What could possibly go wrong with a centralized password database
LastPass says DevOps engineer’s hacked computer led to security breach in 2022
21–30 of 270 posts
Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022
#22So, with most password managers, when you authenticate on a new device, you are prompted for MFA. The user had a keylogger installed on their machine, so the attacker could collect the master password, but how did they login to the vault on a new machine without MFA? Did they get the MFA seed and login on a different machine, and nobody received a "You're using LastPass on a new machine, if this wasn't you..." messag…
Better trust nobody when it comes to security. I'm using offline keypass. It's great.
This cannot be overstated. The online managers have an absurd amount of complexity. Just think of all the millions already spent tracing back the attack, writing these statements, all the turmoil inside the company... just for the convenience of synchronizing passwords seamlessly.
Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022
#23Am I assuming in this case the engineer was using his home PC to work? This isn't unheard of in the industry, Engineers using BYOD devices or similar to work from home. But with a company with a risk profile as high as LastPass this seems _incredibly dumb_. You would assume anyone with the keys to the kingdom was working on a company provided device, or any device that fits a compliance framework based on their own r…
I don’t think he’s necessarily working on his pc. He probably just had a shared LastPass account between work and his pc.
Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022
#24Earlier quoted context omitted.
Better trust nobody when it comes to security. I'm using offline keypass. It's great.
Wouldn’t that be susceptible to the same attack?
No? You'd have to carry out the third-party software RCE on each individual user to install a keylogger. This attack installed a keylogger on a single computer, then exfiltrated millions of passwords. Centralization is a bad thing. Same modus operandi maybe, but nowhere near the same impact.
Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022
#25Earlier quoted context omitted.
Better trust nobody when it comes to security. I'm using offline keypass. It's great.
Wouldn’t that be susceptible to the same attack?
Basically yes, but the difference in threat potential between “random person” and “person who controls access to the secure passwords of many thousands of people, most of them more tech savvy than the average user” is exponential.
Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022
#26So, with most password managers, when you authenticate on a new device, you are prompted for MFA. The user had a keylogger installed on their machine, so the attacker could collect the master password, but how did they login to the vault on a new machine without MFA? Did they get the MFA seed and login on a different machine, and nobody received a "You're using LastPass on a new machine, if this wasn't you..." messag…
Better trust nobody when it comes to security. I'm using offline keypass. It's great.
That wouldn´t help with a malware scenario.
A Hardware Security Module would avoid exfiltration of secrets.
(Off-line AND off-device)
Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022
#27So, with most password managers, when you authenticate on a new device, you are prompted for MFA. The user had a keylogger installed on their machine, so the attacker could collect the master password, but how did they login to the vault on a new machine without MFA? Did they get the MFA seed and login on a different machine, and nobody received a "You're using LastPass on a new machine, if this wasn't you..." messag…
https://pberba.github.io/security/2020/05/28/lastpass-phishi...
From what I can tell, all of lastpass mfa options are based around some form of otp not webauthn.
We tested the above in our own environment, since we had control of the devices we did not need urls to do it. We just grabbed the data locally to confirm if it was true. At the time lastpass told us webauthn was in the pipeline so we stayed.
Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022
#28The Plex angle & note about securing their personal network had me curious about whether this person had a server exposed to the internet or if the attacker was only able to access it because they’d already compromised LastPass’s VPN. Nobody is looking good here but the former case would be especially regrettable.
You probably at least need remote access within Plex in order to install new plugins, meaning you could probably run the exploit by just having his username and password.
Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022
#29I'm not sure the description is what actually happened. It doesn't have the ring of truth to it. That said, LastPass is not deserving of any trust as a password product of any kind. That a password was captured by a keylogger on a Dev Ops home computer shows that they don't understand how to secure remote computers, the meaning of defense in depth, the importance of proper login authentication, or how to secure data…
While it's very civil of you to wish recovery upon LastPass, I don't really think the product is deserving of redemption. This is not the first major incident and it demonstrates little growth in relation to prior breaches. The world as a whole would probably be better off if LastPass were to breathe its last.
Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022
#30Earlier quoted context omitted.
I'm fascinated that this was part of their remediation. I'd consider "don't trust the employee's local network" to be a pretty basic principle of modern corporate information security. What happens when an employee logs in from hotel wifi? You basically have to treat the network between the user and your environment as hostile, and design for that problem.
And as an employee, "don't trust the company's local network" with your own devices either.
For my personal devices, I trust my company's local network essentially the same as any other network my mobile devices connect to.