Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass says DevOps engineer’s hacked computer led to security breach in 2022

9to5mac.com

Post reply on HN
Print view View original

61–70 of 270 posts

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#61

Post by oceanplexian »

j45 wrote: post #43

We're reminded that cloud services are ultimately someone else's computer. Putting one's secrets someone else's computer under the marketing of convenience is just that. This is not just to do with LastPass. It doesn't make sense why one would put their personal, most valuable passwords in the hand of another party. Of course, it's handy on a team between people. When it comes to our bank accounts, do we trust someon…

I really don't understand the point of these cloud password managers. Use something like KeepassX. Encrypt it with AES256, upload it to Dropbox, Google Drive, whatever. I personally throw the encrypted p/w file in an encrypted MacOS disk image with a secondary, separate memorized passphrase as well. Literally solves the problem without having to trust or pay some random sketchy service.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#62

Post by moring »

technick wrote: post #35

Only 4 engineers had this level of privilege at lastpass, how did the attacker identify the target? Linkedin... that's why you should not list where you work until you're no longer working there or list a completely different role than what you're currently in. I'm listed as a janitor of where I work. Only those that know me, know what I really do. I've tried to sell the policy forbidding employees from listing their…

Have you consulted a lawyer to check if you can even forbid employees doing this? It sounds unenforceable to me (depending on your country, YMMV of course).

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#63

Post by judge2020 »

moring wrote: post #62
technick wrote: post #35

Only 4 engineers had this level of privilege at lastpass, how did the attacker identify the target? Linkedin... that's why you should not list where you work until you're no longer working there or list a completely different role than what you're currently in. I'm listed as a janitor of where I work. Only those that know me, know what I really do. I've tried to sell the policy forbidding employees from listing their…

Have you consulted a lawyer to check if you can even forbid employees doing this? It sounds unenforceable to me (depending on your country, YMMV of course).

In the US, it's legal under threat of being fired, since companies can fire you for any reason as long as it's not discrimination of a protected class.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#64

Post by BLKNSLVR »

hackernewds wrote: post #34
Johnny555 wrote: post #20

Earlier quoted context omitted.

My company isn't nearly as high profile or security focused and we're not allowed to use our own computers for any work related purposes,and our work laptops run threat detection software and we have a whitelist of software we're allowed to install. I'm surprised that LastPass's policies aren't at least that strict. My company has what I think is a big hole in this policy in that we're allowed to use our own phone fo…

As much as LastPass seems to be trying to pin this on a single engineer, and not a broad vuln, the fact that they have such lax policies around access management, especially for a password management system, tells me enough I need to know never to use them again. Waiting for the rebrand and the incoming lawsuits.

Yep. The symptom being that a problem of this scale can be caused by a single engineer, which points to the root cause being deeper and potentially systemic.

The question for future trust is: what's been / being done to prevent the same thing from happening again due to another single engineer?

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#65

Post by luxuryballs »

IncRnd wrote: post #5

I'm not sure the description is what actually happened. It doesn't have the ring of truth to it. That said, LastPass is not deserving of any trust as a password product of any kind. That a password was captured by a keylogger on a Dev Ops home computer shows that they don't understand how to secure remote computers, the meaning of defense in depth, the importance of proper login authentication, or how to secure data…

Even if they got pwned and the hackers got full system access like this the screw up is still definitely in the implementation right?

Isn't this like basic stuff where you would use encryption that only the end-user can bypass?

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#66

Post by NoPicklez »

schainks wrote: post #60
deathanatos wrote: post #19

Earlier quoted context omitted.

Yeah, because the description is inadequate. Is this BYOD? (… seems like not the employee's fault.) Is this the employee used the same password on the laptop and home, got credential stuffed, and LastPass isn't using MFA¹? (…seems like not the employee's fault.) Was there some jump from compromised home laptop to corp laptop? (The network is never to be trusted. …seems like not the employee's fault.) The buck is supp…

> The buck is supposed to stop at security, not at each employee's personal hygiene … if your game plan depends on the latter, it's game over. I have to take security trainings twice a year that literally talk about the buck stopping at my digital hygiene and I better not fuck it up for The Company. Companies have to understand breaches will happen, but preparing employees on how to spot attacks or understand when th…

Right, but for your average user. If your machine is infected with a keylogger that results in a stolen password because of a vulnerability not timely identified and corrected.

That's not on you as an employee, that's on the security team for not implementing compensating controls/defence in depth.

Yes you have a responsibility to detect phishing emails, not writing down passwords, inserting USB's etc. But if something happens to you completely behind the scenes during your normal business, it's not on the employee.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#68

Post by gavanm »

theamk wrote: post #52
IncRnd wrote: post #5

I'm not sure the description is what actually happened. It doesn't have the ring of truth to it. That said, LastPass is not deserving of any trust as a password product of any kind. That a password was captured by a keylogger on a Dev Ops home computer shows that they don't understand how to secure remote computers, the meaning of defense in depth, the importance of proper login authentication, or how to secure data…

Are there any reliable ways to secure remote computers from keyloggers _and_ still provide an efficient software development environment for non-trivial projects? All of the software engineers I have seen have a fairly unrestricted environment -- Linux machines, with sudo access, often with passwordless root access via "docker" group, and with non-intrusive "endpoint protection" system. It would be normal to for some…

You've already included the answer - "using their machines as remote terminals, doing most their actual work on some remote server".

The developer uses MFA (TOTP, Push Notification, Yubikey etc) into a virtual desktop inside the organisation (Citrix, VMWare Horizon, etc).

From there, the developer can SSH / whatever into their development environment - which is hosted "inside" the corporate network, or their cloud provider, via internal links.

All code, and dev boxes live "inside" the corporate network, and only keypresses, mouse movement, and screen diffs are sent back and forth.

Most remote access packages can prevent clipboard, USB device, file transfer etc.

If you need a password manager for work purposes, then it lives on the corporate managed network - not your remote laptop/desktop - and to be really paranoid - you only ever "copy/paste" those passwords - you don't type them in.

If you really want to lock it down further, give the remote workers dedicated corporate equipment that they only use to access the remote desktops, so you can prevent some things like screen capturing, and really lock down the software to prevent things like keylogging software/malware.

You also should have the entire development environment segregated from the "business" corporate network as well.

It's only really an issue if you want to have offline developers - in which case I don't have any thoughts ready to hand - (but would expect it to be a very locked down machine, possibly with an even more locked down VM inside it).

As someone who regularly uses multiple layers of Virtual Desktop -> Virtual Desktop -> Remote Desktop, provided the network can handle it (on both your local network, and the corporate network), it works surprisingly well.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#69

Post by kc10 »

I went through the pain of resetting hundreds of my passwords since the last breach during which they lost encrypted data. It was brutal, took several weeks and I had to spend late nights and weekends resetting passwords as a hobby project.

I am glad I went through all the pain.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#70

Post by hnbear »

theamk wrote: post #52
IncRnd wrote: post #5

I'm not sure the description is what actually happened. It doesn't have the ring of truth to it. That said, LastPass is not deserving of any trust as a password product of any kind. That a password was captured by a keylogger on a Dev Ops home computer shows that they don't understand how to secure remote computers, the meaning of defense in depth, the importance of proper login authentication, or how to secure data…

Are there any reliable ways to secure remote computers from keyloggers _and_ still provide an efficient software development environment for non-trivial projects? All of the software engineers I have seen have a fairly unrestricted environment -- Linux machines, with sudo access, often with passwordless root access via "docker" group, and with non-intrusive "endpoint protection" system. It would be normal to for some…

Give you a MacBook and a cloud Linux dev machine (or as many as you want).

Secure access to dev environment with multiple easy factors - MBP biometrics, yubikey, etc

Enforce strong password and FDE on the laptop.

Obviously doesn’t need to be a MacBook, but you stated an aversion to overly locked down windows laptops.

In general, just enforce strong multifactor creds when accessing internal resources.

You can also enforce device very requirements, so a stole device or yubi can’t be used either.

Then do what you want on your Linux instances in the cloud. They’re protected with their own controls.

Post reply on HN