LastPass says DevOps engineer’s hacked computer led to security breach in 2022
1–10 of 270 posts
Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022
#2Am I assuming in this case the engineer was using his home PC to work?
This isn't unheard of in the industry, Engineers using BYOD devices or similar to work from home. But with a company with a risk profile as high as LastPass this seems _incredibly dumb_.
You would assume anyone with the keys to the kingdom was working on a company provided device, or any device that fits a compliance framework based on their own risk needs (which should be massive!).
E.g., endpoint management, AV/detection, FIDO2 with Yubikeys to access AWS as an admin and otherwise. Just a few off the top of my head.
Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022
#3> “More specifically, the credentials for the servers were stolen from a DevOps engineer who had access to cloud storage at the company. This made it more difficult for LastPass to detect the suspicious activity.”
This comes off as spin to me by LastPass or LogMeIn’s PR department. Even if this was the case, how is it possible for intrusion detection systems to not observe and report abnormally high egress traffic? Downloading every vault should be a rather noticeable event.
Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022
#4> This was accomplished by targeting the DevOps engineer’s home computer and exploiting a vulnerable third-party media software package, which enabled remote code execution capability and allowed the threat actor to implant keylogger malware. The threat actor was able to capture the employee’s master password as it was entered, after the employee authenticated with MFA, and gain access to the DevOps engineer’s LastPass corporate vault.
Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022
#5I'm not sure the description is what actually happened. It doesn't have the ring of truth to it.
That said, LastPass is not deserving of any trust as a password product of any kind. That a password was captured by a keylogger on a Dev Ops home computer shows that they don't understand how to secure remote computers, the meaning of defense in depth, the importance of proper login authentication, or how to secure data at rest. Each of these points are close to the core of their business.
I don't wish them ill. I hope they recover from this, but they need to understand security to produce a security product.
Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022
#6> “More specifically, the credentials for the servers were stolen from a DevOps engineer who had access to cloud storage at the company. This made it more difficult for LastPass to detect the suspicious activity.” This comes off as spin to me by LastPass or LogMeIn’s PR department. Even if this was the case, how is it possible for intrusion detection systems to not observe and report abnormally high egress traffic? D…
If they only took the vaults after a user accessed them, that would be less than double the traffic in the system. It depends how patient they were, or how broken the system was.
Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022
#7> “More specifically, the credentials for the servers were stolen from a DevOps engineer who had access to cloud storage at the company. This made it more difficult for LastPass to detect the suspicious activity.” This comes off as spin to me by LastPass or LogMeIn’s PR department. Even if this was the case, how is it possible for intrusion detection systems to not observe and report abnormally high egress traffic? D…
Maybe it was one of those odd and security-violating cases that give CISOs nightmares where they test by copying PROD to the SANDBOX.
Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022
#8> Following the incident, LastPass has taken a number of steps to prevent future attacks and investigate what happened. The engineer was assisted in strengthening the security of their personal network [...]
I hope this involved something along the lines of: "This zoom meeting won't end until you update your router firmware".
Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022
#9> This was accomplished by targeting the DevOps engineer’s home computer and exploiting a vulnerable third-party media software package, which enabled remote code execution capability and allowed the threat actor to implant keylogger malware. The threat actor was able to capture the employee’s master password as it was entered, after the employee authenticated with MFA, and gain access to the DevOps engineer’s LastPa…
Bring your own computer for DevOps ?
Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022
#10So, with most password managers, when you authenticate on a new device, you are prompted for MFA.
The user had a keylogger installed on their machine, so the attacker could collect the master password, but how did they login to the vault on a new machine without MFA?
Did they get the MFA seed and login on a different machine, and nobody received a "You're using LastPass on a new machine, if this wasn't you..." message?
Did they exfil all that data to the compromised machine first, then out?
Unless I'm missing something, this doesn't seem right.