Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How did my LastPass master password get leaked?

news.ycombinator.com

Post reply on HN
Print view View original

431–440 of 529 posts

Re: Ask HN: How did my LastPass master password get leaked?

#431

Post by tuwtuwtuwtuw »

gregsadetsky wrote: post #429
ksec wrote: post #420

Earlier quoted context omitted.

Finally, if it is indeed not Lastpass's fault and as they say they dont store master password on their server, then there must be a software all these victims have in common. And it has to be fairly common so we could get at least 20 report on a HN thread. Side Note: Interesting all it takes was AppleInsider publishing, getting some sort of traction. And Lastpass had a response within two hours. Edit: This still does…

Yeah, what doesn't make sense is that the emails we all received says: "Someone just used your master password to try to log in to your account from a device or location we didn't recognize" so either: - the email was sent incorrectly i.e. our master passwords were /not/ used to login. In that case, why was the email sent? - the email is correct i.e. someone does indeed have access to our master password (it was conf…

It does make sense if you consider that there can be more than 1 vulnerability and that some attacker targeting LastPass may use recent password from a fresh vulnerability mixed with older passwords from some previous breach.

I'm not actually following what does not make sense.

Re: Ask HN: How did my LastPass master password get leaked?

#432

Post by ksec »

tuwtuwtuwtuw wrote: post #430
ksec wrote: post #420

Earlier quoted context omitted.

Finally, if it is indeed not Lastpass's fault and as they say they dont store master password on their server, then there must be a software all these victims have in common. And it has to be fairly common so we could get at least 20 report on a HN thread. Side Note: Interesting all it takes was AppleInsider publishing, getting some sort of traction. And Lastpass had a response within two hours. Edit: This still does…

> Unless @gregsadetsky had his computer access full hacked. He stored the LastPass password in KeePass, right? KeePass has had vulnerabilities allowing JavaScript on any web page read secrets from the KeePass storage. I'm not saying that's what happened, but I don't think it's safe to say that "had his computer access full hacked.". There's also plenty of NPM packages and similar which has had vulnerabilities which c…

Yes and agree, pure speculation / inferring guesses. Based on the assumption the attacker would choose the easiest path. Although I did thought of Keepass leak, but most of the other incidents doesn't use KeePass though.

I just wish HN has a show newest comment first, it is bit hard to follow at the moment.

>LastPass seems a bit like a mess so I would not be surprised if they are to blame though.

Reading that. There is another possibility... no one was hacked..... it was just attacker trying to log in using the wrong password and the email Lasspass generated completely messed up.

Re: Ask HN: How did my LastPass master password get leaked?

#433

Post by CryptoBanker »

gregsadetsky wrote: post #244
CryptoBanker wrote: post #236

Earlier quoted context omitted.

Old LastPass account with a random string as the password, definitely not used anywhere else

And you received the same "Someone just used your master password to try to log in to your account from a device or location we didn't recognize" email? Someone is tracking IP addresses now in the thread -- would you mind sharing what was your attacker's IP?

154.201.46.49

Re: Ask HN: How did my LastPass master password get leaked?

#434

Post by gregsadetsky »

tuwtuwtuwtuw wrote: post #431
gregsadetsky wrote: post #429

Earlier quoted context omitted.

Yeah, what doesn't make sense is that the emails we all received says: "Someone just used your master password to try to log in to your account from a device or location we didn't recognize" so either: - the email was sent incorrectly i.e. our master passwords were /not/ used to login. In that case, why was the email sent? - the email is correct i.e. someone does indeed have access to our master password (it was conf…

It does make sense if you consider that there can be more than 1 vulnerability and that some attacker targeting LastPass may use recent password from a fresh vulnerability mixed with older passwords from some previous breach. I'm not actually following what does not make sense.

What's confusing to me is that my password was never used elsewhere (it was generated only to be used with LastPass and stored in KeePass). Other reports here say that their passwords were unique as well.

I just have a doubt right now about the possibiliy that this attack was using passwords from past breaches (which is what LastPass is saying)

Re: Ask HN: How did my LastPass master password get leaked?

#435

Post by gregsadetsky »

CryptoBanker wrote: post #433
gregsadetsky wrote: post #244

Earlier quoted context omitted.

And you received the same "Someone just used your master password to try to log in to your account from a device or location we didn't recognize" email? Someone is tracking IP addresses now in the thread -- would you mind sharing what was your attacker's IP?

154.201.46.49

Thanks!

Re: Ask HN: How did my LastPass master password get leaked?

#436

Post by tuwtuwtuwtuw »

gregsadetsky wrote: post #434
tuwtuwtuwtuw wrote: post #431

Earlier quoted context omitted.

It does make sense if you consider that there can be more than 1 vulnerability and that some attacker targeting LastPass may use recent password from a fresh vulnerability mixed with older passwords from some previous breach. I'm not actually following what does not make sense.

What's confusing to me is that my password was never used elsewhere (it was generated only to be used with LastPass and stored in KeePass). Other reports here say that their passwords were unique as well. I just have a doubt right now about the possibiliy that this attack was using passwords from past breaches (which is what LastPass is saying)

But when they are talking about breaches they aren't just referring to other web sites being hacked. In theory, your computer may have been compromised some time during the last years.

It was just weeks ago some very popular package on NPM was found to collect credentials.

Again, not saying that's what happened but theoretically your computer was breached with some malware which collected credentials. I just meant it "makes sense" from a technical point of view. The likelyhood of this being the issue I am more unsure about.

Re: Ask HN: How did my LastPass master password get leaked?

#437

Post by gregsadetsky »

tuwtuwtuwtuw wrote: post #436
gregsadetsky wrote: post #434

Earlier quoted context omitted.

What's confusing to me is that my password was never used elsewhere (it was generated only to be used with LastPass and stored in KeePass). Other reports here say that their passwords were unique as well. I just have a doubt right now about the possibiliy that this attack was using passwords from past breaches (which is what LastPass is saying)

But when they are talking about breaches they aren't just referring to other web sites being hacked. In theory, your computer may have been compromised some time during the last years. It was just weeks ago some very popular package on NPM was found to collect credentials. Again, not saying that's what happened but theoretically your computer was breached with some malware which collected credentials. I just meant it…

Understood, and that makes sense.

Re: Ask HN: How did my LastPass master password get leaked?

#438

Post by aflag »

drakonka wrote: post #418

This article claims LastPass has responded to their request for comment: https://www.howtogeek.com/776450/lastpass-says-it-didnt-leak ... "LastPass investigated recent reports of blocked login attempts and determined the activity is related to fairly common bot-related activity, in which a malicious or bad actor attempts to access user accounts (in this case, LastPass) using email addresses and passwords obtained fro…

So, in other words, they have no idea about what's going on. I'm not sure whether that's good or bad.

Re: Ask HN: How did my LastPass master password get leaked?

#439

Post by tyingq »

EVa5I7bHFq9mnYK wrote: post #365
Retric wrote: post #239

Earlier quoted context omitted.

If you have the hash and algorithm used to generate it of a human generated password you can in the vast majority of cases get the password. It’s a combination of people being very bad at generating, remembering, and entering passwords plus generally being unwilling to wait minutes or even seconds to generate the hash on their local computer.

MD5 is long considered a broken, weak hash algorithm. Here is the MD5 hash of a password: d9afca35a87a2af4168500640fcf2370 Password is 16 characters long, all lower case, no numbers, no special symbols. Please tell me the password.

56 billion md5 hashes per second for $1.80 per hour at OVH. (single Nvidia Tesla v100 GPU)

Still a no-go for plain old brute forcing all a-z combinations. But, if your password is some combination of actual words, common keyboard sequences, or anything else in a password dictionary, it's cracked pretty quick/cheap.

Re: Ask HN: How did my LastPass master password get leaked?

#440

Post by jagstangxl »

gregsadetsky wrote: post #427
jagstangxl wrote: post #426

Earlier quoted context omitted.

Correct, at 10:20 eastern I did receive the verify device/location email using an invalid password but it is no longer sending the email.

That would truly be the best outcome possible -- that LastPass sent out "Someone just used your master password" emails incorrectly i.e. those were false positives.

They are saying it’s just a credential stuffing attack and being that my master passphrase is only used for LastPass I’m hoping that is all that is going on. Their statement does say “It’s important to note that, at this time, we do not have any indication that accounts were successfully accessed” but I would still like confirmation the emails were sent even on invalid attempts.
Post reply on HN