Date: Thu, 5 May 2011 22:12:15 +0100
From: Cal Leeming <cal@...whisper.co.uk>
To: Benji <me@...ji.com>
Cc: full-disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: Lastpass Security Issue

+1 reason why people should never used centralized password / form storage
tbh.

On Thu, May 5, 2011 at 10:09 PM, Benji <me@...ji.com> wrote:

> They've said nothing about what they're going to do to the server with said
> anomaly. Wouldnt be happy until a full reinstall.
>
> On Thu, May 5, 2011 at 11:39 AM, Ryan Sears <rdsears@....edu> wrote:
>
>> Hey all,
>>
>> Early this morning the folks over at LastPass decided to issue a warning
>> about a potential security issue based on the fact that they detected some
>> anomalies in their logs.
>>
>> http://blog.lastpass.com/2011/05/lastpass-security-notification.html
>>
>> Basically the post outlines the fact that even though they've investigated
>> everything they can think of, they still noticed data potentially being
>> exfiltrated from one of their DBs, as more information came out then was
>> going in. Because of the fact they can't account for the traffic from any
>> legitimate source, they're being paranoid and assuming the worst (that
>> someone found a SQL injection presumably).
>>
>> Even though their passwords were all salted, they're still forcing
>> everyone to change their master password. Those using 2-factor are
>> relatively un-affected, although they have to change their master passwords
>> as well.
>>
>> This might leave some people who use lastpass in 'Re-enable account hell',
>> where they have their email password stored on lastpass, but can't verify
>> and login to lastpass without clicking an activation link in their email.
>> This can be solved by using one of the plugins in offline mode with your old
>> master password. I'm not sure why they didn't mention it, but this has
>> solved a lot of people's problems.
>>
>> All in all IMHO these guys take security quite seriously. They noticed an
>> anomaly, investigated and hours later posted something about it on their
>> blog. I'm not sure why no emails have been sent out, but there has been
>> speculation that it would have taken too long (
>> http://blog.lastpass.com/2011/05/lastpass-security-notification.html?showComment=1304571300013#c1232708813079521918),
>> which I don't really agree with. That should've been their first step IMHO,
>> and that's where they fell on their face a bit with all this.
>>
>> They DO put impressive security measures into place when something does
>> happen though, as seen in the XSS bug found. They implemented HSTS,
>> X-Frame-Options, CSP, which I've only seen used in super rare cases:
>>
>> http://blog.lastpass.com/2011/02/cross-site-scripting-vulnerability.html
>>
>> They're also implementing PBKDF2, so that makes me feel as though with
>> every security issue they're dealing with they don't just identify and
>> re-mediate, but actually restructure their infrastructure in order to hedge
>> against any potential future attack vectors. I personally see this as the
>> best response of any company I've ever seen from a security standpoint.
>>
>> Thoughts?
>>
>> Ryan
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>>
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists