This LastPass Phishing Hack Can Steal All Your Passwords—Here's How to Prevent It « Null Byte :: WonderHowTo

If you want to keep your online world secure, your best bet is to have a different password for every site and service that you use, and to make sure each of the passwords are comprised of random characters instead of familiar words or numbers. But this obviously creates a problem—how exactly are we supposed to remember all of these complicated passwords?This is wherepassword management serviceslikeLastPasscome into play. You simply remember one secure password and the service remembers the rest. Enter the one true password when prompted, then the service will auto-populate the password for the site you're visiting. Sounds safe, right?On the surface, sure. LastPass has solid security measures that prevent someone from being able to brute-force attack your account and unlock your master password. But now, thanks to some clever new phishing sites, you might unwittingly hand the password over yourself—meaning every login credential for every service stored on LastPass could be stolen.LostPass: The LastPass Phishing Clone That Could Fool AnybodyDeveloperSean Cassidyhas created a phishing tool that perfectly clones the LastPass expired login prompt, and he named the toolLostPass. It detects when the user has LastPass installed, then displays a "session expired" message on the phishing site that prompts you to log back into LastPass.This is where LostPass gets really nasty. When you enter your user name and password on the following screen, LostPass immediately hijacks your account. The user name (email address) and master password are sent upstream to the attacker's server, so the bulk of the damage is already done.At this point, if you have two-factor authentication enabled on your LastPass account, you'll be prompted to enter your verification code. As with the "session expired" message and the login prompt, this interface is virtually identical to the official LastPass prompt.Now LostPass has everything it needs to take total control over your account. It uses the login info and two-factor authentication token it just stole to create a backdoor into your account by way of the LastPass "Emergency contact" feature, then sets the attacker's server as a trusted device to prevent any email notifications. To put it simply, all of your passwords are now compromised, and you probably have no idea that this just happened.Note: As Sean statedon his blog, "LastPass now requires email confirmation for all logins from new IPs. This substantially mitigates LostPass, but does not eliminate it." So, it's a small chance that you might get hacked, but it's still a chance if there'sa clever, persistent hackerbehind the wheel.How to Make Sure You Don't Get TrickedLostPass works because it's almost a perfect replica of the official LastPass interface—but there are some subtle distinguishing elements. Depending on if you're using Chrome or Firefox as your browser, there are two different ways to spot this phishing attack, and I'll outline both below.Spotting LostPass on ChromeIf you're using Chrome as your browser, spotting a LostPass phishing site takes a keen eye. The only real difference is in the URL bar—the address for the LastPass login prompt will start withchrome-extensionif it's legit, but it will start withchrome-extension.pw, or something similar, if it's a LostPass phishing attempt.Spotting LostPass on FirefoxA phishing attempt would be a bit easier to spot on Firefox, since the official LastPass login prompt is a floating window, whereas the LostPass phishing prompt is embedded into the webpage. The interface will look virtually identical, but if you can't freely move the pop-up window, you're dealing with a phishing attempt.Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedNews:'Impossible to Identify' Website Phishing Attack Leaves Chrome & Firefox Users Vulnerable (But You Can Prevent It)How To:It's Really No Contest — LastPass Is the Best Password Manager for iPhone & AndroidHow To:Use Biometrics to Change Your LastPass Master Password from Your PhoneHow To:Dashlane & LastPass Can Now Automatically Strengthen All of Your Weak PasswordsHacking macOS:How to Dump 1Password, KeePassX & LastPass Passwords in PlaintextHow To:LastPass's AutoFill API Is Finally Out of Beta - Here's How Oreo Users Can Turn It OnNews:The 25 Worst Passwords That People Used in 2015How To:The 4 Best Password Managers for AndroidHow To:Drop Everything! Here's How to Secure Your Data After Heartbleed: The Worst Web Security Flaw EverNews:8 Tips for Creating Strong, Unbreakable PasswordsHow To:Change These Settings Now to Protect Your Data in Case Your Phone Is StolenHow To:Use Google's Advanced Protection Program to Secure Your Account from PhishingHow To:Have Your Passwords Ever Been Leaked Online? Find Out with PwnedListNews:Why You Still Shouldn't Use iCloud Keychain to Store Your Passwords in iOS 12How To:Use the LastPass Password ManagerHow To:Have Your Friends Ever Used Pandora on Your Computer? Well, You Can Steal Their PasswordsHow To:The 4 Best Password Managers for iPhoneHow To:Use Third-Party Password Managers with iOS 12's AutoFill FeatureHow To:Your Phone's Biggest Security Weakness Is Its Data Connection — Here's How to Lock It DownHow To:Easily Generate Hundreds of Phishing DomainsHow To:Keep track of your passwords on an Android phone with the LastPass appHow To:Manage Stored Passwords So You Don't Get HackedHow To:The 5 Best Two-Factor Authentication Apps for iPhone & AndroidHow To:Phish Social Media Sites with SocialFishHack Like a Pro:How to Spear Phish with the Social Engineering Toolkit (SET) in BackTrackHow To:Password-Protect Your Pages Documents So Only You & Allowed Collaborators Can Access ThemHacking Windows 10:How to Steal & Decrypt Passwords Stored in Chrome & Firefox RemotelyHow To:The Safe & Secure Way to Get Your Phone to Remember Your App PasswordsHow To:The Beginner's Guide to Defending Against Wi-Fi HackingHow To:4 Apps to Help Keep Your Android Device SecureHow To:Null Byte & Null Space Labs Present: Wi-Fi Hacking, MITM Attacks & the USB Rubber DuckyHow To:LastPass Form Fill DemonstrationSocial Engineering, Part 2:Hacking a Friend's Facebook PasswordHow To:Advanced Social Engineering, Part 2: Hack Google Accounts with a Google Translator ExploitNews:Flaw in Facebook & Google Allows Phishing, Spam & MoreHow To:Advanced Social Engineering, Part 1: Exact Revenge on Craigslist Scammers with Tabnab PhishingHow To:Chrome Shares Your Activity with Google - Here's How to Use Comodo Dragon to Block ItNews:Delitos informaticos. Phishing, en 3 minutos.How To:Carve Saved Passwords Using CainGoodnight Byte:HackThisSite Walkthrough, Part 2 - Legal Hacker Training