LastPass Password Manager a 'Phishing Risk'

A security researcher says he's published proof that users of password manager tool LastPass could easily be tricked into handing over login details. LastPass insists there is no bug with the service itself, but has made some changes to mitigate the issue.

Sean Cassidy published details of the potential attack at a security conference. He says the way LastPass operates makes it too easy to create bogus looking login pages that could fool users into handing over their login credentials.

According to Cassidy, two main problems combine to create the phishing risk. One is that LastPass displays messages to the user in the browser viewport - that's the main part of the browser which effectively displays a website page (not including the site URL). The second problem was that LastPass was set up to allow remote logouts from the service.

Bogus Login Screen An Identical Copy

In his demonstration, Cassidy showed that as long as users were on a malicious website, or one with a security flaw, it was possible to not only log out of LastPass, but to then show a bogus message in the viewport asking users to log back in. That could then trick users into handing over their master LastPass login, and thus expose all their stored passwords.

Cassidy says the bogus message looks convincing because there's no difference between it and the real thing: "It's pixel-for-pixel the same notification and login screen." (Source: seancassidy.me)

LastPass has addressed the claims on its support site. It insists there's no security vulnerability with the service, but has added several steps to make it less likely a user will fall for a phishing attack.

Remote Logouts Now Blocked

One such defense is to completely block remote logouts. Even if the attacker was able to create the bogus login request, the browser extension for LastPass will still show the user is logged in. LastPass has also tweaked its setting so that users can't simply login from any machine. If somebody tries logging into an account from a previously unused location or device, LastPass will now send an email with a verification link.

Another change is to more strongly warn the user if they are typing their LastPass master password into any other site or service, including the bogus login form from the attack Cassidy describes. Finally, LastPass is working on alternative ways to display notifications other than the viewport, which could make it harder to create convincing bogus messages. (Source: lastpass.com)

What's Your Opinion?

Do you use LastPass and do you think LastPass has done enough to address this security issue? Is it worth putting up with an extra bit of inconvenience, such as email verification when using a new machine, for added security? Do you trust password manager tools or is it too much risk putting all your passwords in one (virtual) place?