Security researcher develops LostPass tool to exploit LastPass password manager

LastPass-LostPass-Pc-Tablet-Media

Security researcher Sean Cassidy discovered a phishing attack (LostPass) at ShmooCon 2016, which enables spoofing notifications displayed by LastPass version 4.0 in the web browser wherein users get tricked to divulge their login credentials as well as OTP. He also added that an email notification is sent by LastPass if any attacker tries logging in from a new IP address.

Cassidy states that this attack works in Chrome and spotting the difference between a fake LastPass message, and the actual one isn’t easy for users since it has the same login screen and same notification.

All attacker has to do is reroute the user to a legit website that is vulnerable to XSS attacks, followed by XSS flaw for detecting the installation of LastPass. Then, log the user out with a CSRF issue and ask to log in once again.

Image: seancassidy.me

When the user clicks on this notification, the exact login page appears, and once the credentials are entered, users are logged on to the server of the attacker. User credentials against the LastPass API will then be checked, accuracy will be verified, and the user will be asked for 2-factor authentication code.

Image: seancassidy.me

Once the attacker gets access to the username and password, all the information of the victim can be downloaded from the API. Cassidy advised the users to keep a check on the account history of LastPass for checking unknown IP addresses.

Apart from that users should disable mobile login, ignore notifications in the browser window and enable IP restriction.

About the author

Nitika

Nitika Munshi

Nitika is an MCA graduate and works as an all-around news writer at PC-Tablet. In free time, she works on Photoshop and plays GTA V on her Xbox. A tech-enthusiast at heart, she explores ways that businesses can leverage the Internet and move their businesses to the next level.

Web Stories

5 Best Projectors in 2024: Top Long Throw and Laser Projectors for Every Budget 5 Best Laptop of 2024 5 Best Gaming Phones in Sept 2024: Motorola Edge Plus, iPhone 15 Pro Max & More! 6 Best Football Games of all time: from Pro Evolution Soccer to Football Manager 5 Best Lightweight Laptops for High School and College Students 5 Best Bluetooth Speaker in 2024 6 Best Android Phones Under $100 in 2024 6 Best Wireless Earbuds for 2024: Find Your Perfect Pair for Crystal-Clear Audio Best Macbook Air Deals on 13 & 15-inch Models Start from $149