Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass says DevOps engineer’s hacked computer led to security breach in 2022

9to5mac.com

Post reply on HN
Print view View original

111–120 of 270 posts

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#111

Post by oxfordmale »

jstummbillig wrote: post #107
IncRnd wrote: post #5

I'm not sure the description is what actually happened. It doesn't have the ring of truth to it. That said, LastPass is not deserving of any trust as a password product of any kind. That a password was captured by a keylogger on a Dev Ops home computer shows that they don't understand how to secure remote computers, the meaning of defense in depth, the importance of proper login authentication, or how to secure data…

> That a password was captured by a keylogger on a Dev Ops home computer shows that they don't understand how to secure remote computers I tend to disagree. The potential for any single employee to do substantial harm to any business is incredible and designing a system to make that not possible is nigh impossible. It's neither the humans nor the institutions fault. It's just that systems involving humans are incredi…

If a password was captured by a key logger, rather than a session token being stolen, they didn't implement 2FA for this login.

They are also talking about a home computer. In my company, VPN access is limited to trusted devices; therefore, sensitive systems can only be accessed from a corporate machine.

Security at LastPass seems substandard for a company storing security credentials. Unfortunately, from my experience, this is relatively common, and regulators need to start issuing significant fines or prison sentences for this to improve. Unfortunately, it is too easy for CTO/CISO to find a scapegoat and avoid scrutiny.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#112

Post by eru »

kodah wrote: post #89
theamk wrote: post #52

Earlier quoted context omitted.

Are there any reliable ways to secure remote computers from keyloggers _and_ still provide an efficient software development environment for non-trivial projects? All of the software engineers I have seen have a fairly unrestricted environment -- Linux machines, with sudo access, often with passwordless root access via "docker" group, and with non-intrusive "endpoint protection" system. It would be normal to for some…

Personally, I'm not a fan of the answers that amount to a cloud-hosted thin client. I use these at work, they're absolute technological marvels, but they suck. The real answer is a zero trust network that implements: - multi factor auth - deployment approval gates - end to end service encryption - ALE for secrets and keys - password managers - WireGuard tunneling or equivalent - read only production environments by d…

> - read only production environments by default; major levers to pull in order to write

Yes. In general, it's a good idea to split state management from business logic.

In the simplest thing, that means that eg you have a database that's separate from the rest of your site. But the principle applies more generally.

Useful for keeping things simple.

To go further: if you want to log something, you send it to a log server that is super simple and can only write to one location. So if someone takes over your business logic service, they can't write arbitrarily.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#113

Post by forty »

mcsniff wrote: post #10

So, with most password managers, when you authenticate on a new device, you are prompted for MFA. The user had a keylogger installed on their machine, so the attacker could collect the master password, but how did they login to the vault on a new machine without MFA? Did they get the MFA seed and login on a different machine, and nobody received a "You're using LastPass on a new machine, if this wasn't you..." messag…

I work for a LastPass competitor.

As far as I know, no popular password manager seriously includes "fully compromised local device" in their threat model. I don't think it can be done without hurting seriously usability (like having one 2fa verification each time you use a credential would work) and the predictable outcome of hurting usability too much is that people will find more handy insecure ways to store their passwords.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#114

Post by jason_wo »

j13n wrote: post #98
jason_wo wrote: post #75

I'am honest, similar things could happen on my laptop for my personal stuff. I have some AWS keys in some files that are used by terraform/packer. A hacker could easily get them. Some other AWS keys are stored in the CI system and provided as env variables. Someone that can merge/push to the specified branches can just change the CI script an exfiltrate them. How can I fix that? I would need some MFA for both cases.…

YubiKeys and aws-vault for managing my credentials. Hashicorp Vault and SSM for services.

Nice! Do I understand this correctly?

You use aws-vault(https://github.com/99designs/aws-vault) and configure it with IAM and MFA with YubiKeys. You configure e.g. the profile jonsmith.

When you run

aws-vault exec jonsmith -- aws s3 ls

it will ask you, e.g. every hour to confirm with YubiKeys and cache the key for one hour. After that the temporary keys expire. Can you also store keys different from AWS?

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#115

Post by pid-1 »

jstummbillig wrote: post #107
IncRnd wrote: post #5

I'm not sure the description is what actually happened. It doesn't have the ring of truth to it. That said, LastPass is not deserving of any trust as a password product of any kind. That a password was captured by a keylogger on a Dev Ops home computer shows that they don't understand how to secure remote computers, the meaning of defense in depth, the importance of proper login authentication, or how to secure data…

> That a password was captured by a keylogger on a Dev Ops home computer shows that they don't understand how to secure remote computers I tend to disagree. The potential for any single employee to do substantial harm to any business is incredible and designing a system to make that not possible is nigh impossible. It's neither the humans nor the institutions fault. It's just that systems involving humans are incredi…

Restricting access to corporate environments from trusted machines is trivial using any form of MDM. No one should be working from their personal machines. That's gross negligence.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#116

Post by jhoelzel »

Im not sure that they are just using this as a scapegoat but if your working from home, as a DevOps/Platform engineer, your very first ticket should be to activate MFA.

Kubernetes does MFA, all the Clouds do MFA and the company you work for can afford a "cheap android phone as key".

No matter if bare-metal, cloud or managed. If you habe ANY edit rights you need MFA.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#117

Post by pid-1 »

theamk wrote: post #52
IncRnd wrote: post #5

I'm not sure the description is what actually happened. It doesn't have the ring of truth to it. That said, LastPass is not deserving of any trust as a password product of any kind. That a password was captured by a keylogger on a Dev Ops home computer shows that they don't understand how to secure remote computers, the meaning of defense in depth, the importance of proper login authentication, or how to secure data…

Are there any reliable ways to secure remote computers from keyloggers _and_ still provide an efficient software development environment for non-trivial projects? All of the software engineers I have seen have a fairly unrestricted environment -- Linux machines, with sudo access, often with passwordless root access via "docker" group, and with non-intrusive "endpoint protection" system. It would be normal to for some…

My company operates in a Windows centric industry and our software team uses it as well.

It turns out you don't need administrative privileges for a lot of dev work (installing and running vs code, python, node, many databases, etc...).

My experience is that sudo apt-get install is a Linux Distro thing, most programs don't need special permissions as long they are installed in user scope.

So, answering your question, our devs are like regular users: when they need to install something that needs privileges they call IT. Surprisingly, that rarely happens.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#119

Post by mschuster91 »

eru wrote: post #110
rightbyte wrote: post #80

Earlier quoted context omitted.

> Yes you have a responsibility to [...] not writing down passwords Most places force you to rotate the password so I would not say it is a responsibility to not write it down. I do it. It is like there is a fixed number of passwords per life you can remember or something.

Even more so, I think writing down passwords on paper is actually pretty good security: An attacker can only hack the paper with physical access to my office. But if they have that, they might as well install an physical keylogger. You can also combine a written down fragment of the password with a remembered one.

> An attacker can only hack the paper with physical access to my office.

... and there are lots of unrelated people with physical access to your office. Cleaning staff, building maintenance, HVAC technicians, printer service staff... and all of these may not have the same level of background checks as your company has.

And even if you hire all of these yourself (which makes sense at a certain scale), that still doesn't protect you against marketing inviting a camera crew and walking around everywhere in one of these typical "life at the office" short films for Linkedin. IT staff offices seem to be very popular for such films since they're usually the most personalized rooms with lots of nerd stuff on the walls and desks.

Besides: swiping a photo of a post-it leaves no evidence, whereas installing a physical keylogger certainly does.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#120

Post by secondcoming »

deathanatos wrote: post #19
IncRnd wrote: post #5

I'm not sure the description is what actually happened. It doesn't have the ring of truth to it. That said, LastPass is not deserving of any trust as a password product of any kind. That a password was captured by a keylogger on a Dev Ops home computer shows that they don't understand how to secure remote computers, the meaning of defense in depth, the importance of proper login authentication, or how to secure data…

Yeah, because the description is inadequate. Is this BYOD? (… seems like not the employee's fault.) Is this the employee used the same password on the laptop and home, got credential stuffed, and LastPass isn't using MFA¹? (…seems like not the employee's fault.) Was there some jump from compromised home laptop to corp laptop? (The network is never to be trusted. …seems like not the employee's fault.) The buck is supp…

If you BYOD then do your work stuff on a VM. It’ll help with security and has the benefit that you can just delete the VM when you change jobs.
Post reply on HN