Download as PDF, PPTX
![siesta.py
• Beautifies every JS file
• Injects a payload to every function
• console.log([file] [function] [params])
• Credits to Alberto Garcia (@algillera)](https://image.slidesharecdn.com/shakaconpreso-171203091107/85/Breaking-vaults-Stealing-Lastpass-protected-secrets-15-320.jpg)
![Storage
Chrome Firefox Safari Opera
Windows
#{user_profile['LocalApp
Data']}/Google/Chrome/
User Data/Default/
databases/chrome-
extension_hdokiejnpimak
edhajhdlcegeplioahd_0
#{user_profile[
'AppData']}/
Mozilla/
Firefox/Profiles
#{user_profile['LocalAppData
']}/Apple Computer/Safari/
Databases/safari-
extension_com.lastpass.lpsaf
ariextension-n24rep3bmn_0
#{user_profile['AppData']}/
Opera Software/Opera
Stable/databases/chrome-
extension_hnjalnkldgigidg
gphhmacmimbdlafdo_0
Mac
#{user_profile['LocalApp
Data']}/Google/Chrome/
Default/databases/
chrome-
extension_hdokiejnpimak
edhajhdlcegeplioahd_0
#{user_profile['
LocalAppData']
}/Firefox/
Profiles
#{user_profile['AppData']}/
Safari/Databases/safari-
extension_com.lastpass.lpsaf
ariextension-n24rep3bmn_0
#{user_profile['LocalAppData']
}/com.operasoftware.Opera/
databases/chrome-
extension_hnjalnkldgigidggph
hmacmimbdlafdo_0
Unix
#{user_profile['LocalApp
Data']}/.config/google-
chrome/Default/
databases/chrome-
extension_hdokiejnpimak
edhajhdlcegeplioahd_0
#{user_profile['
LocalAppData']
}/.mozilla/firefox
#{user_profile[‘LocalApp
Data’]}/.opera/widgets/
wuid-*/pstorage
Internet Explorer uses Protected Storage](https://image.slidesharecdn.com/shakaconpreso-171203091107/85/Breaking-vaults-Stealing-Lastpass-protected-secrets-23-320.jpg)
Uploaded byMartin Vigo
Breaking vaults: Stealing Lastpass protected secrets
The document discusses the vulnerabilities associated with LastPass, a widely used password management service. It details various attacks like bypassing two-factor authentication and account recovery vulnerabilities, exposing how attackers can gain access to user vaults by exploiting weaknesses in the browser extensions and the storage methods of sensitive data. The document concludes by suggesting measures to harden LastPass security against potential threats.
More Related Content
Similar to Breaking vaults: Stealing Lastpass protected secrets
![[Easy] LastPass Password Manager Tutorial](https://cdn.slidesharecdn.com/ss_thumbnails/autlastpass-160903043520-thumbnail.jpg?width=640&height=640&fit=bounds)
![[Made Easy] How to use LastPass - Tutorial](https://cdn.slidesharecdn.com/ss_thumbnails/howtouselastpass-170421132328-thumbnail.jpg?width=640&height=640&fit=bounds)
Breaking vaults: Stealing Lastpass protected secrets
- 1. Breaking Vaults Stealing LastPassprotected secrets Martin Vigo @martin_vigo martinvigo.com
- 2.
- 3. Who am I •Product Security Engineer • Spaniard / Galician • Diver • Gin tonic consumer • @martin_vigo / martinvigo.com Most beautiful beach in the world Amazing seafood Charlie Sheen’s grandfather was Galician
- 4. Wikipedia “LastPass is apassword management service which seeks to resolve the password fatigue problem by centralizing user password management in the cloud”
- 5.
- 6. Why targeting Password Managers? •All you want to hack is in one place • Social Networks • Banks • Email accounts • Corporate credentials
- 7. Why LastPass? • Enterpriseedition • Large companies use it • “More than 10,000 corporate customers ranging in size all the way up to the Fortune 500” • Not only credentials • Credit Cards, Personal documentation, Private notes, etc. • Arguably the most popular password manager
- 8. State of theart • Vulnerabilities • DNS poisoning • XSS form injection All focus on leaking specific secrets
- 9. Target: Master Password Allyour secrets are belong to us
- 10.
- 11.
- 12. LastPass browser plugin •Javascript • Sandboxed (SOP) • Injects code into DOM • Access to filesystem
- 13. Security claims • LastPasshas no access to your data • Local encryption • Secure storage
- 14. Reversing Meaning making senseof 3MB of obfuscated JS
- 15. siesta.py • Beautifies everyJS file • Injects a payload to every function • console.log([file] [function] [params]) • Credits to Alberto Garcia (@algillera)
- 16. • Identified allaccessed files • Minimized/obfuscated JS • Storage on Sqlite DBs • Browser specific implementation • Business logic • File location • Storage • AES own implementation • RSA is based on jsbn library Logic and storage
- 17. Local encryption • 256-bitAES • CBC and ECB • Their own implementation • PBKDF2 • 500 / 5000 rounds (default) • Unauthenticated query
- 18. Encryption key PBKDF2-SHA256(Username, MasterPassword, Iterations, 32) Salt Password key length
- 19. LastPass has noaccess to your data PBKDF2-SHA256(Master Password, k, 1, 32) E/D(k, vault) Encrypted Vault Encrypted Vault PBKDF2(SHA-256, Per user salt, k’, 100000, 32)
- 20. What does LastPasssee? The encrypted vault A 1-round PBKDF2-SHA256 of the encryption key
- 21. Stealing the MasterPassword
- 22. Remember password • Storesthe password locally • Sqlite DB or prefs.js • ECB or CBC • u7W1PsEYsWrtAS1Ca7lOOH== • !waXcJg8b7wI8XYZnV2l45A==|4d0Hiq+spx50pso2tEMtkQ==
- 23. Storage Chrome Firefox SafariOpera Windows #{user_profile['LocalApp Data']}/Google/Chrome/ User Data/Default/ databases/chrome- extension_hdokiejnpimak edhajhdlcegeplioahd_0 #{user_profile[ 'AppData']}/ Mozilla/ Firefox/Profiles #{user_profile['LocalAppData ']}/Apple Computer/Safari/ Databases/safari- extension_com.lastpass.lpsaf ariextension-n24rep3bmn_0 #{user_profile['AppData']}/ Opera Software/Opera Stable/databases/chrome- extension_hnjalnkldgigidg gphhmacmimbdlafdo_0 Mac #{user_profile['LocalApp Data']}/Google/Chrome/ Default/databases/ chrome- extension_hdokiejnpimak edhajhdlcegeplioahd_0 #{user_profile[' LocalAppData'] }/Firefox/ Profiles #{user_profile['AppData']}/ Safari/Databases/safari- extension_com.lastpass.lpsaf ariextension-n24rep3bmn_0 #{user_profile['LocalAppData'] }/com.operasoftware.Opera/ databases/chrome- extension_hnjalnkldgigidggph hmacmimbdlafdo_0 Unix #{user_profile['LocalApp Data']}/.config/google- chrome/Default/ databases/chrome- extension_hdokiejnpimak edhajhdlcegeplioahd_0 #{user_profile[' LocalAppData'] }/.mozilla/firefox #{user_profile[‘LocalApp Data’]}/.opera/widgets/ wuid-*/pstorage Internet Explorer uses Protected Storage
- 24. SQLite DB • LastPassSavedLogins2contains the encrypted credentials • No root needed
- 25. prefs.js (Firefox) • extensions.lastpass.loginuserscontains the usernames • extensions.lastpass.loginpws contains encrypted passwords • No root needed
- 26. Master password encryption •AES-256 • IV: Random • KEY: SHA256(username) • Data: !L5b/dOyu4EMdmWCYkASQaw==|cHTFJDy1DQi8dPY0AJL/1B= IV 24 chars (ignoring !) Separator 26th char Data Starting 27th char MP encryption key Vault encryption key
- 27. Profit! • We locatedthe files • We know the encryption system • We have the IV • We have the key • We have the data
- 28. What about 2factor auth?
- 29.
- 30. 2-factor auth • Supportsmultiple platforms • Google Auth, Yubikey, Toopher, etc.
- 31. UUID is the“trust token”
- 33. What’s going on? •How is the request forged? • How is the token generated? • How is it stored? • Where is it stored?
- 34. How is therequest forged? The token is injected into the DOM
- 35. How is thetoken generated? • At plugin installation 32 chars length • 0-9 A-Z a-z !@#$%^&*()_ length lowercase? uppercase? digits? special chars? min digits ambiguous chars? make pronounceable?
- 36. How/Where is itstored? • In plaintext • Firefox • In the file “lp.suid” • Chrome/Safari/Opera • Local-storage SQLite DB
- 37. Design Problems? • Browsersdon’t encrypt local storage • LocalStorage DB and lp.suid are accessible and unencrypted • The token is stored in plaintext • Token is injected in DOM • XSS means game over
- 38. More problems • Sametoken for all browser users • Fixed token till plugin is reinstalled • Untrusting the browser has no real effect • Same token when changing QR Code • Token fixation • Attacker can set a token on the client • Proactive token stealing • Steal token today, use it tomorrow
- 39. Profit! • We havethe file • We know the encryption • We have the data • We have the IV • We have the key • We have the 2-factor token
- 40. What about if: “Rememberpassword” was not clicked There was no way to obtain 2-factor auth token
- 41.
- 42. Wait… What? How isaccount recovery possible if LastPass does not know my password?
- 43. Recovering the account Provideyour email
- 44. Recovering the account Geta unique link
- 45. Recovering the account Pressthe button
- 46. Boom! • Full, unrestrictedaccess to the vault • Attacker can set a new password • But does not have to! • Bypasses 2 factor-auth
- 47. Recover account flow Email GET/s/?s=8aa37bb1bb3FAKE03ad4127 302 Location: /recover.php? &time=1412381291&timehash=340908c353c099c9FAKE6b387002c5a4881ebdf1 &username=test%40test.com&usernamehash=fc7be7e5f6cbec9FAKE2995bd3331c097 POST /otp.php &changepw=ccb2501724FAKE2b575a214e1052 d0fa27b0726b6HASHdb2e1da3952e Recover button
- 48. Can I directlygenerate the recover url? • time: timestamp when the recovery was initiated (the link “expires” in 2 hours) • timehash: salted hash of the timestamp • username: the email address • usernamehash: salted hash of the email 302 Location: /recover.php? &time=1412381291&timehash=340908c353c099c9FAKE6b387002c5a4881ebdf1 &username=test%40test.com&usernamehash=fc7be7e5f6cbec9FAKE2995bd3331c097
- 49. Challenges • I needto generate a valid timestamp • I need the be able to generate the hashes • I need the salt
- 50. Let’s try… • Requestmy own unique url and reuse the hashes in the victims url • BINGO! • Same salt is used for all users • Link does not truly expire, only the timestamp is validated against the hash • There is no need to request account recovery. You only need a valid url
- 51. The salt isthe secret • Still, we need to change the username, and hash it. • We are only missing the server salt to be able to generate valid recover urls • Salts are not designed to be a secret, only random and unique. • Oh wait… “LastPass account email addresses, password reminders, server per user salts, and authentication hashes were compromised”
- 52. Can I forgethe post request? • changepw: a derived “disabled OTP” POST /otp.php &changepw=ccb25017c4FAKE2b575a21441055d0fa27b0726b6HASHdb2e1da395e
- 53. OTPs in LastPass •2 types of OTPs • “True” OTPs for authentication • “Disabled” OTP • Let’s call it dOTP
- 54. Disabled OTP • Usedto recover the vault • Which ultimately means for authentication • It’s set by default • It’s not the encryption key
- 55. How/Where is itstored? • Unprotected • Firefox • In the file {SHA256(username)}_ff.sotp (binary format) • Needs the extra step: bin2hex • Chrome/Safari/Opera • SQLite DB
- 56. How is therequest forged? The dOTP is injected into the DOM
- 57. From dOTP tovault Local-storage getdOTP(username) dOTP token=SHA256(SHA256(username+dOTP2)+dOTP2) /otp.php(username, token) Set-Cookie: PHPSESSID pwdeckey GET /accts3.php encrypted vault
- 58. What is”pwdeckey”? • It’snot the key to decrypt any password • It’s the seed to derive the key to decrypt the “vault key” • The vault key decrypts all the password, notes, etc. in the vault
- 59. So… What isa Disabled OTP again? • A Master Password on steroids • Bypasses IP restrictions • Bypasses 2-factor auth • Bypasses user alerts
- 60. pwdeckey == dOTPtoken *Took me “only” 3 months to notice…
- 61. AES-ECB(SHA256(dOTP_token), encryptedVaultKey ) Vaultkey decryption *Remember: dOTP_token = SHA256(SHA256(username+dOTP2)+dOTP2)
- 62. How/Where is thevault key stored? • Encrypted • Firefox • In the file {SHA256(username)}_lpall.slps • Chrome/Safari/Opera • SQLite DB
- 63. No need toquery LastPass! • dOTP -> Key to decrypt vault key -> Vault key • Encrypted vault is stored locally by default! • Iterations;base64 encoded/encrypted vault • Firefox • In the file {SHA256(username)}_lps.act.sxml • Chrome/Safari/Opera • SQLite DB
- 64. Profit! • We locatedthe token • We know how to hash it • We get the vault key decryption key • We get the vault • We decrypt the vault key • We decrypt the vault
- 65. Automating all thestuff
- 66. Metasploit module • Stealsand decrypts the master password • Steals the 2-factor auth token • Steals the encryption key • Decrypts the entire vault • Supports: • Windows, Mac and Unix • Chrome, Firefox, Safari and Opera • IE coming soon • Meterpreter and shell • Multiuser https://github.com/martinvigo/metasploit-framework Sometime in the next couple weeks
- 67.
- 69. What about ifthere is: No disabled OTP No access to the machine No Exploit No nothing!
- 70.
- 71.
- 72. Stop sharing yourLastPass credentials with the entire world!!!!
- 73.
- 74. Hardening LastPass • Usethe binary version of the plugin • Do not store your master password • Disable “Account recovery” • Do not use “Password reminder” • Activate 2-factor auth • Prompt for master password to make passwords visible • Add country restriction • Update/Randomize PBKDF2 iterations • Disallow TOR logins
- 75.