What is the LastPass phishing attack?

The LastPass phishing attack is a phishing attack that became widely known in early 2016 and affected many users of the LastPass password manager. The sensitive passwords of lots of users were compromised, and it gave a wake-up call to all the security experts.

In this LastPass phishing attack, an attacker typically displays a notification in the victim’s computer saying the victim’s session in LastPass has expired and he needs to re-login. On clicking on the notification, a login screen appears, which is the same as LastPass’s login screen. But the login screen is actually that of the attacker’s website.

If the victim gives his actual password on the login screen, the credentials directly go to the attacker. Using the username and password, the attacker can now login to the victim’s LastPass account and do malicious activities or impersonate the victim.

The LastPass phishing attack was first notified by Sean Cassidy, who is a CTO of Praesido Inc. In his blog, Cassidy termed the attack as the LostPass attack.

How is the LastPass phishing attack perpetrated?

In the LastPass phishing attack, the attacker exploits the XSS or cross-site scripting vulnerability (What is the cross-site scripting vulnerability?) of the LastPass website to perpetrate the attack.

The attacker first uses social engineering to trick a victim into clicking on a malicious link. It may be a link sent through an email or any link indicating some interesting pictures or videos.

The link actually contains a script stored on the attacker’s website. On clicking on the link, the script exploits the logout CSRF (What is the CSRF vulnerability?) of the LastPass website and logs out the victim from the LastPass website.

Then, the malicious script displays a malicious notification in the browser viewport saying the victim’s session has expired and the victim needs to re-login.

On clicking on the notification, a login screen appears, which looks similar to that of the LastPass website. Cassidy says in his blog that this malicious login screen looks completely similar to the login screen of the LastPass website. And there is no way the victim can realize it is actually a nefarious login screen that belongs to the attacker’s website.

Now, the victim is tricked into providing his actual login and password on the fraudulent login screen.

At this point, the attacker’s server will collect the credentials and verify them using LastPass’ APIs. If the credentials do not match, the victim is redirected to the login screen again, saying “Invalid Password.”

Once the attacker has the correct credentials, i.e., the username, password, and two-factor token applicable for two-factor authentication, he can log in to the LastPass website using the same credentials and …