Skip to main content
  1. Home
  2. Computing
  3. News

Latest bugs in LastPass allowed attackers to steal passwords

Jonathan Keane
By

A hand on a laptop in a dark surrounding.
Password manager LastPass is patching a number of critical vulnerabilities in its software that left users’ passwords potentially leaking.

No software is ever totally safe and while password managers can offer a degree of security and convenience, they are not impervious as these security flaws demonstrate.

Related Videos

The latest bugs were discovered by Google Project Zero researcher Tavis Ormandy, who is renown for finding and disclosing flaws in security software. Ormandy said he found a vulnerability that allows for the stealing of passwords by running a binary version of the password manager’s extension.

Related

In a proof of concept, Ormandy demonstrated using the code to launch an application. He opened the calculator in Windows but, he said, a malicious actor could use this code to steal password details when the manager is entering them into the login fields.

“That doesn’t look good, this script will proxy unauthenticated window messages to the extension. This is clearly a mistake, because anybody can do [it],” he wrote in his advisory.

“Therefore, this allows complete access to internal privileged LastPass RPC [remote procedure calls] commands,” he said.

I found another bug in LastPass 4.1.35 (unpatched), allows stealing passwords for any domain. Full report will be on the way shortly. pic.twitter.com/9VkV7R3vud

— Tavis Ormandy (@taviso) March 21, 2017

LastPass said in a tweet that this has been fixed and promised a blog post with more details on what went wrong but the post has yet to materialize.

Ormandy also found remote code execution vulnerabilities in the password manager’s Chrome and Firefox extensions. The Chrome bug has since been patched but the Firefox version remains unpatched for now but this may be due to a hold up on Mozilla’s end.

“We are aware of reports of a Firefox add-on vulnerability. Our security is investigating and working on issuing a fix,” said LastPass on Tuesday night.

This isn’t the first time that Ormandy has poked holes in LastPass’ software. In 2016, he disclosed a Firefox-related flaw that would have allowed an attacker to access someone’s extension, without them knowing, and delete the passwords.

Editors' Recommendations

Topics
LastPass, used by millions, may be vulnerable to shockingly simple exploits

LastPass was vulnerable, a white hat hacker at Google's Project Zero claimed Tuesday. A patch for the problem was out by Thursday, Engadget is reporting.

Tavis Ormandy, a researcher affiliated with Google's security research team Project Zero, sarcastically asked if anyone actually uses LastPass on Twitter yesterday, adding that he found a bunch of fundamental security problems with little more than a quick glance, Betanews is reporting. LastPass is the most popular password storage service on the planet, with millions of users.

Read more
Americans know they shouldn't share their passwords, but do it anyway
web of trust privacy investigation password man with computer security

95 percent of Americans share at least six passwords with friends or family, even though most people acknowledge this is a bad idea.

That's according to a LastPass survey of its users, released today in a blog post by Amber Gott that includes an infographic summarizing the findings. The vast majority of passwords, it turns out, aren't shared online: they're shared verbally: 74 percent of passwords were shared out loud. 15 percent were shared using pen and paper, leaving around 10 percent to be shared via texting, email, and password management services combined.

Read more
Despite security revisions, the secrecy of your passwords may still be at risk with LastPass
lastpass on phone

LastPass is what's considered a single sign-on service, or SSO. It compiles all of your passwords into a single vault that can auto-fill forms at any time. It's convenient, saves time, and is allegedly more secure than the alternative -- typically using the same password for everything.

Security researchers have determined, however, that LastPass is far from perfect. It has been found to contain the types of holes that any amateur hacker could have a field day with. Given the proper tools, user data could have easily gotten into the wrong hands, revealing myriad private login credentials and leaving them vulnerable to a host of dangerous exploits.

Read more