Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass says DevOps engineer’s hacked computer led to security breach in 2022

9to5mac.com

Post reply on HN
Print view View original

121–130 of 270 posts

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#121

Post by 8organicbits »

dividedbyzero wrote: post #104
unit_circle wrote: post #96

First of all: If you have the title of "DevOps" what you're doing is "Operations", you aren't practicing DevOps. Anyway, this company has had incident after incident. This will keep happening every few years for them like it has for the past 10. As will lack of transparency/ outright lying. Some commenters are saying they wish the company the best. I don't. Use something else. LastPass needs to die.

> First of all: If you have the title of "DevOps" what you're doing is "Operations", you aren't practicing DevOps. So what title do you need to have to practice DevOps?

"DevOps enables coordination and collaboration between formerly siloed roles like development, IT operations, quality engineering, and security." - https://learn.microsoft.com/en-us/devops/what-is-devops

It's not a job title, it's an engineering practice. People who participate in DevOps include "software engineer", "network engineer", "IT operations engineer", "platform engineer", "cloud engineer", "quality engineer", "security engineer", "manager", etc.

I'm also one of the people who does "operations" but has a DevOps job title. I've grown to accept this as a second definition, it's quite common now.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#122

Post by antihero »

deathanatos wrote: post #19
IncRnd wrote: post #5

I'm not sure the description is what actually happened. It doesn't have the ring of truth to it. That said, LastPass is not deserving of any trust as a password product of any kind. That a password was captured by a keylogger on a Dev Ops home computer shows that they don't understand how to secure remote computers, the meaning of defense in depth, the importance of proper login authentication, or how to secure data…

Yeah, because the description is inadequate. Is this BYOD? (… seems like not the employee's fault.) Is this the employee used the same password on the laptop and home, got credential stuffed, and LastPass isn't using MFA¹? (…seems like not the employee's fault.) Was there some jump from compromised home laptop to corp laptop? (The network is never to be trusted. …seems like not the employee's fault.) The buck is supp…

I expect the amount of companies that would get fucking owned by simply managing to execute

cat ~/.aws/* |

On a devops/senior dev machine is colossal.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#123

Post by nicky0 »

mschuster91 wrote: post #119
eru wrote: post #110

Earlier quoted context omitted.

Even more so, I think writing down passwords on paper is actually pretty good security: An attacker can only hack the paper with physical access to my office. But if they have that, they might as well install an physical keylogger. You can also combine a written down fragment of the password with a remembered one.

> An attacker can only hack the paper with physical access to my office. ... and there are lots of unrelated people with physical access to your office. Cleaning staff, building maintenance, HVAC technicians, printer service staff... and all of these may not have the same level of background checks as your company has. And even if you hire all of these yourself (which makes sense at a certain scale), that still doesn…

Nobody said the piece of paper has to be a post-it on your monitor. It could in a folder in a locked cabinet.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#124

Post by 8organicbits »

kc10 wrote: post #69

I went through the pain of resetting hundreds of my passwords since the last breach during which they lost encrypted data. It was brutal, took several weeks and I had to spend late nights and weekends resetting passwords as a hobby project. I am glad I went through all the pain.

For anyone who still needs to do this, consider deleting accounts you no longer need. For some sites it's about the same effort to change a password as it is to delete an account (others... a lot more). The next time you need to bulk change passwords, you'll have fewer to change.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#127

Post by macrolime »

BLKNSLVR wrote: post #64
hackernewds wrote: post #34

Earlier quoted context omitted.

As much as LastPass seems to be trying to pin this on a single engineer, and not a broad vuln, the fact that they have such lax policies around access management, especially for a password management system, tells me enough I need to know never to use them again. Waiting for the rebrand and the incoming lawsuits.

Yep. The symptom being that a problem of this scale can be caused by a single engineer, which points to the root cause being deeper and potentially systemic. The question for future trust is: what's been / being done to prevent the same thing from happening again due to another single engineer?

They answer that question directly here

https://support.lastpass.com/help/what-have-we-done-to-ensur...

TLDR;not much

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#128

Post by bearmode »

oceanplexian wrote: post #61
j45 wrote: post #43

We're reminded that cloud services are ultimately someone else's computer. Putting one's secrets someone else's computer under the marketing of convenience is just that. This is not just to do with LastPass. It doesn't make sense why one would put their personal, most valuable passwords in the hand of another party. Of course, it's handy on a team between people. When it comes to our bank accounts, do we trust someon…

I really don't understand the point of these cloud password managers. Use something like KeepassX. Encrypt it with AES256, upload it to Dropbox, Google Drive, whatever. I personally throw the encrypted p/w file in an encrypted MacOS disk image with a secondary, separate memorized passphrase as well. Literally solves the problem without having to trust or pay some random sketchy service.

Because that's unbelievably less convenient.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#130

Post by eertami »

electric_mayhem wrote: post #17

Wait, was he not using a password manager or something? I hear lastpass is pretty good, if he needs recommendations.

People are likely to use weak passwords with Plex, just like they do with Netflix, so that they can easily share the details with other users and input it easily from memory on things like TVs and tablets.

I think generally people consider it low risk, because "who cares if someone can see what I was watching", but if you can get RCE on a computer running Plex Media Server just by logging in to the Plex account, then of course that's a huge security surface and your Plex login should be a secure randomly generated password and have 2FA enabled.

Of course, this can be avoided by paying for the premium Plex subscription which allows you to create accounts for other 'non-admin' users, but for people trying to avoid spending money (a large number of the Plex user base probably), then anyone with the login can change settings/administer the server.

Post reply on HN