The Hack - York University · 2016. 3. 15. · What is LastPass? Freemium password management...
Transcript of The Hack - York University · 2016. 3. 15. · What is LastPass? Freemium password management...
![Page 1: The Hack - York University · 2016. 3. 15. · What is LastPass? Freemium password management service Web-based Stores passwords in cloud](https://reader033.fdocuments.net/reader033/viewer/2022051807/60083a67563d700db4498e2b/html5/thumbnails/1.jpg)
The Hack
R.Abarrota, M.Bandali, S.Merante
![Page 2: The Hack - York University · 2016. 3. 15. · What is LastPass? Freemium password management service Web-based Stores passwords in cloud](https://reader033.fdocuments.net/reader033/viewer/2022051807/60083a67563d700db4498e2b/html5/thumbnails/2.jpg)
What is LastPass?
◉ Freemium password management
service
◉ Web-based
◉ Stores passwords in cloud
![Page 3: The Hack - York University · 2016. 3. 15. · What is LastPass? Freemium password management service Web-based Stores passwords in cloud](https://reader033.fdocuments.net/reader033/viewer/2022051807/60083a67563d700db4498e2b/html5/thumbnails/3.jpg)
Photo courtesy of LastPass
https://lastpass.com/
![Page 4: The Hack - York University · 2016. 3. 15. · What is LastPass? Freemium password management service Web-based Stores passwords in cloud](https://reader033.fdocuments.net/reader033/viewer/2022051807/60083a67563d700db4498e2b/html5/thumbnails/4.jpg)
Cross Platform
LastPass has apps for most
major mobile platforms, with
dedicated support for a variety of
browsers on the PC.
Photo courtesy of LastPass
https://lastpass.com/
![Page 5: The Hack - York University · 2016. 3. 15. · What is LastPass? Freemium password management service Web-based Stores passwords in cloud](https://reader033.fdocuments.net/reader033/viewer/2022051807/60083a67563d700db4498e2b/html5/thumbnails/5.jpg)
What Happened?
![Page 6: The Hack - York University · 2016. 3. 15. · What is LastPass? Freemium password management service Web-based Stores passwords in cloud](https://reader033.fdocuments.net/reader033/viewer/2022051807/60083a67563d700db4498e2b/html5/thumbnails/6.jpg)
In June 2015, LastPass noticed unusual activity
on their network of servers, with evidence
showing compromise of some* data
Photo courtesy of Roos-Skywalker
http://roos-skywalker.deviantart.com/art/Data-path-with-glow-335648807
![Page 7: The Hack - York University · 2016. 3. 15. · What is LastPass? Freemium password management service Web-based Stores passwords in cloud](https://reader033.fdocuments.net/reader033/viewer/2022051807/60083a67563d700db4498e2b/html5/thumbnails/7.jpg)
“
“… The investigation has shown, however, that LastPass account email addresses, password reminders, server
per user salts, and authentication hashes were compromised.”
![Page 8: The Hack - York University · 2016. 3. 15. · What is LastPass? Freemium password management service Web-based Stores passwords in cloud](https://reader033.fdocuments.net/reader033/viewer/2022051807/60083a67563d700db4498e2b/html5/thumbnails/8.jpg)
Hashes & Salts?
![Page 9: The Hack - York University · 2016. 3. 15. · What is LastPass? Freemium password management service Web-based Stores passwords in cloud](https://reader033.fdocuments.net/reader033/viewer/2022051807/60083a67563d700db4498e2b/html5/thumbnails/9.jpg)
a Hash Function maps data of
arbitrary size to data of fixed size.
Examples of cryptographic hash functions:
◉ MD5
◉ SHA-1
◉ SHA-2
![Page 10: The Hack - York University · 2016. 3. 15. · What is LastPass? Freemium password management service Web-based Stores passwords in cloud](https://reader033.fdocuments.net/reader033/viewer/2022051807/60083a67563d700db4498e2b/html5/thumbnails/10.jpg)
Salts are [random] data used as
additional input to a one-way
function that hashes a password
or a passphrase.
![Page 11: The Hack - York University · 2016. 3. 15. · What is LastPass? Freemium password management service Web-based Stores passwords in cloud](https://reader033.fdocuments.net/reader033/viewer/2022051807/60083a67563d700db4498e2b/html5/thumbnails/11.jpg)
var salt = username;
var derived_key = PBKDF2(HMAC−SHA256,
password,
salt, 5000, 256);
PR
F
# of iterations
length of derived
key
![Page 12: The Hack - York University · 2016. 3. 15. · What is LastPass? Freemium password management service Web-based Stores passwords in cloud](https://reader033.fdocuments.net/reader033/viewer/2022051807/60083a67563d700db4498e2b/html5/thumbnails/12.jpg)
What could hackers do?
![Page 13: The Hack - York University · 2016. 3. 15. · What is LastPass? Freemium password management service Web-based Stores passwords in cloud](https://reader033.fdocuments.net/reader033/viewer/2022051807/60083a67563d700db4498e2b/html5/thumbnails/13.jpg)
Not much!
![Page 14: The Hack - York University · 2016. 3. 15. · What is LastPass? Freemium password management service Web-based Stores passwords in cloud](https://reader033.fdocuments.net/reader033/viewer/2022051807/60083a67563d700db4498e2b/html5/thumbnails/14.jpg)
Because ...
◉ Passwords were hashed.
◉ Hashes were salted.
◉ After the breach, the LastPass team took
extra measures to prevent further damage.
![Page 15: The Hack - York University · 2016. 3. 15. · What is LastPass? Freemium password management service Web-based Stores passwords in cloud](https://reader033.fdocuments.net/reader033/viewer/2022051807/60083a67563d700db4498e2b/html5/thumbnails/15.jpg)
LastPass blog post June 2015Disclosed what happened and how
they planned on ensuring to keep
data safe.
![Page 16: The Hack - York University · 2016. 3. 15. · What is LastPass? Freemium password management service Web-based Stores passwords in cloud](https://reader033.fdocuments.net/reader033/viewer/2022051807/60083a67563d700db4498e2b/html5/thumbnails/16.jpg)
LastPass◉ Password management service
LastPass Hack◉ User information compromised
Summary
![Page 17: The Hack - York University · 2016. 3. 15. · What is LastPass? Freemium password management service Web-based Stores passwords in cloud](https://reader033.fdocuments.net/reader033/viewer/2022051807/60083a67563d700db4498e2b/html5/thumbnails/17.jpg)
Questions
Was my master password exposed?The master
password is used to
retrieve all other
passwords stored by
the service.
Yes
No
What Should I do Now?
Email your master
password to
LastPass
Update info
Was information in my vault exposed?Form fill profiles,
secure notes,
usernames, emails,
etc..
Yes
No
![Page 18: The Hack - York University · 2016. 3. 15. · What is LastPass? Freemium password management service Web-based Stores passwords in cloud](https://reader033.fdocuments.net/reader033/viewer/2022051807/60083a67563d700db4498e2b/html5/thumbnails/18.jpg)
Any questions ?
Thanks!
![Page 19: The Hack - York University · 2016. 3. 15. · What is LastPass? Freemium password management service Web-based Stores passwords in cloud](https://reader033.fdocuments.net/reader033/viewer/2022051807/60083a67563d700db4498e2b/html5/thumbnails/19.jpg)
References
◉ https://blog.lastpass.com/2015/06/lastpass-security-notice.html
◉ https://en.wikipedia.org/wiki/LastPass
◉ https://en.wikipedia.org/wiki/Hash_function
◉ https://en.wikipedia.org/wiki/PBKDF2
◉ https://tools.ietf.org/html/rfc2898
◉ https://en.wikipedia.org/wiki/Salt_%28cryptography%29
◉ https://en.wikipedia.org/wiki/Pseudorandom_function_family
◉ http://www.graemenoble.id.au/post/49072807017/lastpass-password-database-
explanation
◉ http://lifehacker.com/lastpass-hacked-time-to-change-your-master-password-
1711463571
◉ http://www.dailytech.com/When+Breaches+Happen+LastPass+Hack+Showcases+V
alue+of+Strong+Encryption/article37401.htm
◉ http://www.ibtimes.co.uk/lastpass-hacked-what-you-need-know-about-password-
manager-security-breach-1506350
![Page 20: The Hack - York University · 2016. 3. 15. · What is LastPass? Freemium password management service Web-based Stores passwords in cloud](https://reader033.fdocuments.net/reader033/viewer/2022051807/60083a67563d700db4498e2b/html5/thumbnails/20.jpg)
Credits
Special thanks to all the people who made and
released these awesome resources for free:
◉ Presentation template by SlidesCarnival
◉ Presentation icons by SlidesCarnival
◉ Images from LastPass and other cited
sources