LastPass Password Service Hacked 268
Trailrunner7 writes "LastPass, a popular Web based password management firm, advised its customers to change the password they use to access the service following what the company said are signs that its network may have been compromised."
KeePass (Score:5, Informative)
Using an online service for something like your passwords is just incredibly stupid. It's a really well known place to hack for someone who wants lots of passwords. Backup your encrypted password container to your own place, but never something like this.
Re: (Score:2)
Some of us don't use windows.
Re: (Score:2)
Ahem [keepass.info].
Hint: try scrolling down. It's probably already in the repository for your distro if you use Linux.
Re: (Score:2)
Really? I use Linux - the Chrome OS distro. Didn't notice it available for that...
Re: (Score:2)
Yes, it's *probably* already in the repository for your distro if you use Linux. If it's not, why not contribute it?
Re: (Score:2)
Simple - the only repository that exists for Chrome OS is the Google Web Store. It only supports Chrome applications or extensions, and Keepass has not been implemented as a Chrome application or extension. You don't need to use the Web Store, but Chrome OS still only runs Chrome applications or extensions.
Lastpass is available as a Chrome extension, and works just fine.
Re: (Score:2)
Sure - just provide me a link.
Hint, it doesn't exist. At least, not to my knowledge. Chrome OS only supports running chrome-based applications and extensions, and Keepass is neither.
Re: (Score:2)
Looks like you just found out the big problem with Chrome OS. You barely run Linux then, in the sense of being a distro that has WILDLY different build requirements from all other desktop distros. It's almost like saying, "Sure I run Linux, the DD-WRT distro, just give me a link".
Re: (Score:2)
Don't have to:
http://sourceforge.net/projects/keepass/forums/forum/329220/topic/4503818 [sourceforge.net]
Re: (Score:2)
http://www.keepassx.org/ [keepassx.org]
Re: (Score:2)
If you think KeePass isn't vulnerable to attacks you just aren't being creative enough.
Re: (Score:2)
Personally, I wrote my own equivalent of SuperGenPass that addresses some of the security concerns [stackoverflow.com]. That said, I use PassPack [passpack.com] with a tediously strong password to keep a backup in case I inadvertantly break compatibility, and a copy of the generator on my website.
Re: (Score:2)
Re: (Score:2)
They will only get lots of passwords from people who are foolish enough to select a brute forcible password as their master. Picking a simple master password is stupid. Storing encrypted data on the internet isn't necessarily stupid.
Not to mention, if you generate random passwords for every service, it's not much labor to just go ahead and generate new ones when situations like this occur. All LastPass clients automatically update to use the new passwords, no big deal.
IMO the convenience of having a central
Re: (Score:2)
I've used both pwsafe and KeePass... I never cared for KeePass, and had just moved all my passwords back to pwsafe when I found out about LastPass, got convinced it was "secure enough" by Steve Gibson, and never looked back.
The big deal for me at the time, once past the "secure enough" thing, was that pwsafe was Windows only. KeePass did not have a means of syncing passwords that might be changed on multiple machines. Even with pwsafe, I had to carry my database around and sync it with my other machines
For a non-.NET open source password manager... (Score:2)
I use Password Gorilla [github.com]. Written in Tcl/Tk, has standalone downloads for Linux, Mac OS X, Windows. Been using it for the last few years, works well for me.
From the wiki:
Password Gorilla is a Tcl/Tk application which can run on Linux, Windows and Mac OS X. The source files written are supposed to be compatible between platforms. They are tested to run on Linux kernel (less than or = to) 2.6.30.5, Windows XP, Windows 7 and Mac OS X 10.6. So it is possible to work with this password manager in heterogenous en
Re: (Score:2)
I'm very happy with KeePass. It enabled me to have a poor man's authentication token:
Instead of using a password to unlock the database, I use a key file stored in an SD card. I mapped one of my laptop's multimedia buttons to the hot key that triggers the global auto-type feature, so that when I need to authenticate somewhere I just have to press that button and hit enter to unlock the database. The authentication is done automatically and the database stays unlocked for 5 minutes. When I leave the computer
Shut up you idiots (Score:2)
Stop spewing crap when you know nothing of the case!
"Using an online service for something like your passwords is just incredibly stupid. It's a really well known place to hack for someone who wants lots of passwords. Backup your encrypted password container to your own place, but never something like this."
Hey, retardo, don't you think the people who made it know this? All of your password are stored on their system ENCRYPTED. They are encrypted on YOUR computer, with a password only YOU (not them) before
Re: (Score:2)
Sssh... Sshhthink istssst's ssshhafe?
Re: (Score:2)
Re:KeePass (Score:4, Insightful)
What's a "secured dropbox account?" Didn't we find out last week that Dropbox has the encryption keys to your stuff and will hand it over to pretty much anyone who asks nicely?
Re: (Score:2)
Re: (Score:2)
You mean that I would have to remember like 2 passwords ???
Oh, come on, what is this ?? The middle ages ???
Re: (Score:2)
I use KeePass primarily because it's the only one I've found for Android that works cross-platform anywhere the way I'd like to use it.
There are quite a few that do this. mSecure (from mSeven software) works on Android, iPhone, Windows, Mac, and allows you to sync all your devices with your own computer.
It will also support backup and restore to any regular file, and the database is encrypted. So your drop box plan continues to work.
Its is password protected rather the key-file protected. You may argue the wisdom of that, but too often the keyfile approach fails because those get stored on the same device.
Re: (Score:2)
There are quite a few that do this.
But, I believe KeePass is the only Android password manager that both open source and no cost.
Re: (Score:3)
"works on Android, iPhone, Windows, Mac"
Missing an important one there... Take a guess...
BeOS ?
Re:KeePass (Score:4, Funny)
yes - I know that if the pass phrases for any of them are
week, the whole thing doesn't make sense.
My pass phrase is month which is four times as strong.
Re: (Score:2)
Re: (Score:2)
Woosh.
Re:KeePass + Wuala (Score:2)
I prefer KeePass + Wuala for even more security. I set up the KeePass file in a synced folder so I can use KeePass to login to Wuala.
http://www.gadberry.com/aaron/2011/04/29/wuala-for-dropbox-users/ [gadberry.com]
Re:KeePass (Score:5, Funny)
I use LastPass because I want access to my passwords at work and Dropbox is blocked. LastPass does the same thing as KeePass+Dropbox, and I can access it from anywhere.
And now, apparently, so can everybody else! That is convenient.
Re: (Score:2)
Is there something wrong with
sudo apt-g[TAB] i[TAB] pwgen
pwgen
?
Re: (Score:2)
You could do a `dd if=/dev/random bs=1 count=256` in there somewhere for some cryptographically secure entropy as well.
Re: (Score:2)
I guess the main benefit of the GP's method is that you won't actually need a "safe" to store your passwords. You can re-generate the same password anytime, anywhere, as long as you remember the master password and "reason."
However, a problem with this implementation is that generated passwords will be hexadecimal only. Not really much entropy per character there (4 bits vs. 6.5x bits for all ASCII printable chars). Just extend the generated password length, I guess.
Personally, I'd use HMAC-SHA-256 or HMAC-
Re: (Score:2)
I'm not sure you appreciate the meaning of the word "random". That's not random at all.
Re: (Score:2)
FUCK YOU, I just lost the game :(
Re: (Score:2)
Well on windows (and perhaps linux as well), any character put into the keyboard message loop is widely available to any application. Key loggers can get these as well, because they are simply messages, which every process can eaves drop on. (Which is how key-loggers usually work, even the hardware ones).
Re: (Score:2)
PasswordSafe has less functionality than KeePass except that there is a compatible command line client for it (pwsafe).
I often use pwsafe from a remote shell and I would switch to a KeePass database if I could find a CLI for it...
Re: (Score:2)
Re: (Score:2)
Welcome to the cloud. You're meant to be lost. All your data are belong to us now, don't worry!
Apparently... (Score:2)
Re: (Score:2)
Re: (Score:2)
Apparently not. They appear to be an awful lot more paranoid than Sony...
Re: (Score:3)
How so?
The data stored on LastPass is, with the exception of the salt and email address (neither of which are sensitive), encrypted. The only risk is to those who used weak "master passwords", and then the bad guys would need to identify which of the encrypted data blobs they got (assuming they actually got any) are weakly secured. This is not exactly easy.
From the LastPass announcement:
In this case, we couldn't find that root cause. After delving into the anomaly we found a similar but smaller matching traffic anomaly from one of our databases in the opposite direction (more traffic was sent from the database compared to what was received on the server). Because we can't account for this anomaly either, we're going to be paranoid and assume the worst: that the data we stored in the database was somehow accessed. We know roughly the amount of data transfered and that it's big enough to have transfered people's email addresses, the server salt and their salted password hashes from the database. We also know that the amount of data taken isn't remotely enough to have pulled many users encrypted data blobs.
In short:
- Not many, if any, encrypted data "blobs" were taken. This means that the odds of an offline attack on the encry
I wonder... (Score:2)
Straight from the horse's mouth: (Score:5, Informative)
Note: This is taken from http://blog.lastpass.com/2011/05/lastpass-security-notification.html [lastpass.com]
***f****f****f******f******f**f**f*f*******f******f*f**f******f******f********
We noticed an issue yesterday and wanted to alert you to it. As a precaution, we're also forcing you to change your master password.
We take a close look at our logs and try to explain every anomaly we see. Tuesday morning we saw a network traffic anomaly for a few minutes from one of our non-critical machines. These happen occasionally, and we typically identify them as an employee or an automated script.
In this case, we couldn't find that root cause. After delving into the anomaly we found a similar but smaller matching traffic anomaly from one of our databases in the opposite direction (more traffic was sent from the database compared to what was received on the server). Because we can't account for this anomaly either, we're going to be paranoid and assume the worst: that the data we stored in the database was somehow accessed. We know roughly the amount of data transfered and that it's big enough to have transfered people's email addresses, the server salt and their salted password hashes from the database. We also know that the amount of data taken isn't remotely enough to have pulled many users encrypted data blobs.
If you have a strong, non-dictionary based password or pass phrase, this shouldn't impact you - the potential threat here is brute forcing your master password using dictionary words, then going to LastPass with that password to get your data. Unfortunately not everyone picks a master password that's immune to brute forcing.
To counter that potential threat, we're going to force everyone to change their master passwords. Additionally, we're going to want an indication that you're you, by either ensuring that you're coming from an IP block you've used before or by validating your email address. The reason is that if an attacker had your master password through a brute force method, LastPass still wouldn't give access to this theoretical attacker because they wouldn't have access to your email account or your IP.
We realize this may be an overreaction and we apologize for the disruption this will cause, but we'd rather be paranoid and slightly inconvenience you than to be even more sorry later.
We're also taking this as an opportunity to roll out something we've been planning for a while: PBKDF2 using SHA-256 on the server with a 256-bit salt utilizing 100,000 rounds. We'll be rolling out a second implementation of it with the client too. In more basic terms, this further mitigates the risk if we ever see something suspicious like this in the future. As we continue to grow we'll continue to find ways to reduce how large a target we are.
For those of you who are curious: we don't have very much data indicating what potentially happened and what attack vector could have been used and are continuing to investigate it. We had our asterisk phone server more open to UDP than it needed to be which was an issue our auditing found but we couldn't find any indications on the box itself of tampering, the database didn't show any changes escalating anyone to premium or administrators, and none of the log files give us much to go on.
We don't have a lot that indicates an issue occurred but it's prudent to assume where there's smoke there could be fire. We're rebuilding the boxes in question and have shut down and moved services from them in the meantime. The source code running the website and plugins has been verified against our source code repositories, and we have further determined from offline snapshots and cryptographic hashes in the repository that there was no tampering with the repository itself.
Again, we apologize for the inconvenience caused and will continue to take every precaution in protecting user data.
The LastPass Team.
UPDATE 1: We're overloaded handling support and
Re:Straight from the horse's mouth: (Score:5, Insightful)
In this case, we couldn't find that root cause. After delving into the anomaly we found a similar but smaller matching traffic anomaly from one of our databases in the opposite direction (more traffic was sent from the database compared to what was received on the server). Because we can't account for this anomaly either, we're going to be paranoid and assume the worst: that the data we stored in the database was somehow accessed. We know roughly the amount of data transfered and that it's big enough to have transfered people's email addresses, the server salt and their salted password hashes from the database. We also know that the amount of data taken isn't remotely enough to have pulled many users encrypted data blobs.
Gotta be honest here: Even if this WASN'T anything, if I had trusted my passwords for everything to some other party like this, I'd very well want them to be more than a bit paranoid in protecting it. So I say, kudos.
Re: (Score:3)
Re: (Score:3)
Re: (Score:2)
Somebody forward this to Sony.
Re: (Score:3)
Reading this makes me more likely to use their service. Well played. Seriously.
Re: (Score:2)
They're re-encrypting (or hashing) the password 100,000 times (basically a big loop) before they end up with the version they store for the user.
This makes it very computationally expensive to try and crack passwords. In the big scheme of things, it might only take a second or so for a modern CPU to perform this operation 100,000 times, however if someone is cracking passwords automatically, going from potentially tens of thousands of cracking attempts per-second to only one or two per-second makes a brute
I guess I'm just old school... (Score:2)
Re:I guess I'm just old school... (Score:5, Insightful)
Either you have an excellent memory or you're reusing the same password on multiple sites. If you're a mere mortal, like me, and you don't want to reuse a few passwords over and over again, you need a password manager.
Re: (Score:2)
Or you could use the same password-salt on multiple sites, with a unique, easy-to-remember base for each site. For example, my base could be "RjZg#sl1", which would produce RjZslshg#sl1 for slashdot, RjZgglg#sl1 for gmail, RjZtwttrg#sl1 for twitter, etc.
You need to memorize eight characters, and one process (remove consonants from service name), and you've got a secure, unique password for each website. It's not perfect - if someone is specifically targeting you, and gets two or three of your passwords in c
Re: (Score:3)
I find that sentences describing my thoughts about the service in question and mapped to leet-speak are easy to remember for a large number of sites.
Some hypothetical examples:
1. Slashdot: d0tc0m1.0d1n0s4ur
2. Twitter: 0hg0dwh0c4r3z4b0utth1zsh1t
3. Flickr: 3y3y4mh3r3f0rth3b00b13z--3y3m34n4rt
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Either you have an excellent memory or you're reusing the same password on multiple sites. If you're a mere mortal, like me, and you don't want to reuse a few passwords over and over again, you need a password manager.
Or, If you're a code like me, you wrote a javascript:sha1( salt + get_master_pw() + host ); bookmarklet [ubuntu.com] which enables you to use the same password everywhere, but generate a site specific hash that you enter into the PW field.
Note: I would use someone else's PW hasher plugin, but I can re-code my own system from scratch in any URL bar, text editor, command shell or programming language to re-gain access to my codes in a worst case scenario...
Re: (Score:2)
Re: (Score:3)
There is more in my life than memorizing passwords. Not much (it seems, at times), but more.
Re: (Score:2)
so how many brains have you lost so far??
Re: (Score:2)
One, his name is Spock, would also have been an acceptable answer.
oh yeah? (Score:2)
Re: (Score:2)
For now....
Army builds brain reading machine. [gizadeathstar.com]
Re: (Score:2)
I use this thing called my brain to store passwords.
I tried that too, but then this happened [youtube.com].
Wel... (Score:2)
Apparently the hackers got only paswords, and not passwords. No big deal then.
One key to rule them all... (Score:2)
"...advised its customers to change the password they use to access the service..."
Wow, I only have to change one password? Whew, that's a relief! For a minute there, I thought I had to change them all. (/sarcasm)
Consolidated password management works, as long as YOU maintain 100% control. Use Truecrypt locally for securing your password file. Sync the encrypted file to the cloud of you want an "online" backup.
Re:One key to rule them all... (Score:5, Informative)
Consolidated password management works, as long as YOU maintain 100% control. Use Truecrypt locally for securing your password file. Sync the encrypted file to the cloud of you want an "online" backup.
LastPass is basically the exact same thing. It's encrypted locally and sent to them AFTER encryption. They don't store the plaintext passwords. The danger is the same either way if a user doesn't use a strong enough password.
Re: (Score:2)
LastPass is basically the exact same thing. It's encrypted locally and sent to them AFTER encryption. They don't store the plaintext passwords. The danger is the same either way if a user doesn't use a strong enough password.
The problem I have with their site is that they use the same password to encrypt your password database that you use to log into the site. So, if somebody puts the equivalent of a keylogger on their server they get everything.
They should have one password to authenticate to the server, and another password to encrypt the passwords that get uploaded to the site. In fact, you'd only need both when logging in from a client that doesn't use Lastpass, since the latter could safely store the former.
Re: (Score:2)
Sure it does:
1. Get root on webserver.
2. Edit login page. New login page has the user enter their password into a box, and send the password in the clear to the server (fully protected by SSL of course).
3. Send copy of password to wherever.
4. Do whatever the previous secure implementation did with the users's password and pass that into the authentication routine so that the app works fine.
SSL/TLS only protects you against attacks to data in-transit. Now, SSL client certificates would completely preve
Re: (Score:2)
Pick your poison....
If you go with LastPass - you get great integration/ease of use and you can access your passwords from any place with internet access. For that ease of use, you run the risk of LastPass's servers being hacked and hoping that the encryption they use is strong enough and that your password isn't vulnerable to a dictionary-type attack.
If you take your approach - you get limited integration/ease of use and you can only access your passwords from any place where you can access gpg.
In either
Re: (Score:2)
No, because if you encrypt your own material you hold the keys. If you let someone else do it, they hold the keys. And who knows how good they are at keeping them safe.
You always know how good you are (or, how bad you are) at keeping your own keys safe.
Keepass(x), gpg encrypted file backup with the gpg keys backed up on a CD in a bank safety deposit box. (and if you're daring, a copy of the key on a usb jump drive you keep on your person at all times)
Don't forget the copy you keep in your head and enter whenever you need to access the safe; you're vulnerable at that point to a key logger. :)
With LastPass, you encrypt your own material, LastPass never holds the keys. LastPass works exactly the same as KeePass: there's a binary blob that is kept on an Internet-accessible server, and you download the blob and decrypt it locally. All they have is an encrypted version of your key, just like in your Linux/Mac/Windows desktop system. Yeah, maybe they could
This. (Score:2)
Re: (Score:2)
Its just like anything else, be smart about it. It doesn't force you to use it for every site so don't. I use it for all my forums, some email, some social sites, basically anything that if stolen, doesn't matter, well over 100 sites. I don't use it for anything connected to any part of my finances, credit cards, or my big selling or buying sites (ebay,amazone,etc), a much smaller 10-20 sites. Using it this way is worry free and does simplify things. You still have multiple passwords, but at least the
They didn't pull a sony (Score:4)
Re: (Score:2)
Wow. I'm going to check out their service then - that's obscenely ethical.
Re: (Score:2)
That was my reaction too. If they are this cautious about unexplained traffic then maybe a online password service (run by them) isn't the disaster I thought it would be.
Headline Edit (Score:5, Informative)
LastPass Pasword Service may have been Hacked.
This is a good story, but the story isn't that they were definitely hacked. It's entirely possible that the anomalous data transfers they mentioned were caused by internal testing and not properly documented, based on the limited information we have available.
Here is a transcript wherein Steve Gibson talks at length about why LastPass is secure [grc.com].
Re: (Score:2)
He's more trustable than an AC.
Some of Mr. Gibson's opinions are a bit excessive (like the whole 'stealth ports' thing), but he usually gets the facts right.
I noticed something happened last night (Score:2)
So why ... (Score:2)
... does anyone believe storing sensitive informaiton in the "cloud" or the Internet?
Where do you store your passwords? (Score:2)
Re: (Score:2)
Your question is missing a component. So why does anyone believe X what? Where X is "storing sensitive information in the 'cloud' or the Internet"? Is a good idea, presumably?
Ridiculous (Score:2)
They weren't "hacked", they saw a tiny anomaly in their network traffic (which honestly, most companies wouldn't even have noticed), and decided to notify you about it and handle it in the most paranoid way possible. It's such a small thing that I wouldn't have expected most companies to even tell anyone it happened.
But somehow them behaving in a very commendable way for a security company has blown up into an absolute PR nightmare for them, with sites lik
Site Overloaded (Score:2)
They just got slasdotted, efuct, dugg, and twitter bombed all at once. Read more [lastpass.com].
Re: (Score:2)
And here is the actual text, for those of you trying to avoid irony in your diet.
Their blog is hosted @ Google not @ Lastpass (Score:2)
ping blog.lastpass.com
PING ghs.l.google.com (74.125.93.121) 56(84) bytes of data
ping lastpass.com
PING lastpass.com (96.255.24.82) 56(84) bytes of data.
Not very ironic when you know how DNS works.
Hacker convenience (Score:2)
So... (Score:2)
"LastPass, a popular Web based password management firm, advised its customers to change the password
They need to change the name of the company to "Second to LastPass"?
Re: (Score:2)
ThirdToLastPass: It's the antepenultimate.
NOW I'm angry, PSN hack meh (Score:2)
Fuck the PSN hack, who gives a shit about that, 99.9999999% of the time banks will allow me to simlply refute credit card fraudulent purchases. It costs me NOTHING but inconvienience.
I was a loyal foxmarks user, then xmarks, then they told me I had to use lastpass.
Well look how this has worked fucking out then, I am PISSED - jesus fuck is there some important passwords in my account.
For fucks sake.
Re: (Score:2)
Being that your passwords haven't been compromised (at least based on the most recent information they've posted), I don't see how this is remotely an issue.
As they state on their site, "We know roughly the amount of data transfered and that it's big enough to have transfered people's email addresses, the server salt and their salted password hashes from the database. We also know that the amount of data taken isn't remotely enough to have pulled many users encrypted data blobs."
Best case scenario, there ar
I use the more secure password system evah! (Score:2)
It's called, my memory.
It's so secure, I might not even know the password i use. I like it better that way, don't have any written down passwords, don't have any "cloud" storage of a password vault, don't have an encrypted file/database of passwords i use.
Sure, on the occasion I have to retype in passwords till I get the right one, but not that often.
Using a program for passwords, reminds me of this little true story:
My buddy kept all his phone numbers on his Atari 130XE, which I said, "What if you don't
Re: (Score:2)
When you are up to your ass in alligators, it is difficult to remind yourself that your initial objective was to drain the swamp.
Re: (Score:2)
Of course not. IT departments have been cut to the bone and the budget to hire an outside security auditor is now the CEO's bonus for cutting IT costs. The few SysAdmins left working in most IT departments are too frazzled to pay much attention to security and management mostly looks at any spending on IT security like buying insurance - we won't spend that money until after the house has burned down because before then there's we don't care.
Just look at the earlier article here on Slashdot [slashdot.org] to see how muc
Re: (Score:2)
Don't blame the admins. In so many private companies, the PHBs decide that security has no ROI, so at best they give lip service to it.
Guess what smaller businesses say about a security breach? "Geek Squad can clean the mess up and we can call them 24/7".
Bigger businesses really are not affected because there is no financial incentive to. Customer list a .torrent on an ID theft side? Doesn't result in quarterly losses, and will be quickly forgotten.
It will take governments stepping in before anything is
Re: (Score:2)
The company admits they had 'unexplained' traffic with more data coming from the database than going to the database. They were unable to track down the source of the traffic and have started some password changing strategy for the users.
Re:Hacked? (Score:4, Funny)
My climbing gym web site was hacked recently and used for a phishing scam and general fun for the script kiddies. The annoying part is that, even with absolutely nothing critical to lose (other than site up-time due to our host taking the site down), there is still a lot of work to do just to make sure they didn't leave another back door. I know this because...I missed the backdoor. They dropped a nice PHP script on the server that gave them unrestricted access.
Anyway, the point is that just thinking one has been breached is shitload of work for someone, and probably a good reason to beat the bad publicity of a full breach with a press release that at first sounds worse than it well may be.
Re: (Score:2)
In olden times that was probably reasonable, but I've got well over a hundred passwords on file. It's hard enough to get around and change more than a few from time to time, but trying to actually remember them? Good luck without some sort of utility.