Password theft evolves at dizzying speeds

WASHINGTON: Millions of people count on password managers to safeguard their accounts and help them keep track of their passwords. By serving as a sort of master-key for their accounts, password managers can encourage good digital hygiene, such as using long, complex and unique passwords.

But a major vulnerability in one of the most popular password managers, LastPass, shows how even the tactics users hope will protect them online can still leave them vulnerable – and how just hard it is to keep up with what technology to trust.

Tavis Ormandy, a member of a Google team that hunts for unknown software bugs, discovered the LastPass problem this week, calling it a “complete remote compromise”. A distant attacker could potentially take over users’ LastPass accounts and gain access to their troves of passwords – at least, if they visited a website designed to exploit the vulnerability while using the LastPass browser extension with Firefox, according to a blog post from LastPass.

LastPass pushed out an update on Wednesday fixing the problem. It also acknowledged an issue that similarly exposed user passwords and was disclosed to LastPass by security researcher Mathias Karlsson last year.

The company fixed the problem Karlsson discovered when he told them about it, but it wasn’t made public until Wednesday when Karlsson published a blog post explaining the bug. Industry best practice is for researchers to wait until after problems have been fixed to talk about them, but companies don’t always announce when they’ve made major corrections.

This isn’t the first time password managers have had security problems. In 2014, researchers uncovered security problems in LastPass and four other password managers. Last year, researchers were able to sneak a malicious program into the Apple App Store that could steal passwords from iOS and OSX’s built-in Keychain password management tool, as well as from popular password manager 1Password.

Earlier this week, a government agency also waved developers away from another common account security strategy: using SMS text messages to deliver two- factor authentication codes. Two-factor authentication is one of the best, basic steps people can take to secure their accounts. It works by having a user verify their identity by using another method beyond a password, most often by entering a code sent to them via SMS.

But the National Institute of Standards and Technology argues using SMSes for two-factor authentication shouldn’t be considered secure because the number associated with an account might change hands or the code might be intercepted if sent to a number registered through an online service, including Skype or Google Voice. Instead, the guidance suggests alternatives such as using secure apps for two-factor authentication, already offered through Google. – Washington Post