LastPass autofill exploit

Re:LastPass autofill exploit by pbininda on Wednesday July 27, 2016 @05:58AM (#12171600)

If I read this article correctly, the headline should actually be: How I made LastPass give me all MY passwords

Update: after a few answers to my badly thought through comment, I now feel enlightened. The attack scenario is a malicious web site which can gobble up my passwords. Thanks

[ Parent | on HN ]

Re:LastPass autofill exploit by viraptor on Wednesday July 27, 2016 @06:03AM (#12171617)

This is just a PoC. Now imagine that the author instead:

1. Writes up that post.

2. Inserts an iframe in the post, which enumerates known sites. (hidden out of view with css tricks)

3. Instead of alerting on screen, sends the results back to their server.

4. Submits to HN.

[ Parent | on HN ]

Re:LastPass autofill exploit by maehwasu on Wednesday July 27, 2016 @07:13AM (#12171870)

It's also REALLY easy to deliver that malicious site through web ads, especially background pops.

[ Parent | on HN ]

Re:LastPass autofill exploit by martin-adams on Wednesday July 27, 2016 @06:06AM (#12171631)

My interpretation is. How I could create a web page that give ME all the commonly used site's passwords for ANY last pass visitor who has autofill enabled.

So no, I don't think it will only give you your own passwords.

[ Parent | on HN ]

Re:LastPass autofill exploit by zaxomi on Wednesday July 27, 2016 @06:09AM (#12171639)

If you where using LastPass, and visited any page controlled by an attacker on any domain, they could get your passwords to all sites that they tested for, for example twitter, gmail etc.

[ Parent | on HN ]