Google Project Zero is a team of highly talented security analysts with a brief to uncover zero-day vulnerabilities. If a vulnerability is found, Project Zero reports to the vendor concerned and starts a 90-day countdown for a fix to be issued before full public disclosure is made. LastPass is also in the security business, being one of the most popular password management solutions with more than 16 million users, including 58,000 businesses. Project Zero has just disclosed that a security vulnerability left some of those 16 million users exposed to the risk of credential compromise as, in an ironic twist, LastPass could leak the last password used to any website visited.
How could the LastPass ‘last password’ vulnerability be exploited?
In a tweet posted September 16, Google Project Zero analyst Tavis Ormandy stated that “LastPass could leak the last used credentials due to a cache not being updated,” adding “this was because you can bypass the tab credential cache being populated by including the login form in an unexpected way!”
Ormandy reported the vulnerability on August 29, as Project Zero issue 1930, which showed how the credentials previously filled by LastPass could be exposed to any website under certain circumstances.
Ferenc Kun, the security engineering manager for LastPass at LogMeIn, which owns LastPass, said in an online statement that this “limited set of circumstances on specific browser extensions” could potentially enable the attack scenario described.
“To exploit this bug, a series of actions would need to be taken by a LastPass user including filling a password with the LastPass icon, then visiting a compromised or malicious site and finally being tricked into clicking on the page several times,” Kun said, “any potential exposure due to the bug was limited to specific browsers (Chrome and Opera.)”
The answer, thankfully, is nothing. LastPass has already patched the vulnerability, and the fix was comprehensively verified with Project Zero. Indeed, the fix was rolled out on September 13, and Kun confirmed that “we have now resolved this bug; no user action is required and your LastPass browser extension will update automatically.”
As a precaution, the LastPass update was deployed to all web browsers and not just Chrome and Opera.
How severe was this vulnerability and should you stop using LastPass?
Let’s deal with the last part of that question first; there’s absolutely no reason to stop using LastPass or your preferred password manager for that matter. “Although password managers like any other software have flaws the benefits of using one far outweigh the risks,” says ethical hacker John Opdenakker. “It’s far more likely that your accounts will get compromised by attacks that exploit poor passwords,” Opdenakker says, “such as through credential reuse, than by attacks against password managers themselves.”
OK, so how serious was this particular vulnerability? It certainly sounds serious enough, right? Tavis Ormandy at Project Zero allocated the vulnerability a “high” severity rating. Opdenakker isn’t so sure it merits that. “I think it’s most important that LastPass fixed this bug, which is certainly not a critical one, within a reasonable amount of time,” Opdenakker says, “it’s debatable whether it’s high or medium because, as Ormandy says, it doesn’t work for all URLs.”
LastPass security recommendations
Ferenc Kun said that LastPass continues to recommend the following best practices for added online security:
- Do not click on links from people you don’t know, or that seem out of character from your trusted contacts and companies.
- Always enable Multi-Factor Authentication (MFA) for LastPass and other services like your bank, email, Twitter, Facebook, etc.
- Never reuse your LastPass master password and never disclose it to anyone, including us.
- Use different, unique passwords for every online account.
- Keep your computer malware-free by running antivirus with the latest detection patterns and keeping your software up-to-date.
More at Forbes