

EDIT: and more, what guarantees can they offer that the plugins downloaded from their site ever since their were vulnerable are not themselves trojanized? OpenSSL has been vulnerable since March 2012, how many downloads did they have since then?

Erwin• 12 years ago

I'm unclear on what you mean by "MITM... serving Javascript to EVERYONE". In a typical MITM scenario, you've logged into your coffee shop with an insecure network, or you are in some Middle Eastern country where all traffic is under control of the government.

Unless you are somehow able to route all traffic through your network, you cannot MITM "everyone", no matter even you have the private certificate for lastpass.com.

jsn• 12 years ago

Of course you can -- for example, if you are NSA and in position to apply pressure to whoever hosts lastpass SSL frontends.

omh• 12 years ago

Yes, I'd say most MITM scenarios are at the client end.

But you could, for example, be an evil network admin near the LastPass servers. That would let you MITM almost everyone who connects.

icebraining4• 12 years ago

Everyone who they were MITMing. I thought that was implied in the context.

pwman3• 12 years ago

Extensions/Downloads are all cryptographically signed -- I'd hope if you're installing password management software like this that you see that it's unsigned or signed by someone other than LastPass.

Using the extensions to login -- it doesn't matter nearly as much if you're MITM as it would if the website was MITM and you login from the website -- what's in the middle is mostly useful only to do things like mess with you -- delete your sites / DOS your account, but in no way exposes your encrypted data.

The combination of extension use instead of going to the website, perfect forward security, data that's encrypted with a key that doesn't leave your devices, the fact that what you'd most likely leak is a session ID which will be replaced on your next login and that we haven't actually seen anyone utilize heartbleed to get a SSL key yet combine to make LastPass a tough target.

Given everything it'd be far easier to target all the banks and email clients that simply send your credentials right over the wire.

This is definitely a big problem and we're currently working on tools to try to help people recognize what's at risk and help them update it.

blueskin_4• 12 years ago

Should have used KeePass. Even HTTPS isn't perfect, so uploading your data to a third party is a bad idea.

Fishkins2• 12 years ago

I've heard people say this before, but I'm a little confused by it. Do you only use one device? If not, how do you keep the PWs for your devices in sync without uploading your data somewhere?

scragg• 12 years ago

I suppose you could carry it on a usb drive.

rquirk• 12 years ago

Don't know about the OP, but I use a combination of sneakernet and scp to keep keepassx up to date across machines.

ds2062• 12 years ago

I've been using Dropbox. Is that a bad idea?

Sprint2• 12 years ago

Using my local network or USB. Aren't most if not all your devices using your network too? There is no need for your private data to leave your network when you want to sync!

rainsford• 12 years ago

KeePass by itself is not a replacement for Lastpass since it lacks (among other things) the ability to sync across devices or support mobile platforms.

lazylizard• 12 years ago

i thought there's built in sync to ftp,webdav.. http://keepass.info/help/v2/sync.html , http://keepass.info/plugins.html#ioprotocolext adds sftp/ftps..

and an android app https://play.google.com/store/apps/details?id=com.android.ke...

blueskin_4• 12 years ago

...then be a hacker and implement it right, rather than wanting an all in one 'solution' that compromises security for the sake of not requiring thought.

borplk• 12 years ago

Thank god I'm using Keepass I can put my head on the pillow comfortably.

theboss4• 12 years ago

I don't understand how anyone can throw last pass under the bus here.

0day where an unbelievable amount of sites are affected. last pass comes out and says we were vulnerable and we fixed it and provides information as to what it means for your data... I wish everyone did that...

edit: A lot of people recommend keepass. keepass is vulnerable to the same thing everyone else is worried last pass was vulnerable to. kee pass' download site is HTTP. You could be getting trojaned binaries and incorrect shasums if you download it from ANYWHERE.

streptomycin• 12 years ago

I installed keepassx through my distro's package manager.

theboss4• 12 years ago

Where do you think they got the package from?

eli• 12 years ago

Well, that's rather unfair to keepass. Presumably you can install keepass the same way you install your browser. If the browser is backdoored you're hosed anyway. In fact, if any process is backdoored you likely hosed.

efuquen3• 12 years ago

Not understanding some of the responses, I think they did a pretty nice job trying to address the issues in their posts. Of course you could have been MITM but the vast majority of that danger comes from using public wifi and if you're smart you should be using a VPN provider anyway.

Realistically speaking here they found out about this at the same time as everyone else did and addressed it pretty quickly and professionally. Is there really anything else they or anyone else could have done, other then just use KeePass? Which has it's own major inconveniences that can only be addressed by some sort of cloud based solution (whether controlled by you or someone else), which probably would very likely have been using OpenSSL as well ...

yblu2• 12 years ago

Any VPN provider that you can recommend?

efuquen3• 12 years ago

I use privateinternetaccess, good reference comparisons:

http://lifehacker.com/5935863/five-best-vpn-service-provider...

https://torrentfreak.com/which-vpn-services-take-your-anonym...

eikenberry2• 12 years ago

Most VPN providers offer openvpn which uses openssl and thus is vulnerable as well.

efuquen3• 12 years ago

yup, good point. A good provider should have multiple protocol options but most people would use the default, something definitely to look into changing from the norm. i.e. if a lot of sites use OpenSSL for https then for your VPN you should probably use a different protocol, so no single vulnerability in either would screw you over.

ctb_mg• 12 years ago

Agreed that cloud services may be using OpenSSL to transfer the KeePass database to/from the client. Presume an attacker obtains the KeePass database via a MITM attack on communications to/from this cloud service. Then what?

The attacker needs to penetrate the defenses of the KeePass database itself, so I'm unsure of the point you're trying to make with KeePass and cloud services.

IgorPartola9• 12 years ago

The issue I have with LastPass is that they claim to never see your master password. This is not true in any sense. Open their website, log in using your master pass. You just submitted it to them. As a secondary thing, pick a random password from the list and say "Show me the password"; it will ask you for your master password. The extension you install has nothing to do with this: you are entering the password directly into their web page and interacting with their JavaScript and their server-side code. At this point they have your master password.

I understand why they do this: it's convenient and lets you share/give passwords to others. But this feature is 100% incompatible with the claim that they never see your master password.

stungeye2• 12 years ago

My understanding is that even with their web login process your password isn't sent to their servers in plaintext. From the comments on their heartbleed blog post: "We only use one-way salted hashes (after going through PBKDF2 rounds) to send to the server for authentication."

So their servers get a hashed version of your password, but not the password itself. Their servers likely also store a hashed version of your password so that they can authenticate you. This style of auth is also used when you use the "show me the password" feature.

IgorPartola9• 12 years ago

This cannot be. Your passwords (the ones you are trying to protect) must be encrypted using your master password. LastPass needs to decrypt them somewhere using your master password. What you are describing is how their browser extension seems to work. However, their website does not require the extension to work. So either they implement security in JavaScript that's running within the page (cannot by definition be done securely), or they store all your passwords in a way that they can decrypt them (invalidates the use case for LastPass).

RainbowRandolph2• 12 years ago

You are not submitting your master password to them. It's been a while since I completely understood the login process, but this should be mostly right:

1. The encryption key is a local hash of your email address and master password. This never leaves your computer.

2. Ignoring PBKDF2, Your encryption key and your master password are again hashed locally. That is sent with your login email to LastPass.

3. LastPass hashes Step 2 with a salt and that result is then used to authenticate you. After any additional two factor auth verification, LastPass will send your password file, which is decrypted using the result in Step 1, that has never left your computer.

You're more than welcome to inspect the JavaScript code yourself. They have a simple encryption, decryption page so you can see exactly what LastPass does.

https://lastpass.com/js/enc.php

davexunit• 12 years ago

Don't worry, you're still storing secret information with a proprietary web service that you can't audit. You're safe!

RainbowRandolph2• 12 years ago

The website and extensions are mostly JavaScript, so you can audit the code yourself if you wish. LastPass does use a proprietary plugin for some features, but they have a binary free version for most, if not all browsers.

DavideNL• 12 years ago

This reminds me of the time when i downloaded the Lastpass iPhone app, synced it with my Macbook's Lastpass, opened the Lastpass iPhone app _for the first time_ and it uploaded all my data to icloud without asking for permission... #fail

It was about a year ago, and at the time the iphone app apparently defaulted to 'sync -> iCloud -> on'.

LocalMan• 12 years ago

Password managers can protect you from being "Hacked" in the manner of destroying all your Gmail, and can help prevent your computer from being enslaved by a botnet. And probably help protect your bank account and any online medical records.

But if the NSA or any competent government targets you as an individual, no password manager can help you. TrueCrypt might help, but even that has vulnerabilities.

LastPass and the Heartbleed Bug

Related Stories