Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass says DevOps engineer’s hacked computer led to security breach in 2022

9to5mac.com

Post reply on HN
Print view View original

91–100 of 270 posts

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#91

Post by chii »

IncRnd wrote: post #5

I'm not sure the description is what actually happened. It doesn't have the ring of truth to it. That said, LastPass is not deserving of any trust as a password product of any kind. That a password was captured by a keylogger on a Dev Ops home computer shows that they don't understand how to secure remote computers, the meaning of defense in depth, the importance of proper login authentication, or how to secure data…

> I hope they recover from this, but they need to understand security to produce a security product.

it's because the market doesn't actually pay for a secure product, but the appearance of one.

The end-user buying cannot really discern whether the company's product is actually secure. There's no third-party standard auditing (let's say, a gov't organization).

Banks are run securely, not because I personally audit them, but that the gov't mandates liability onto the banks for losses from their insecure systems. So the banks are secure, because they stand to lose a lot. The same must be mandated for all companies imho, or insecure companies would continue to exist and thrive.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#93

Post by jjeaff »

chaorace wrote: post #29
IncRnd wrote: post #5

I'm not sure the description is what actually happened. It doesn't have the ring of truth to it. That said, LastPass is not deserving of any trust as a password product of any kind. That a password was captured by a keylogger on a Dev Ops home computer shows that they don't understand how to secure remote computers, the meaning of defense in depth, the importance of proper login authentication, or how to secure data…

While it's very civil of you to wish recovery upon LastPass, I don't really think the product is deserving of redemption. This is not the first major incident and it demonstrates little growth in relation to prior breaches. The world as a whole would probably be better off if LastPass were to breathe its last.

They need to sell it to someone else with a better track record.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#94

Post by mekoka »

Nevermind the Plex vulnerability. Nevermind that the thieves are called here "hackers" and the theft, an "attack". It all makes it sound like more of a feat than it actually was. The bottom line for me is this: you outsource your security to a company whose sole reason for existing is to be more paranoid about it than you, and they tell you that what should be among their most treasured and garded secrets can casually be found in a coffee shop nearby.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#95

Post by bboygravity »

LilBytes wrote: post #2

Am I assuming in this case the engineer was using his home PC to work? This isn't unheard of in the industry, Engineers using BYOD devices or similar to work from home. But with a company with a risk profile as high as LastPass this seems _incredibly dumb_. You would assume anyone with the keys to the kingdom was working on a company provided device, or any device that fits a compliance framework based on their own r…

> You would assume anyone with the keys to the kingdom was working on a company provided device, or any device that fits a compliance framework based on their own risk needs (which should be massive!).

You mean one of those company devices that is so locked down that they are close to impossible to work on?

Like if you need to install a new (part of) a toolchain, you need to go through IT which takes between 3 weeks and 6 months?

But your deadline is next week and your manager doesn't care about your IT "excuse", so just use notepad and CLI (or your own PC where you can do in 1 day what would otherwise take you months).

Those devices... yeah...

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#96

Post by unit_circle »

First of all: If you have the title of "DevOps" what you're doing is "Operations", you aren't practicing DevOps.

Anyway, this company has had incident after incident. This will keep happening every few years for them like it has for the past 10. As will lack of transparency/ outright lying.

Some commenters are saying they wish the company the best. I don't. Use something else. LastPass needs to die.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#97

Post by [deleted] »

JadoJodo wrote: post #4

> This was accomplished by targeting the DevOps engineer’s home computer and exploiting a vulnerable third-party media software package, which enabled remote code execution capability and allowed the threat actor to implant keylogger malware. The threat actor was able to capture the employee’s master password as it was entered, after the employee authenticated with MFA, and gain access to the DevOps engineer’s LastPa…

[deleted]

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#98

Post by j13n »

jason_wo wrote: post #75

I'am honest, similar things could happen on my laptop for my personal stuff. I have some AWS keys in some files that are used by terraform/packer. A hacker could easily get them. Some other AWS keys are stored in the CI system and provided as env variables. Someone that can merge/push to the specified branches can just change the CI script an exfiltrate them. How can I fix that? I would need some MFA for both cases.…

YubiKeys and aws-vault for managing my credentials. Hashicorp Vault and SSM for services.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#99

Post by faeyanpiraat »

ed_elliott_asc wrote: post #90
geoelectric wrote: post #84

Earlier quoted context omitted.

I'm sure they meant something analog like on a sticky note rather than in a password manager, where it should be stored.

My bank still won’t let me paste a password so at least that bank doesn’t mean use a password manager!

If you start dragging a password from 1Password, the window disappears and you can release your mouse over a field elsewhere, and it will get typed in there (instead of pasting). This may or may not work for your case.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#100

Post by faeyanpiraat »

gavanm wrote: post #68
theamk wrote: post #52

Earlier quoted context omitted.

Are there any reliable ways to secure remote computers from keyloggers _and_ still provide an efficient software development environment for non-trivial projects? All of the software engineers I have seen have a fairly unrestricted environment -- Linux machines, with sudo access, often with passwordless root access via "docker" group, and with non-intrusive "endpoint protection" system. It would be normal to for some…

You've already included the answer - "using their machines as remote terminals, doing most their actual work on some remote server". The developer uses MFA (TOTP, Push Notification, Yubikey etc) into a virtual desktop inside the organisation (Citrix, VMWare Horizon, etc). From there, the developer can SSH / whatever into their development environment - which is hosted "inside" the corporate network, or their cloud pr…

> You also should have the entire development environment segregated from the "business" corporate network as well.

This is the key point, otherwise you'll also just get a linux machine with developer root access, but EVEN CLOSER to the corporate network.

Post reply on HN