Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass says DevOps engineer’s hacked computer led to security breach in 2022

9to5mac.com

Post reply on HN
Print view View original

11–20 of 270 posts

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#11

Post by lathiat »

mcsniff wrote: post #10

So, with most password managers, when you authenticate on a new device, you are prompted for MFA. The user had a keylogger installed on their machine, so the attacker could collect the master password, but how did they login to the vault on a new machine without MFA? Did they get the MFA seed and login on a different machine, and nobody received a "You're using LastPass on a new machine, if this wasn't you..." messag…

They had code execution on the persons computer, the encrypted vault is downloaded and stored/cached on the computer - you only need the master password at that point to decrypt it. Or to read the decrypted version out of the process (e.g. your web browsers memory)

The 2FA part in the password managers (and least in the major players currently) is to get a copy of the encrypted vault from the server. The user did that part, and the encrypted vault was not easily accessible locally.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#12

Post by SOLAR_FIELDS »

LilBytes wrote: post #2

Am I assuming in this case the engineer was using his home PC to work? This isn't unheard of in the industry, Engineers using BYOD devices or similar to work from home. But with a company with a risk profile as high as LastPass this seems _incredibly dumb_. You would assume anyone with the keys to the kingdom was working on a company provided device, or any device that fits a compliance framework based on their own r…

I could see this kind of sophisticated attack easily working on some random company with fairly lax BYOD policies. Makes sense, it was a rather sophisticated attack when you look at your typical medium sized company. But if your entire company and organization is built around keeping things secure, THIS is what brought you down? This isn’t getting owned by some unforeseen 0day, it’s just sloppy opsec.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#13

Post by akerl_ »

ccooffee wrote: post #8

> Following the incident, LastPass has taken a number of steps to prevent future attacks and investigate what happened. The engineer was assisted in strengthening the security of their personal network [...] I hope this involved something along the lines of: "This zoom meeting won't end until you update your router firmware".

I'm fascinated that this was part of their remediation. I'd consider "don't trust the employee's local network" to be a pretty basic principle of modern corporate information security. What happens when an employee logs in from hotel wifi? You basically have to treat the network between the user and your environment as hostile, and design for that problem.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#14

Post by acdha »

The Plex angle & note about securing their personal network had me curious about whether this person had a server exposed to the internet or if the attacker was only able to access it because they’d already compromised LastPass’s VPN. Nobody is looking good here but the former case would be especially regrettable.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#15

Post by throwawaypass »

mcsniff wrote: post #10

So, with most password managers, when you authenticate on a new device, you are prompted for MFA. The user had a keylogger installed on their machine, so the attacker could collect the master password, but how did they login to the vault on a new machine without MFA? Did they get the MFA seed and login on a different machine, and nobody received a "You're using LastPass on a new machine, if this wasn't you..." messag…

Better trust nobody when it comes to security.

I'm using offline keypass. It's great.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#16

Post by userbinator »

akerl_ wrote: post #13
ccooffee wrote: post #8

> Following the incident, LastPass has taken a number of steps to prevent future attacks and investigate what happened. The engineer was assisted in strengthening the security of their personal network [...] I hope this involved something along the lines of: "This zoom meeting won't end until you update your router firmware".

I'm fascinated that this was part of their remediation. I'd consider "don't trust the employee's local network" to be a pretty basic principle of modern corporate information security. What happens when an employee logs in from hotel wifi? You basically have to treat the network between the user and your environment as hostile, and design for that problem.

And as an employee, "don't trust the company's local network" with your own devices either.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#18

Post by metadaemon »

throwawaypass wrote: post #15
mcsniff wrote: post #10

So, with most password managers, when you authenticate on a new device, you are prompted for MFA. The user had a keylogger installed on their machine, so the attacker could collect the master password, but how did they login to the vault on a new machine without MFA? Did they get the MFA seed and login on a different machine, and nobody received a "You're using LastPass on a new machine, if this wasn't you..." messag…

Better trust nobody when it comes to security. I'm using offline keypass. It's great.

Wouldn’t that be susceptible to the same attack?

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#19

Post by deathanatos »

IncRnd wrote: post #5

I'm not sure the description is what actually happened. It doesn't have the ring of truth to it. That said, LastPass is not deserving of any trust as a password product of any kind. That a password was captured by a keylogger on a Dev Ops home computer shows that they don't understand how to secure remote computers, the meaning of defense in depth, the importance of proper login authentication, or how to secure data…

Yeah, because the description is inadequate. Is this BYOD? (… seems like not the employee's fault.) Is this the employee used the same password on the laptop and home, got credential stuffed, and LastPass isn't using MFA¹? (…seems like not the employee's fault.) Was there some jump from compromised home laptop to corp laptop? (The network is never to be trusted. …seems like not the employee's fault.)

The buck is supposed to stop at security, not at each employee's personal hygiene … if your game plan depends on the latter, it's game over.

There's more here than is being written, and I can only imagine because the truth probably stinks.

¹except TFA mentions MFA … but the mention of it doesn't really make sense.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#20

Post by Johnny555 »

LilBytes wrote: post #2

Am I assuming in this case the engineer was using his home PC to work? This isn't unheard of in the industry, Engineers using BYOD devices or similar to work from home. But with a company with a risk profile as high as LastPass this seems _incredibly dumb_. You would assume anyone with the keys to the kingdom was working on a company provided device, or any device that fits a compliance framework based on their own r…

My company isn't nearly as high profile or security focused and we're not allowed to use our own computers for any work related purposes,and our work laptops run threat detection software and we have a whitelist of software we're allowed to install.

I'm surprised that LastPass's policies aren't at least that strict.

My company has what I think is a big hole in this policy in that we're allowed to use our own phone for email, a few corporate apps (like Jira) and our corporate password manager (not LastPass), but IT doesn't do any management of phones (other than being able to wipe them remotely if you're connected to the company email server). I suspect that the company doesn't want to spend the money on giving everyone a managed phone.

Post reply on HN