Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass says DevOps engineer’s hacked computer led to security breach in 2022

9to5mac.com

Post reply on HN
Print view View original

71–80 of 270 posts

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#71

Post by BLKNSLVR »

peanutz454 wrote: post #32
cebert wrote: post #3

> “More specifically, the credentials for the servers were stolen from a DevOps engineer who had access to cloud storage at the company. This made it more difficult for LastPass to detect the suspicious activity.” This comes off as spin to me by LastPass or LogMeIn’s PR department. Even if this was the case, how is it possible for intrusion detection systems to not observe and report abnormally high egress traffic? D…

I would expect that they'd setup something to notify them of - "abnormally high egress traffic downloading every vault", and yet due to alert fatigue, they never noticed. The specific thing with getting too many alerts is that you see them, but they aren't anyone's responsibility in general. The entire team gets them through email or sms or slack, and the new guys looks at them and wonders if we should do something a…

That's really just a variation on the same problem though.

We installed security product X, job done, walk away happy![0]

[0]: https://yewtu.be/watch?v=62NyFTAKgOI

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#72

Post by NoPicklez »

PragmaticPulp wrote: post #37
technick wrote: post #35

Only 4 engineers had this level of privilege at lastpass, how did the attacker identify the target? Linkedin... that's why you should not list where you work until you're no longer working there or list a completely different role than what you're currently in. I'm listed as a janitor of where I work. Only those that know me, know what I really do. I've tried to sell the policy forbidding employees from listing their…

> I've tried to sell the policy forbidding employees from listing their positions or where they work on linkedin, each time management frowns and says no. One day they'll come around... Forbidding employees from listing their role on LinkedIn would put them at a major disadvantage in job searching and recruiting. Forcing employees to hide their role is unreasonable. The company doesn’t own the employee.

I disagree, but disclaimer I work at a company that allows you to.

If you work at an organisation like LastPass in a privileged position, then you need to be aware that you are an enormous target. And it's not just your own or the companies security you potentially compromise, but millions of others arguably most sensitive information.

In Australia, if you have a security defence clearance, you are not allowed to display that in your social media networks (e.g. Linkedin), despite that potentially being important to your other job prospects in such industry. For those exact reasons.

If your LinkedIn said you were a DevOps engineer at LastPass, you know for sure that they're a prime target.

I'm not arguing the legality of it, just the problem it poses if you don't. Perhaps the solution is to tighten who can see your position and you diligently only connect with people you absolutely know and not have connections of connections on.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#75

Post by jason_wo »

I'am honest, similar things could happen on my laptop for my personal stuff.

I have some AWS keys in some files that are used by terraform/packer. A hacker could easily get them.

Some other AWS keys are stored in the CI system and provided as env variables. Someone that can merge/push to the specified branches can just change the CI script an exfiltrate them.

How can I fix that?

I would need some MFA for both cases. I would imagine it would be a good idea that I have to confirm each action on MFA device, which will then generate temporary tokens that are invalid after a few minutes. I locked into some solutions like Hashicorp Vault but I was not able to build something in a short time. New features were always more important.

How do you do it?

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#76

Post by Fire-Dragon-DoL »

oceanplexian wrote: post #61
j45 wrote: post #43

We're reminded that cloud services are ultimately someone else's computer. Putting one's secrets someone else's computer under the marketing of convenience is just that. This is not just to do with LastPass. It doesn't make sense why one would put their personal, most valuable passwords in the hand of another party. Of course, it's handy on a team between people. When it comes to our bank accounts, do we trust someon…

I really don't understand the point of these cloud password managers. Use something like KeepassX. Encrypt it with AES256, upload it to Dropbox, Google Drive, whatever. I personally throw the encrypted p/w file in an encrypted MacOS disk image with a secondary, separate memorized passphrase as well. Literally solves the problem without having to trust or pay some random sketchy service.

Sharing with family sucks with these. No permission control and no simultaneous write from multiple devices make those unusable

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#77

Post by Thorrez »

bobleeswagger wrote: post #59
lathiat wrote: post #11

Earlier quoted context omitted.

They had code execution on the persons computer, the encrypted vault is downloaded and stored/cached on the computer - you only need the master password at that point to decrypt it. Or to read the decrypted version out of the process (e.g. your web browsers memory) The 2FA part in the password managers (and least in the major players currently) is to get a copy of the encrypted vault from the server. The user did tha…

Seems like a broken 2FA implementation.

2FA can't protect you from malware on your machine.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#78

Post by razemio »

bobleeswagger wrote: post #59
lathiat wrote: post #11

Earlier quoted context omitted.

They had code execution on the persons computer, the encrypted vault is downloaded and stored/cached on the computer - you only need the master password at that point to decrypt it. Or to read the decrypted version out of the process (e.g. your web browsers memory) The 2FA part in the password managers (and least in the major players currently) is to get a copy of the encrypted vault from the server. The user did tha…

Seems like a broken 2FA implementation.

How would you fix this problem with 2fa? I can't imagine how this would work technically. Maybe I am missing something.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#79

Post by Thorrez »

judge2020 wrote: post #63
moring wrote: post #62

Earlier quoted context omitted.

Have you consulted a lawyer to check if you can even forbid employees doing this? It sounds unenforceable to me (depending on your country, YMMV of course).

In the US, it's legal under threat of being fired, since companies can fire you for any reason as long as it's not discrimination of a protected class.

California also has this law:

>Labor Code section 232.5 prohibits an employer from discharging or retaliating against an employee who discusses or discloses information about the employer’s working conditions.

https://www.dir.ca.gov/dlse/howtofilelinkcodesections.htm

I'm not sure if it applies, but I could see why lawyers might be nervous about forbidding employees from saying their role.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#80

Post by rightbyte »

NoPicklez wrote: post #66
schainks wrote: post #60

Earlier quoted context omitted.

> The buck is supposed to stop at security, not at each employee's personal hygiene … if your game plan depends on the latter, it's game over. I have to take security trainings twice a year that literally talk about the buck stopping at my digital hygiene and I better not fuck it up for The Company. Companies have to understand breaches will happen, but preparing employees on how to spot attacks or understand when th…

Right, but for your average user. If your machine is infected with a keylogger that results in a stolen password because of a vulnerability not timely identified and corrected. That's not on you as an employee, that's on the security team for not implementing compensating controls/defence in depth. Yes you have a responsibility to detect phishing emails, not writing down passwords, inserting USB's etc. But if somethi…

> Yes you have a responsibility to [...] not writing down passwords

Most places force you to rotate the password so I would not say it is a responsibility to not write it down.

I do it. It is like there is a fixed number of passwords per life you can remember or something.

Post reply on HN