November 19, 2015 By Shane Schick 2 min read

Single sign-on (SSO) services are supposed to make computing more secure than juggling multiple passwords, but security researchers have proven that LastPass contained design flaws and other issues that could have exposed user credentials to all kinds of exploits.

In a blog post published in conjunction with their presentation at the Black Hat Europe conference, Salesforce security engineers Martin Vigo and Alberto Garcia Illera outlined ways to get around LastPass from outside or internally via the client or server. This included bypassing the service’s two-factor authentication via a locally stored token that’s written in plaintext, fooling the password recovery feature and targeting session cookies, among other approaches. Perhaps most troubling was their discovery of a custom_js parameter cybercriminals could use to inject JavaScript to steal user logins and passwords.

As one might expect, the researchers duly reported their findings to LastPass, which immediately made changes to address the holes. However, as noted by David Bisson on security consultant Graham Cluley’s blog, there are probably holes within many other password managers and SSO services. However, that doesn’t mean it’s better not to use them or to fall back on easy-to-decipher or default passwords, which is often still the case with many computer users.

In fact, Tom’s Guide suggested that it would be difficult for cybercriminals to break into LastPass the way the researchers did if they weren’t also able to get at the user’s server and/or actual machine. As a result, the effort required to break into a server or steal user credentials would probably means hackers pursue other methods instead. Still, given that the service is used by thousands of organizations, the researchers’ findings could have some CISOs and their teams worried.

One of the complicating factors in this case, as SecurityWeek pointed out, is that LastPass suffered a data breach earlier this year; it was acquired in October by LogMeIn, which was also attacked by cybercriminals last year.

This marks the second year in a row the Salesforce researchers identified problems with LastPass. Add them up, and all those things mean the combined organization will have to work harder than ever to demonstrate to customers that they shouldn’t migrate and their information will remain secure.

More from

CISA hit by hackers, key systems taken offline

3 min read - The Cybersecurity and Infrastructure Security Agency (CISA) — responsible for cybersecurity and infrastructure protection across all levels of the United States government — has been hacked.“About a month ago, CISA identified activity indicating the exploitation of vulnerabilities in Ivanti products the agency uses,” a CISA spokesperson announced.In late February, CISA had already issued a warning that cyber threat actors are exploiting previously identified vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure gateways. Ivanti Connect Secure is a widely deployed…

Cloud security evolution: Years of progress and challenges

7 min read - Over a decade since its advent, cloud computing continues to enable organizational agility through scalability, efficiency and resilience. As clients shift from early experiments to strategic workloads, persistent security gaps demand urgent attention even as providers expand infrastructure safeguards.The prevalence of cloud-native services has grown exponentially over the past decade, with cloud providers consistently introducing a multitude of new services at an impressive pace. Now, the contemporary cloud environment is not only larger but also more diverse. Unfortunately, that size…

PixPirate: The Brazilian financial malware you can’t see

10 min read - Malicious software always aims to stay hidden, making itself invisible so the victims can’t detect it. The constantly mutating PixPirate malware has taken that strategy to a new extreme. PixPirate is a sophisticated financial remote access trojan (RAT) malware that heavily utilizes anti-research techniques. This malware’s infection vector is based on two malicious apps: a downloader and a droppee. Operating together, these two apps communicate with each other to execute the fraud. So far, IBM Trusteer researchers have observed this…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today