Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How did my LastPass master password get leaked?

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 529 posts

Re: Ask HN: How did my LastPass master password get leaked?

#41

Post by ChrisMarshallNY »

gregsadetsky wrote: post #5
minaguib wrote: post #2

I'd get in touch with LastPass support asap to see if they have a digital trail to help you figure out what happened. I'd also guess the most plausible situation would be malware on your computer that managed to sniff your credentials in-transit/clipboard/memory/browser/keyboard and exfiltrate it to some shady folks.

Thanks Sending emails to support@lastpass.com doesn't work ("This inbox is not monitored") and I have to upgrade my account to contact their support, which I'll do right away. EDIT: after checking, the login attempt does appear in my Account History (my original email said it didn't -- I wasn't looking in the right place)

I suspect that it was a random phishing attempt.

> Login attempt blocked

> Hello, Someone just used your master password to try to log in to your account from a device or location we didn't recognize. LastPass blocked this attempt, but you should take a closer look.

Looks fairly classic. Might want to look at the email headers, to see if it really came from LastPass.

I get about ten of these a day. Some are scarily well-done.

Most are for banks that I don't use, but I also get a lot of attempts to grab my AppleID. My Apple (mac.com) address is an OG address, and has been making the spammer circuit for over a decade. I suspect that I actually get hundreds of spams a day, but Apple is good at nuking most of them, before they reach my inbox.

Re: Ask HN: How did my LastPass master password get leaked?

#43

Post by ComputerGuru »

gkoberger wrote: post #22
ComputerGuru wrote: post #7

Because LastPass is beyond stupid and uses your master password to log in to their bbulletin or whatever php forum. That’s what got me to write and publish this: https://neosmart.net/blog/2017/a-free-lastpass-to-1password-... EDIT: "or whatever" means I couldn't remember the name of the php forum notorious for its insecurity, I thought it was something like 'bbulletin'. It was phpBB.

There's a level of irony in complaining about LastPass's security, followed by suggestion people run their passwords through random third-party software that you wrote. Even if your code isn't malicious (which I believe), it opens up so many potential attack vectors. For anyone reading this, please use the official 1Password import functionality, not this: https://support.1password.com/import-lastpass/

There was no 1Password to LastPass importer at the time I wrote that (believe me, I looked because I have better things to do than write apps to benefit a commercial entity like agilebits otherwise), and of course the code is published on GitHub and released under the MIT license. It's very short and simple and rather easy to review. It's also a .NET executable, which is ridiculously easy to reverse-compile back to C# (not just assembly) so you can even check that I'm distributing an exe that does the same thing as the code I published.

EDIT

I just revisited that link I shared, and I have to say, it takes some real chutzpah to turn around and accusing me of advising insecure practice when the link I shared literally talks about just that:

Due to the nature of this application, 𝘄𝗲 𝘀𝘁𝗿𝗼𝗻𝗴𝗹𝘆 𝘂𝗿𝗴𝗲 𝗲𝘃𝗲𝗿𝘆𝗼𝗻𝗲 𝘁𝗼 𝗱𝗼𝘄𝗻𝗹𝗼𝗮𝗱 𝘁𝗵𝗲 𝘀𝗼𝘂𝗿𝗰𝗲 𝗰𝗼𝗱𝗲, review it quickly, and compile it yourself to use this tool. However, we do recognize that this may be beyond the means of all security-minded folk out there looking to make the switch, so we are providing signed binaries available for download. If you do opt to use the binary download, make sure to validate the authenticode signature like so: ...

Re: Ask HN: How did my LastPass master password get leaked?

#44

Post by a-dub »

do you have it installed on your smartphone? have you ever entered your master password on your smartphone? what sort of smartphone do you have, does it get security updates regularly, is the manufacturer competent?

same with your desktop. is everything up to date?

Re: Ask HN: How did my LastPass master password get leaked?

#45

Post by ChrisMarshallNY »

luckylion wrote: post #32
studiecomput wrote: post #10

Earlier quoted context omitted.

Why do you recommend others to stop using LastPass?

From my interaction with LastPass support (I'm a premium user), they've outsourced to some cheap company where agents have no clue how anything works. It took weeks to get through to somebody who even understands the problem and their reply was essentially "yeah we know it's broken, it's broken because of security". Left a really bad taste in my mouth. I wouldn't be using them at all if I didn't have to for a client.

I remember reading a blog entry, a few years ago.

Someone received a phishing email from "their bank."

They responded to the email, and got someone on the horn, immediately.

But their bank (the real one), sent them to a horrifying voice jail.

The point was that the crooks gave better customer service than the real bank.

Re: Ask HN: How did my LastPass master password get leaked?

#46

Post by gregsadetsky »

baobabKoodaa wrote: post #17

I'm guessing that the email actually was a phishing attempt, and no-one actually has your LastPass master password.

Unfortunately, once logged into LastPass, I see the exact same information in my "Account History". I also talked to support on the phone and they confirmed it.

So unfortunately, not a phishing attempt!

Re: Ask HN: How did my LastPass master password get leaked?

#47

Post by dogman123 »

gregsadetsky wrote: post #38
techknight wrote: post #34

This also happened to me back on Nov 10, 2021. I had an old LastPass account, wasn't using it, when all of a sudden i get an email: -- Login attempt blocked Hello, Someone just used your master password to try to log in to your account from a device or location we didn't recognize. LastPass blocked this attempt, but you should take a closer look. --- Like you, it told me that the attempt came from Brazil, using an IP…

What, really?? This is too crazy of a coincidence to be a coincidence. This is exactly what's happening to me, and same IP prefix. What does it mean? --- How old of account was this? Can you contact me by email (email in my profile)? --- Two theories: - there is a problem with LastPass - you and I both had the same Chrome extension installed that was actually compromised, and that extension was listening to/sending p…

posting another comment here too for visibility, but this _just_ happened to me as well....

Time Monday, December 27, 2021 at 1:41 PM EST Location São Paulo, SP 01323, BRAZIL IP address 160.116.88.235

Re: Ask HN: How did my LastPass master password get leaked?

#48

Post by ComputerGuru »

gkoberger wrote: post #18
gregsadetsky wrote: post #9

Earlier quoted context omitted.

Sorry, what do you mean by "to log in to their bbuletin or whatever php forum"? According to LastPass, they don't have access to the master password // presumably it's not stored on their side. Is that accurate..? Thanks

After a bit of searching, I wasn't able to find any PHP forum software that LastPass lets you log in to. I could only find one official-seeming forum, and it uses a different login. So, I think this is FUD... I don't use LastPass, but accusing them of something like this (and using the phrase "or whatever") is pretty serious without proof.

They appear to have sunset their phpBB instance. It was the main hub and support portal on their website with up to thousands of active visitors at any given time. You can see it archived here:

https://web.archive.org/web/20150629081250/https://forums.la...

Here's the archived phpBB login page. It asks for your LastPass login and password (not your forum account, your actual LastPass login and actual LastPass master password):

https://web.archive.org/web/20150717071236/https://lastpass....

Here's a past HN discussion from the time with some guesses at how such a phpBB login using the master password could, theoretically, be implemented without knowledge of the password. Note that this doesn't imply it's possible to implement it in a way that would be resistant to their web server (running phpBB!!!!) being compromised: https://news.ycombinator.com/item?id=16016171

Re: Ask HN: How did my LastPass master password get leaked?

#49

Post by gregsadetsky »

dogman123 wrote: post #39

Hey, this _just_ happened to me too....my password would be near impossible to guess and is not used elsewhere... Just deleted my last pass account! here's the info that came with the email Time Monday, December 27, 2021 at 1:41 PM EST Location São Paulo, SP 01323, BRAZIL IP address 160.116.88.235

WHAT!! Same IP range for me.

How is this possible????

Re: Ask HN: How did my LastPass master password get leaked?

#50

Post by whatsapps2020 »

ChrisMarshallNY wrote: post #45
luckylion wrote: post #32

Earlier quoted context omitted.

From my interaction with LastPass support (I'm a premium user), they've outsourced to some cheap company where agents have no clue how anything works. It took weeks to get through to somebody who even understands the problem and their reply was essentially "yeah we know it's broken, it's broken because of security". Left a really bad taste in my mouth. I wouldn't be using them at all if I didn't have to for a client.

I remember reading a blog entry, a few years ago. Someone received a phishing email from "their bank." They responded to the email, and got someone on the horn, immediately. But their bank (the real one), sent them to a horrifying voice jail. The point was that the crooks gave better customer service than the real bank.

It makes sense economically. Crooks will steal ~100% of your bank balance in one day. Bank itself earns 1-2% per year.
Post reply on HN