Ask HN: How did my LastPass master password get leaked? • Hacker News Board

Re: Ask HN: How did my LastPass master password get leaked?

#311

Post by Nyr » Tue, Dec 28, 2021, 2:10 AM UTC

trajcek wrote: post #194

Just happened to me one hour ago and got scared shitless. Time Monday, December 27, 2021 at 3:50 PM EST Location UNITED STATES IP address 107.173.195.83 Actions taken, in this order: - Head to *Advanced Options* -> *View account history* to see if anything suspicious is going on (nothing so far) - Disable Lastpass MFA and use Google Authenticator (Authy) - *Account Settings* -> click on *Show Advanced Settings* -> *D…

All of this IP space is cybercrime-related.

Most of it was initially obtained via fraud/corruption from AFRINIC and being currently announced by AS202425 (Ecatel, notorious crime host). Whoever is using it is up to no good.

The rest is owned and announced by ColoCrossing which could be considered a legit ISP by some metrics, but also has an extensive history of hosting lots of shady stuff.

Re: Ask HN: How did my LastPass master password get leaked?

#312

Post by s0rr0wskill » Tue, Dec 28, 2021, 2:12 AM UTC

Lastpass is not a good password manager, use something like Bitwarden

Re: Ask HN: How did my LastPass master password get leaked?

#313

Post by bombita » Tue, Dec 28, 2021, 2:14 AM UTC

gregsadetsky wrote: post #179

bombita wrote: post #160

Another data point, same deal. Time Monday, December 27, 2021 at 1:29 PM EST Location São Paulo, SP 01323, BRAZIL IP address 160.116.231.145 Went ahead and deleted my Lastpass account and changed my password in other password managers.

Holy moly!!! Were you using LastPass around 2017? One theory that's floating is that we were all owned by a compromised LastPass extension 4-5 years ago. Just trying to find some common thread among all of us (a thread that's different than "lastpass was owned" which presumably should be more improbable...)

Actually that can very much be the case. Just checked and I signed up for it on Sun, 4 Jun 2017, 08:17, which fits the breach (not sure what was the exact date on it)

Re: Ask HN: How did my LastPass master password get leaked?

#314

Post by ksec » Tue, Dec 28, 2021, 2:20 AM UTC

gregsadetsky wrote: post #219

trajcek wrote: post #205

Earlier quoted context omitted.

"Someone just used your master password to try to log in to your account from a device or location we didn't recognize. LastPass blocked this attempt, but you should take a closer look." Could be... I haven't rotated my password in a while. Could you link me to more info about the LastPass compromise that you mentioned? p.s. My master password is definitely not dictionary material, and it's not used anywhere else, so…

That's so extremely bad and really cannot be a coincidence at this point. We were all owned in the same way years ago...? The compromise was mentioned here: https://news.ycombinator.com/item?id=29707325

So they had waited all these years, before they act on those Password? Seems like there should be some other explanation.

Re: Ask HN: How did my LastPass master password get leaked?

#315

Post by someguydave » Tue, Dec 28, 2021, 2:22 AM UTC

gregsadetsky wrote: post #303

chubs wrote: post #299

Just tried to delete my lastpass account and get the following message: "Something went wrong. : A" Not very confidence-building. Anyone know how to work around this? Also: Went to https://support.logmeininc.com/lastpass/help/delete-your-las... and it doesn't actually tell you how to delete the account, just tells you how to recover your password. Methinks this is all a dark pattern.

There are multiple independent reports here of that error happening as well! See: https://news.ycombinator.com/item?id=29708961 One commenter noted that it wasn't possible to login again (after that error happened), so presumably the account was deleted...?

same thing happened to me (deletion error; could not log in again)

Re: Ask HN: How did my LastPass master password get leaked?

#316

Post by gravelc » Tue, Dec 28, 2021, 2:23 AM UTC

coayer wrote: post #308

gravelc wrote: post #306

Trying to delete my old inactive account and it keeps throwing a meaningless error: "Something went wrong. : A". Wish I'd been more sensible and done it earlier.

Try logging in on Lastpass.com. I got the same error but it says the email is wrong (seems like the account is deleted)

Got the same thing. Doesn't engender any trust at all as there's no confirmation that account is actually deleted. Changed some key passwords again just in case. Switched to 1password a while ago and really hope it doesn't suffer from these kinds of issues.

Re: Ask HN: How did my LastPass master password get leaked?

#317

Post by gregsadetsky » Tue, Dec 28, 2021, 2:26 AM UTC

someguydave wrote: post #315

gregsadetsky wrote: post #303

Earlier quoted context omitted.

There are multiple independent reports here of that error happening as well! See: https://news.ycombinator.com/item?id=29708961 One commenter noted that it wasn't possible to login again (after that error happened), so presumably the account was deleted...?

same thing happened to me (deletion error; could not log in again)

I wonder if deleting a LastPass account with the devtools opened would have showed us the full error message going over the network. Or maybe the server is truly just sending back "A".

Re: Ask HN: How did my LastPass master password get leaked?

#318

Post by charcircuit » Tue, Dec 28, 2021, 2:30 AM UTC

mellowagain wrote: post #310

This has nothing to do with OP's problem but I figured this may be a good place to post about my bad experience with LastPass back in 2019: When I moved to Bitwarden, I have deleted my account on LastPass. I have received a confirmation email regarding my account which states [0]: > Your LastPass account has been permanently deleted and all of your data has been purged from our systems. A few months later I receive a…

It's very possible the billing system is separate from everything else.

Re: Ask HN: How did my LastPass master password get leaked?

#319

Post by ksec » Tue, Dec 28, 2021, 2:38 AM UTC

What are the chances this has something to do with Log4j Vulnerability?

[1] https://community.logmein.com/t5/LastPass-Support-Discussion...

Re: Ask HN: How did my LastPass master password get leaked?

#320

Post by vel0city » Tue, Dec 28, 2021, 2:48 AM UTC

colejohnson66 wrote: post #193

Godel_unicode wrote: post #88

Earlier quoted context omitted.

That IP is present in a cn record for visit[.]keznews[.]com, whose whois record lists an admin contact in CZ. Be very wary of geo-ip results, on the modern internet they are effectively useless.

Ignoring VPNs, why are they useless?

I've routinely seen edge cases where geo IP databases are just wrong, even from providers like Google and others.

My home would routinely show up as from a country a thousand miles away. Friends down the street would show up several states over. Customers I know which were a state over would appear from a different country. The databases are usually right, but they're still often wrong. Often enough to cause frustrations.