Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass says DevOps engineer’s hacked computer led to security breach in 2022

9to5mac.com

Post reply on HN
Print view View original

31–40 of 270 posts

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#31

Post by metadaemon »

yazzku wrote: post #24
metadaemon wrote: post #18

Earlier quoted context omitted.

Wouldn’t that be susceptible to the same attack?

No? You'd have to carry out the third-party software RCE on each individual user to install a keylogger. This attack installed a keylogger on a single computer, then exfiltrated millions of passwords. Centralization is a bad thing. Same modus operandi maybe, but nowhere near the same impact.

Yes, but the article made it seem like they had RCE to his home PC. With that they installed the keylogger to retrieve the master key which they then used to decrypt the offline vault.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#32

Post by peanutz454 »

cebert wrote: post #3

> “More specifically, the credentials for the servers were stolen from a DevOps engineer who had access to cloud storage at the company. This made it more difficult for LastPass to detect the suspicious activity.” This comes off as spin to me by LastPass or LogMeIn’s PR department. Even if this was the case, how is it possible for intrusion detection systems to not observe and report abnormally high egress traffic? D…

I would expect that they'd setup something to notify them of - "abnormally high egress traffic downloading every vault", and yet due to alert fatigue, they never noticed. The specific thing with getting too many alerts is that you see them, but they aren't anyone's responsibility in general. The entire team gets them through email or sms or slack, and the new guys looks at them and wonders if we should do something about it like tweaking the criteria, and then gets other stuff to work on and learns to mostly ignore the alerts.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#33

Post by 29athrowaway »

throwawaypass wrote: post #15
mcsniff wrote: post #10

So, with most password managers, when you authenticate on a new device, you are prompted for MFA. The user had a keylogger installed on their machine, so the attacker could collect the master password, but how did they login to the vault on a new machine without MFA? Did they get the MFA seed and login on a different machine, and nobody received a "You're using LastPass on a new machine, if this wasn't you..." messag…

Better trust nobody when it comes to security. I'm using offline keypass. It's great.

https://xkcd.com/538/

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#34

Post by hackernewds »

Johnny555 wrote: post #20
LilBytes wrote: post #2

Am I assuming in this case the engineer was using his home PC to work? This isn't unheard of in the industry, Engineers using BYOD devices or similar to work from home. But with a company with a risk profile as high as LastPass this seems _incredibly dumb_. You would assume anyone with the keys to the kingdom was working on a company provided device, or any device that fits a compliance framework based on their own r…

My company isn't nearly as high profile or security focused and we're not allowed to use our own computers for any work related purposes,and our work laptops run threat detection software and we have a whitelist of software we're allowed to install. I'm surprised that LastPass's policies aren't at least that strict. My company has what I think is a big hole in this policy in that we're allowed to use our own phone fo…

As much as LastPass seems to be trying to pin this on a single engineer, and not a broad vuln, the fact that they have such lax policies around access management, especially for a password management system, tells me enough I need to know never to use them again.

Waiting for the rebrand and the incoming lawsuits.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#35

Post by technick »

Only 4 engineers had this level of privilege at lastpass, how did the attacker identify the target? Linkedin... that's why you should not list where you work until you're no longer working there or list a completely different role than what you're currently in.

I'm listed as a janitor of where I work. Only those that know me, know what I really do.

I've tried to sell the policy forbidding employees from listing their positions or where they work on linkedin, each time management frowns and says no. One day they'll come around...

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#36

Post by replaceusb »

Seems like a lot of their talk of zero knowledge was bs.

>In December, we notified a subset of customers whose SCIM, Enterprise API, and SAML keys were stored in unencrypted form. This only affected customers who joined LastPass and used these services in 2019 or before.

This part just blew my mind.

>Important: Since resetting MFA shared secrets destroys all LastPass sessions and trusted devices for these users, these users will need to log back in, go through location verification, and re-enable their respective MFA apps to continue using the service.

I feel sorry for everyones internal helpdesk. This is going to be brutal.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#37

Post by PragmaticPulp »

technick wrote: post #35

Only 4 engineers had this level of privilege at lastpass, how did the attacker identify the target? Linkedin... that's why you should not list where you work until you're no longer working there or list a completely different role than what you're currently in. I'm listed as a janitor of where I work. Only those that know me, know what I really do. I've tried to sell the policy forbidding employees from listing their…

> I've tried to sell the policy forbidding employees from listing their positions or where they work on linkedin, each time management frowns and says no. One day they'll come around...

Forbidding employees from listing their role on LinkedIn would put them at a major disadvantage in job searching and recruiting.

Forcing employees to hide their role is unreasonable. The company doesn’t own the employee.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#38

Post by hsbauauvhabzb »

technick wrote: post #35

Only 4 engineers had this level of privilege at lastpass, how did the attacker identify the target? Linkedin... that's why you should not list where you work until you're no longer working there or list a completely different role than what you're currently in. I'm listed as a janitor of where I work. Only those that know me, know what I really do. I've tried to sell the policy forbidding employees from listing their…

I’m not saying security through obscurity is an entirely false practice, but attempting to hide where you work is only going to obfuscate the truth. I’m sure sites like rocketreach* scrape from more than just LI.

*Please don’t pay this mob money, they are rent seeking, bottom feeding scum.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#40

Post by wolfi1 »

metadaemon wrote: post #23
LilBytes wrote: post #2

Am I assuming in this case the engineer was using his home PC to work? This isn't unheard of in the industry, Engineers using BYOD devices or similar to work from home. But with a company with a risk profile as high as LastPass this seems _incredibly dumb_. You would assume anyone with the keys to the kingdom was working on a company provided device, or any device that fits a compliance framework based on their own r…

I don’t think he’s necessarily working on his pc. He probably just had a shared LastPass account between work and his pc.

as a devop a shared account mixing private and business? would be a security breach if you ask me
Post reply on HN