full-disclosure - Re: Lastpass Security Issue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 5 May 2011 22:09:29 +0100
From: Benji <me@...ji.com>
To: Ryan Sears <rdsears@....edu>
Cc: full-disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: Lastpass Security Issue

They've said nothing about what they're going to do to the server with said
anomaly. Wouldnt be happy until a full reinstall.

On Thu, May 5, 2011 at 11:39 AM, Ryan Sears <rdsears@....edu> wrote:

> Hey all,
>
> Early this morning the folks over at LastPass decided to issue a warning
> about a potential security issue based on the fact that they detected some
> anomalies in their logs.
>
> http://blog.lastpass.com/2011/05/lastpass-security-notification.html
>
> Basically the post outlines the fact that even though they've investigated
> everything they can think of, they still noticed data potentially being
> exfiltrated from one of their DBs, as more information came out then was
> going in. Because of the fact they can't account for the traffic from any
> legitimate source, they're being paranoid and assuming the worst (that
> someone found a SQL injection presumably).
>
> Even though their passwords were all salted, they're still forcing everyone
> to change their master password. Those using 2-factor are relatively
> un-affected, although they have to change their master passwords as well.
>
> This might leave some people who use lastpass in 'Re-enable account hell',
> where they have their email password stored on lastpass, but can't verify
> and login to lastpass without clicking an activation link in their email.
> This can be solved by using one of the plugins in offline mode with your old
> master password. I'm not sure why they didn't mention it, but this has
> solved a lot of people's problems.
>
> All in all IMHO these guys take security quite seriously. They noticed an
> anomaly, investigated and hours later posted something about it on their
> blog. I'm not sure why no emails have been sent out, but there has been
> speculation that it would have taken too long (
> http://blog.lastpass.com/2011/05/lastpass-security-notification.html?showComment=1304571300013#c1232708813079521918),
> which I don't really agree with. That should've been their first step IMHO,
> and that's where they fell on their face a bit with all this.
>
> They DO put impressive security measures into place when something does
> happen though, as seen in the XSS bug found. They implemented HSTS,
> X-Frame-Options, CSP, which I've only seen used in super rare cases:
>
> http://blog.lastpass.com/2011/02/cross-site-scripting-vulnerability.html
>
> They're also implementing PBKDF2, so that makes me feel as though with
> every security issue they're dealing with they don't just identify and
> re-mediate, but actually restructure their infrastructure in order to hedge
> against any potential future attack vectors. I personally see this as the
> best response of any company I've ever seen from a security standpoint.
>
> Thoughts?
>
> Ryan
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/