Even The Lastpass Will Be Stolen, Deal With It!
summary
Reversing LastPass browser plugins reveals concrete attacks: AES‑256 with ECB/CBC and pbkdf2 that moved from 500 to 5,000 rounds but still leaks parameters; master passwords and the vault decryption key are recoverable from plugin files, cookies and the default disabled one‑time password stored in cleartext (lp_sid/local storage); custom JS payloads in vault metadata allow account‑scoped XSS; the authors build a Metasploit module able to steal and decrypt the master password and bypass 2FA to exfiltrate and decrypt whole vaults.
AI-written summary · about
chapters (5)
- 0:00Introduction and setup
- 29:46Client-side vulnerabilities
- 36:24Server-side and API attacks
- 47:46Outsider threats
- 48:28Hardening and conclusions
related talks
44mDraining Your Credentials From Popular MacOS Password Managers
49mInside the Information Stealer Ecosystem: From Compromise...
24mThe Emperor’s New Password Manager
26mStudying the Impact of Managers on Password Strength and Reuse
35mSecurity After Death -- Not your problem, or is it?
40m"It Me": Under the Hood of Web Authentication
27mHarnessing Passkeys in the Battle Against Al-Powered Cyber Threats
41mPassbolt Keynote