LostPass: A worryingly simple phishing attack aimed at LastPass users

[Jack]

Content source

http://net-security.org/secworld.php?id=19340

Security researcher (and Praesido CTO) Sean Cassidy has demonstrated at ShmooCon how easy it can be for hackers to steal LastPass users' email, password, and two-factor authentication code via a simple phishing attack.

With this information in hand, the attackers can access the victim's LastPass vault and all the information in it - passwords, sensitive info, etc. - without the victim's knowledge, and change certain settings so that they continue to have access to it in the future.

The attack - dubbed LostPass by Cassidy - relies on the fact that LastPass effectively trained users to expect notifications in the browser viewport (the area below the tab bar and URL address bar (as seen here):

The LastPass login screen and two-factor prompt are shown in the viewport as well.

By luring victims to a malicious website or a real one that is vulnerable to XSS, the attackers are able to show a fake login expired notification. Due to the fact that LastPass is also vulnerable to a logout CSRF flaw, the website can also log any user out of LastPass, so the fake notification is even more convincing.

"Once the victim clicks on the fake banner, direct them to an attacker-controlled login page that looks identical to the LastPass one," Cassidyexplained.

"The victim will enter their password and send the credentials to the attacker's server. The attacker's server will check if the credentials are correct by calling LastPass's API. The API will inform us if two-factor authentication is required."

Read more: LostPass: A worryingly simple phishing attack aimed at LastPass users

 

[hjlbx]

I was waiting for something like this...

 

[ravi prakash saini]

I use my old mind to remember password

 

[Rishi]

LastPass has quickly tried to fix this it seems :

In a subsequent post, LastPass said it now prevents malicious pages from logging users out of the password manager. The malicious page will still say the user has been logged out although a quick check of the LastPass extension in the browser toolbar will show it as still logged in.

Should the user miss this nugget of information, LastPass will pop up a warning whenever the master password is entered on a non-LastPass page. If this is somehow suppressed, the attacker still likely won't get far as LastPass has an e-mail verification system in place requiring a user to authorize a login from an unknown device or location.

Source :
LastPass does more to protect against phishing attacks
However no official bugfix/changelog in their forums or website.

 

[jamescv7]

Always keep on eye on the websites you visit, sometimes a typical user will be panic if dismissing the message shouldn't solve the problem and as much as possible being knowledgeable with supervision must prevent those classic attacks.

 

[pneuma1985]

Makes you wonder how long this has been going on before someone figured out it was a phising attack? Time to change your unbelievably long lastpass password I remember that one lol