You can think of it as a local site that uses HTML and JavaScript within your Browser. You will be presented with the vault log-in page. You can confirm this by visiting the URL chrome-extension://hdokiejnpimakedhajhdlcegeplioahd/vault.html in your address bar. The Lastpass extension uses hdokiejnpimakedhajhdlcegeplioahd as the ID. On Chrome Browsers each extension has a unique ID. In the next sections I will demostrate how to extract the encrypted vault database from the Chrome extension and pull out specific information to start cracking with Hashcat. This includes the SQLite database used by the Browser extension and data within it. What is the key iteration (default or custom)?Īnd since I don’t know what the stolen data looks like, or how it may be encrypted, this blog post is only a theory and estimation based on data I have access to.Did a customer set a weak and easily guessed vault password?.How are the encrypted vaults stored in the cloud?.
It really depends, there are a lot of things to consider. What can attackers do with the stolen vaults? # source-code and other intellectual property.company names, end-user names, billing addresses, email addresses, telephone numbers, and the IP addresses.Lastpass didn’t do a good job at letting the public (and customers) know of how bad the breach actually was. To summarise, in August 2022 Lastpass suffered a data breach where customer data and source code was stolen. There is also a blog post by Lastpass themselves. The Verge published an article which includes a great summary of the breach. Update 2: More clarification on cracking section, added unencrypted URLs to the what was stolen section, and added a link to a Hashcat benchmark for Lastpass from 2013. Update: Fixed a few mistakes and added more clarification. Following this, I will use a wordlist attack to bruteforce the vault which has a weak and guessiable password. To simulate the stolen data, I will use my test Lastpass account to extract an encrypted vault from the Chrome Browser extension on macOS. In this post I will go into technical details on what attackers could do with the stolen encrypted vaults, specifically how they could use tools like Hashcat to crack vault passwords and get access to sensitive log-in credentials.
0 kommentar(er)
