Windows 10: LastPass credentials leak bug reported and resolved

Brink · Sep 24, 2019

Our team recently investigated and resolved a bug affecting certain LastPass extensions. Tavis Ormandy, a security researcher from Google’s Project Zero, responsibly disclosed the issue to us. His report revealed a limited set of circumstances on specific browser extensions that could potentially allow an attacker to create a clickjacking scenario.

To exploit this bug, a series of actions would need to be taken by a LastPass user including filling a password with the LastPass icon, then visiting a compromised or malicious site and finally being tricked into clicking on the page several times. This exploit may result in the last site credentials filled by LastPass to be exposed. We quickly worked to develop a fix and verified the solution was comprehensive with Tavis.

We have now resolved this bug; no user action is required and your LastPass browser extension will update automatically.

Additionally, while any potential exposure due to the bug was limited to specific browsers (Chrome and Opera), as a precaution, we’ve deployed the update to all browsers.

We know the LastPass community is very security-savvy, but as a reminder LastPass continues to recommend the following general best practices for added online security:

Beware of phishing attacks. Do not click on links from people you don’t know, or that seem out of character from your trusted contacts and companies.

Always enable MFA for LastPass and other services like your bank, email, Twitter, Facebook, etc. Adding additional layers of authentication remains the most effective way to protect your account.

Never reuse your LastPass master password and never disclose it to anyone, including us.

Use different, unique passwords for every online account.

Keep your computer malware-free by running antivirus with the latest detection patterns and keeping your software up-to-date.

As always, we welcome (and incentivize) contributions from the security research community through our bug bounty program. We appreciate the important work that white hat researchers provide in augmenting the security of LastPass for all of our users.
Click to expand...

Source: LastPass Bug Reported & Resolved - The LastPass Blog

:)

Brink · Sep 24, 2019

LastPass credentials leak bug reported and resolved

Our team recently investigated and resolved a bug affecting certain LastPass extensions. Tavis Ormandy, a security researcher from Google’s Project Zero, responsibly disclosed the issue to us. His report revealed a limited set of circumstances on specific browser extensions that could potentially allow an attacker to create a clickjacking scenario.

To exploit this bug, a series of actions would need to be taken by a LastPass user including filling a password with the LastPass icon, then visiting a compromised or malicious site and finally being tricked into clicking on the page several times. This exploit may result in the last site credentials filled by LastPass to be exposed. We quickly worked to develop a fix and verified the solution was comprehensive with Tavis.

We have now resolved this bug; no user action is required and your LastPass browser extension will update automatically.

Additionally, while any potential exposure due to the bug was limited to specific browsers (Chrome and Opera), as a precaution, we’ve deployed the update to all browsers.

We know the LastPass community is very security-savvy, but as a reminder LastPass continues to recommend the following general best practices for added online security:

Beware of phishing attacks. Do not click on links from people you don’t know, or that seem out of character from your trusted contacts and companies.

Always enable MFA for LastPass and other services like your bank, email, Twitter, Facebook, etc. Adding additional layers of authentication remains the most effective way to protect your account.

Never reuse your LastPass master password and never disclose it to anyone, including us.

Use different, unique passwords for every online account.

Keep your computer malware-free by running antivirus with the latest detection patterns and keeping your software up-to-date.

As always, we welcome (and incentivize) contributions from the security research community through our bug bounty program. We appreciate the important work that white hat researchers provide in augmenting the security of LastPass for all of our users.
Click to expand...

Source: LastPass Bug Reported & Resolved - The LastPass Blog

SilverBack70 · Sep 24, 2019

LastPass

Installed LastPass for Internet Explorer but, every time I try to sign into LastPass it crashes Internet Explorer. Any suggestions?

MarcinMrowiec · Sep 24, 2019

Scheduled tasks run with elevated privileges can't access stored Windows credentials

It seems that after Creators update scheduled tasks run with elevated privileges ('run with highest privileges' option) can't access stored Windows credentials. Is that a bug or an intentional change and is there a recommended workaround?

Here's one way to reproduce the behaviour:

Start Credential Manger and add some Windows share credentials.

In a console window type 'cmdkey /list', which should list the added credentials

Create a task in a task manager:

Trigger: on user logon

Action: run cmd.exe

Tick the 'run with highest privileges' option

Reboot the machine and log in

In the console window (let's call it 'console 1') opened from the scheduled task type 'cmdkey /list'. This most likely won't display the credentials added in step 1 and properly listed in step 2. ->
This looks like a bug

Now, without closing 'console 1' open another console window as an administrator (let's call it 'console 2') and type 'cmdkey /list'. This will properly list credentials added in step 1.

Switch to 'console 1' and type 'cmdkey /list' again. This time the credentials are listed properly, unlike in step 5. It looks like an access to Windows credentials was somehow 'unlocked' by step 6.

Windows 10: LastPass credentials leak bug reported and resolved

LastPass credentials leak bug reported and resolved

LastPass credentials leak bug reported and resolved

LastPass credentials leak bug reported and resolved

LastPass credentials leak bug reported and resolved - Similar Threads - LastPass credentials leak

Bug Report

Bug Report

report a bug

Bug Report

Bug report - Windows 10 "Photos" app memory leak

Reporting bugs

Report a bug

Reporting a Bug.

Lastpass.