LastPass’ Authenticator app is not secure

[Danielx64]

I’ve found a really easy way to bypass the fingerprint/PIN authentication that protects all of your 2FA codes. The Android app, produced by LastPass, doesn’t use the same protection that their flagship app uses (like locking when idle, lock on screen off, etc).

All you need is access to individual activities (“screens” of apps). You don’t need root to access these; pre-Oreo you can use an app like Adam Szalkowski’s Activity Launcher or if you’re on Oreo you can use sika524’s QuickShortcutMaker.

This is scary as.

 

[upnorth]

Fixed with the latest update : LastPass Authenticator - Android Apps on Google Play

Update information from LastPass : An Update to the LastPass Authenticator App - The LastPass Blog

 

[ForgottenSeer 58943]

Try Bit Warden. Opensource. Professional. Secure. FREE

The team that did Bit Warden wanted a Last Pass clone, but not the increasing price of membership to Last Pass or the security issues it's had over time.

 

[DeepWeb]

Already fixed. No software will ever be fully secure, but it's good to know that the team at LastPass patches any vulnerabilities within 24 hours.

 

[ForgottenSeer 58943]

Already fixed. No software will ever be fully secure, but it's good to know that the team at LastPass patches any vulnerabilities within 24 hours.

24 hours? What are you smoking? They were notified in JUNE and failed to act. This is why I never used or trusted this product. It's nothing but a joke.

13th June 2017: Reported to LastPass support with proof. Jed from LP confirms that he can reproduce the issue

20th June: Followed up asking for an ETA. Support confirm that there is no ETA

7th December: Followed up, ticket pushed to “level 3 support”. Johnny from LP confirms that there are no updates and it is “still being investigated”.

8th December: Informed support that I would be publishing the details, received no response.

24th December: Published the details, received no response.

28th December: Last Pass issues a patch to fix it.

 

[shmu26]

24 hours? What are you smoking? They were notified in JUNE and failed to act. This is why I never used or trusted this product. It's nothing but a joke.

13th June 2017: Reported to LastPass support with proof. Jed from LP confirms that he can reproduce the issue

20th June: Followed up asking for an ETA. Support confirm that there is no ETA

7th December: Followed up, ticket pushed to “level 3 support”. Johnny from LP confirms that there are no updates and it is “still being investigated”.

8th December: Informed support that I would be publishing the details, received no response.

24th December: Published the details, received no response.

28th December: Last Pass issues a patch to fix it.

That's not very confidence-inspiring.

 

[DeepWeb]

24 hours? What are you smoking? They were notified in JUNE and failed to act. This is why I never used or trusted this product. It's nothing but a joke.

13th June 2017: Reported to LastPass support with proof. Jed from LP confirms that he can reproduce the issue

20th June: Followed up asking for an ETA. Support confirm that there is no ETA

7th December: Followed up, ticket pushed to “level 3 support”. Johnny from LP confirms that there are no updates and it is “still being investigated”.

8th December: Informed support that I would be publishing the details, received no response.

24th December: Published the details, received no response.

28th December: Last Pass issues a patch to fix it.

Well in this case. They probably have a bucket list of vulnerabilities and their desktop app/extensions take first priority most likely. And then there needs to be testing that the issue can be reproduced on all devices and all versions of Android, the fix doesn't break other features (on all versions and devices), is proof against future exploits that are similar, etc on all versions and devices of Android. Needless to say it is probably a pain in the butt to develop for Android since apps don't even have the same permissions across versions. There have been other cases where they did respond as quickly as they could. 24 hours was silly of me.

To give them a break, you either need physical access to the device or have malware on your device for it to be vulnerable. Honestly if either one is the case, you are already screwed. So the key here is to not allow physical access and to prevent malware and you should be fine.

 

[shmu26]

Apparently it was never exploited in the wild, at least I didn't hear about it.

 

[ForgottenSeer 58943]

Apparently it was never exploited in the wild, at least I didn't hear about it.

I'm sure the spooks did though. LOL

I understand development cycles, but June for a critical exploit is horrid. IMO of course. I'd drop any company like a rock that failed to address a critical vulnerability within a reasonable period of time.