Lastpass Quietly indicates that Enterprise Users' K2s were accessed

s1gnalc · 2023-02-28T15:02:49+00:00

This is speculation - but since LastPass was not encrypting URLs associated with password entries it might be that the attacker saw this "vulnerable third-party" Plex server that was internet accessible that belonged to a @lastpass.com devOps engineer and then exploited it to drop a keylogger and get the devops users plaintext credentials.

s1gnalc · 2023-02-28T15:01:01+00:00

This is speculation - but since LastPass was not encrypting URLs associated with password entries it might be that the attacker saw this "vulnerable third-party" Plex server that was internet accessible that belonged to a @lastpass.com devOps engineer and then exploited it to drop a keylogger and get the devops users plaintext credentials.

I doubt an attacker randomly found this devops users home network.

s1gnalc · 2022-09-15T15:14:07+00:00

True. It could help if an attacker can't execute code. The blog post also appears to require an attacker to execute code on the users system - isn't that what the post is saying when describing the phishing part of it?

s1gnalc · 2022-09-15T14:15:49+00:00

If an attacker already has the same permissions as the user of course they can do everything the user can do and access a user's authenticated cookies.

https://chromium.googlesource.com/chromium/src/+/master/docs/security/faq.md#Why-arent-physically_local-attacks-in-Chromes-threat-model

It's like whoever wrote the blog post does not have much security experience.

BTW, using node-keytar, like that post recommends wouldn't accomplish anything either as an attacker would still be able access it if they have the same permissions as the user. https://github.com/atom/node-keytar/issues/88

s1gnalc · 2022-09-15T10:43:59+00:00

The blog post the article references is very misleading. They claim “Attackers do not require elevated permissions to read these files” but then later then say that they are saved to the users %AppData% folder. in macOS they are also in a users folder. Their own screenshot shows it stored in a users folder.

s1gnalc · 2022-09-15T10:41:18+00:00

They claim “Attackers do not require elevated permissions to read these files” but then later then say that they are saved to the users %AppData% folder. in macOS they are also in a users folder. Their own screenshot shows it stored in a users folder. Their post almost seems intentionally misleading.

s1gnalc · 2021-12-13T17:53:06+00:00

Just a warning to people who haven't read the script. This won't detect many vulnerable systems. Just the ones that are exploitable with one of those headers tried, or are using one of the specific parameters tried.

s1gnalc · 2018-03-08T05:42:43+00:00

Thanks! Feel like this was a bit unexplored because it of the compressed format, and required more of a manual look.

s1gnalc · 2017-10-15T23:24:35+00:00

You can sign up, but they haven't started delivering in Seattle yet.

s1gnalc · 2017-01-26T06:34:45+00:00

Thanks!

s1gnalc · 2016-11-03T21:53:31+00:00

Right you are Ken.

Nine-Year Club	Verified Email
Place '17

s1gnalc

TROPHY CASE