Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How did my LastPass master password get leaked?

news.ycombinator.com

Post reply on HN
Print view View original

381–390 of 529 posts

Re: Ask HN: How did my LastPass master password get leaked?

#381

Post by gregsadetsky »

ksec wrote: post #361
mulmboy wrote: post #349

Same thing for me. I last changed my master password on Oct 4 2021. password never used elsewhere and stored only in my head, which makes me suspect a bad chrome extension. ``` Someone just used your master password to try to log in to your account from a device or location we didn't recognize. LastPass blocked this attempt, but you should take a closer look. Was this you? Account xxx@xxx.com Time Monday, December 27…

So they are using your "newer" password from Oct 2021? Because all the previous incident seems to relate to very old password usage dated back in 2017. If so then it is big, very big. Could it be log4J? Edit: 12 hours later still no update or response from LastPass.

At least another reported incident in this thread is from someone who registered their account in November of this year...!

https://news.ycombinator.com/item?id=29710262

(I ask them to confirm whether they mean November 2021 and further down in the thread, they confirm that)

And yes, if it's a recent attack -- that's very troubling. (and would be more probable than an attacker sitting on passwords for 4 years)

Re: Ask HN: How did my LastPass master password get leaked?

#382

Post by gregsadetsky »

kreetx wrote: post #234
gregsadetsky wrote: post #162

Earlier quoted context omitted.

I agree, that could make sense. So LastPass (their extension) may have been hacked ~5 years ago ish, a few people here on the thread were all hacked in the same way, our passwords were sold off, and now the same Brazil IP range just tried all of those passwords.

Perhaps you can ask the other victims when did they register their accounts to see if that's true?

I've been trying to ask this to people posting reports, and although there are many "older" accounts (like mine, circa 2017 or older), at least 2 reports are from accounts created this year:

https://news.ycombinator.com/item?id=29710262

https://news.ycombinator.com/item?id=29711950

That would make "more sense" that our credentials weren't stored and unused for years, i.e. that this is possibly a new, recent breach.

Re: Ask HN: How did my LastPass master password get leaked?

#383

Post by gregsadetsky »

seanwilson wrote: post #342

> Either the 3 of us had the same malware/Chrome extension Is stealing the master password this way possible in practice? As far as I know, Chrome extensions cannot inject e.g. JavaScript into tabs and toolbar popups that are owned by Chrome extensions. Random pages and extensions are able to send string/JSON messages to an extension but message sources usually have to be on an allow list + JavaScript `eval` should b…

I sometimes didn't use the LastPass extension, and simply logged in by going to lastpass.com and filling out the login form there. That form could have been compromised by an extension.

Re: Ask HN: How did my LastPass master password get leaked?

#384

Post by wutwutwutwut »

gregsadetsky wrote: post #378
wutwutwutwut wrote: post #377

Earlier quoted context omitted.

Could it be that some malware were run on your machines recently (say a few weeks ago) which extracted the master passwords and then used it now? If your LastPass master password was stored on your computer then malware could have collected it and sent it off to some attacker. Or could it be that all of you guys are using the same router, same ISP, same anything-else, which has snooped on traffic and collected the cr…

Malware is not impossible, but in my case, the password is stored in an encrypted keepass file. Did the malware wait for me to open my keepass vault and snoop the password then? Possibly. But it presumably could/would have done much worse things. Other people in this thread are also confirming that their password was unused anywhere else. And as more independent people are reporting the same story happening to them,…

Let me preface by saying I'm speculating of course.

> Did the malware wait for me to open my keepass vault and snoop the password then?

It's not impossible at least. There's been vulnerabilities in Keepass RPC which allowed any javascripts on Internet reading your passwords [1]. If a simple javascript can read secrets from keepass, I would not be at all surprised if that has happened.

> the less probable it is that we were all hit with the same malware.

Sure. But there's also some selection bias here, were a lot of people visiting hackernews is affected. On twitter, everyone (more or less) who's discussing this issue links this post, which at least in theory could indicate that the scope of the issue is relatively narrow (compared to the entire internet). It could be that some specific developer tools or libraries have been affected for example (as any of the recent packages on NPM which people claim may have sniffed credentials).

1: https://forum.kee.pm/t/a-critical-security-update-for-keepas...

Re: Ask HN: How did my LastPass master password get leaked?

#386

Post by thenickdude »

hellotesttest wrote: post #343
gregsadetsky wrote: post #336

Earlier quoted context omitted.

Fascinating, we must be at about 20 independent reports here. When was your account created?

My account was created 13 years ago.

What year was your master password last changed? It shows it in Vault > Account Settings. Or is your MP also 13 years old?

Re: Ask HN: How did my LastPass master password get leaked?

#387

Post by gregsadetsky »

teasnob wrote: post #350

Sounds like securing your password manager with two factor authentication is a must!

I'm the OP -- I had 2fa enabled on my LastPass account, but didn't have access to the token (a 2fa app running on an old phone I don't have anymore)

I was able to remove the 2fa myself by going through a recovery process and clicking a link they sent me over email...

2fa on LastPass is pretty much useless.

Re: Ask HN: How did my LastPass master password get leaked?

#388

Post by gregsadetsky »

M3wThr33 wrote: post #338

My login attempt info: Time Monday, December 27, 2021 at 5:51 PM EST Location GERMANY IP address 168.81.122.153 It was definitely a unique password. Last set in 2017, but changed now. I had just purged virtually all the data in the account recently, but it's still frightening.

Thanks for your report! There are more than 20 independent reports here... Really scary.

Re: Ask HN: How did my LastPass master password get leaked?

#389

Post by noitpmeder »

gregsadetsky wrote: post #379
drakonka wrote: post #371

I am surprised that LastPass have not yet addressed this. Even if it isn't a widespread incident, the fact that this is being reported by multiple people seems worrying enough for a password manager to respond promptly.

I agree. I contacted the support agent I talked to again with a link to this thread and all of the similar IP addresses that tried to login, presumably with the knowledge of our master passwords. I also sent off a random email to the Verge, and tried tagging LastPass on Twitter. Does anyone have tech media connections who could try to squeeze a word out of LastPass?

krebsonsecurity might want to take a look? Sounds like right up their ally.

Re: Ask HN: How did my LastPass master password get leaked?

#390

Post by ksec »

gregsadetsky wrote: post #379
drakonka wrote: post #371

I am surprised that LastPass have not yet addressed this. Even if it isn't a widespread incident, the fact that this is being reported by multiple people seems worrying enough for a password manager to respond promptly.

I agree. I contacted the support agent I talked to again with a link to this thread and all of the similar IP addresses that tried to login, presumably with the knowledge of our master passwords. I also sent off a random email to the Verge, and tried tagging LastPass on Twitter. Does anyone have tech media connections who could try to squeeze a word out of LastPass?

Looks like not getting any media attention. But There are now more than a dozen incidents which is quite worrying.

Some twitter "expert" insist most of these incidents here were phished. But I read many of them hasn't even touch the password for years. And report of new account compromised suggest this isn't something done by phishing attempt. Not to mention most people here tends to be on a higher level of security and tech knowledge level.

Edit: Well Appleinsider [1] picked up the story, the only bad thing is this expose Hackernews the site to a much wider mainstream audience.

It is also interesting to see how news spread out online in real time.

[1] https://appleinsider.com/articles/21/12/28/lastpass-master-p...

Post reply on HN