Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass says DevOps engineer’s hacked computer led to security breach in 2022

9to5mac.com

Post reply on HN
Print view View original

131–140 of 270 posts

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#131

Post by londons_explore »

If lastpass was well designed, the company would store no private user data.

Ie. they would be a 'dumb' storage system for the customers encrypted data. The data would be encrypted by the customer before upload. And then decrypted again by the customer after download.

Users would be identified by a unique random ID, and users would auth by signing a challenge with a secret key known only to the customer.

That way, even if a bad guy worked for lastpass and had full admin access to all servers, they couldn't steal anything.

And, in fact, if this system was properly designed, it could all run with opensource server code, and the datastore fully open for anyone to inspect, to prove that the security is down to cryptography rather than trusted yet fallible humans.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#132

Post by rwalle »

bboygravity wrote: post #95
LilBytes wrote: post #2

Am I assuming in this case the engineer was using his home PC to work? This isn't unheard of in the industry, Engineers using BYOD devices or similar to work from home. But with a company with a risk profile as high as LastPass this seems _incredibly dumb_. You would assume anyone with the keys to the kingdom was working on a company provided device, or any device that fits a compliance framework based on their own r…

> You would assume anyone with the keys to the kingdom was working on a company provided device, or any device that fits a compliance framework based on their own risk needs (which should be massive!). You mean one of those company devices that is so locked down that they are close to impossible to work on? Like if you need to install a new (part of) a toolchain, you need to go through IT which takes between 3 weeks…

You are making things up. Such a company probably exists somewhere, but I yet need to hear someone telling me a big-name tech company is doing this.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#133

Post by blibble »

schainks wrote: post #60
deathanatos wrote: post #19

Earlier quoted context omitted.

Yeah, because the description is inadequate. Is this BYOD? (… seems like not the employee's fault.) Is this the employee used the same password on the laptop and home, got credential stuffed, and LastPass isn't using MFA¹? (…seems like not the employee's fault.) Was there some jump from compromised home laptop to corp laptop? (The network is never to be trusted. …seems like not the employee's fault.) The buck is supp…

> The buck is supposed to stop at security, not at each employee's personal hygiene … if your game plan depends on the latter, it's game over. I have to take security trainings twice a year that literally talk about the buck stopping at my digital hygiene and I better not fuck it up for The Company. Companies have to understand breaches will happen, but preparing employees on how to spot attacks or understand when th…

> I have to take security trainings twice a year that literally talk about the buck stopping at my digital hygiene and I better not fuck it up for The Company.

this is mostly so they can pin it on you when it inevitably happens (rather than the management)

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#134

Post by jstummbillig »

pid-1 wrote: post #115
jstummbillig wrote: post #107

Earlier quoted context omitted.

> That a password was captured by a keylogger on a Dev Ops home computer shows that they don't understand how to secure remote computers I tend to disagree. The potential for any single employee to do substantial harm to any business is incredible and designing a system to make that not possible is nigh impossible. It's neither the humans nor the institutions fault. It's just that systems involving humans are incredi…

Restricting access to corporate environments from trusted machines is trivial using any form of MDM. No one should be working from their personal machines. That's gross negligence.

> Restricting access to corporate environments from trusted machines is trivial using any form of MDM.

Until somebody pulls out their personal cell phone, and takes a photo of a screen containing highly confidential data, to then send it to someone else, because, dang it, they had to get something done NOW and it seemed very convenient.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#135

Post by NoPicklez »

rightbyte wrote: post #80
NoPicklez wrote: post #66

Earlier quoted context omitted.

Right, but for your average user. If your machine is infected with a keylogger that results in a stolen password because of a vulnerability not timely identified and corrected. That's not on you as an employee, that's on the security team for not implementing compensating controls/defence in depth. Yes you have a responsibility to detect phishing emails, not writing down passwords, inserting USB's etc. But if somethi…

> Yes you have a responsibility to [...] not writing down passwords Most places force you to rotate the password so I would not say it is a responsibility to not write it down. I do it. It is like there is a fixed number of passwords per life you can remember or something.

You missed the point of what I said, I was just using examples that are the responsibility of the employee.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#136

Post by eru »

nicky0 wrote: post #123
mschuster91 wrote: post #119

Earlier quoted context omitted.

> An attacker can only hack the paper with physical access to my office. ... and there are lots of unrelated people with physical access to your office. Cleaning staff, building maintenance, HVAC technicians, printer service staff... and all of these may not have the same level of background checks as your company has. And even if you hire all of these yourself (which makes sense at a certain scale), that still doesn…

Nobody said the piece of paper has to be a post-it on your monitor. It could in a folder in a locked cabinet.

Yes. What I had in mind when I wrote my comment, was to stick the piece of paper in your wallet. But your suggestion also works.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#137

Post by execveat »

gavanm wrote: post #68
theamk wrote: post #52

Earlier quoted context omitted.

Are there any reliable ways to secure remote computers from keyloggers _and_ still provide an efficient software development environment for non-trivial projects? All of the software engineers I have seen have a fairly unrestricted environment -- Linux machines, with sudo access, often with passwordless root access via "docker" group, and with non-intrusive "endpoint protection" system. It would be normal to for some…

You've already included the answer - "using their machines as remote terminals, doing most their actual work on some remote server". The developer uses MFA (TOTP, Push Notification, Yubikey etc) into a virtual desktop inside the organisation (Citrix, VMWare Horizon, etc). From there, the developer can SSH / whatever into their development environment - which is hosted "inside" the corporate network, or their cloud pr…

I'm all in for VM based privilege separation, but that won't protect you from infected endpoint. Assuming this was a targeted attack, folks that achieved RCE on DevOp engineer's machine could have waited for her to authenticate and then inject keystrokes into VM, SSH, VNC, Remote Desktop, Citrix or whatever remote management system they're using.

Honestly, this HN thread is full of bad advice and factually incorrect patronizing. Okta-style system asking to accept every single permission would not have protected from an attack, because Okta caches and reuses authentication tokens. Clipboard snooping / keylogger detection wouldn't have worked because none of these solutions are robust against targeted attacks.

The only thing I can think of which would have (and should have) helped is alert SOC / incident reponse team. Good luck finding one though.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#138

Post by CrLf »

eru wrote: post #108
chii wrote: post #91

Earlier quoted context omitted.

> I hope they recover from this, but they need to understand security to produce a security product. it's because the market doesn't actually pay for a secure product, but the appearance of one. The end-user buying cannot really discern whether the company's product is actually secure. There's no third-party standard auditing (let's say, a gov't organization). Banks are run securely, not because I personally audit th…

Banks are a lot less secure than eg Google. And Google has fewer government mandates on them than banks do. (I worked both in banks and at Google.) However you are right that Google thinks they would lose a lot from being less secure.

Sometimes organizations that look less secure are actually more secure just because they degrade gracefully under attack and/or can more easily mitigate/revert the consequences of successful attacks.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#139

Post by execveat »

pid-1 wrote: post #117
theamk wrote: post #52

Earlier quoted context omitted.

Are there any reliable ways to secure remote computers from keyloggers _and_ still provide an efficient software development environment for non-trivial projects? All of the software engineers I have seen have a fairly unrestricted environment -- Linux machines, with sudo access, often with passwordless root access via "docker" group, and with non-intrusive "endpoint protection" system. It would be normal to for some…

My company operates in a Windows centric industry and our software team uses it as well. It turns out you don't need administrative privileges for a lot of dev work (installing and running vs code, python, node, many databases, etc...). My experience is that sudo apt-get install is a Linux Distro thing, most programs don't need special permissions as long they are installed in user scope. So, answering your question,…

Privilege escalation on Windows is super easy though, every red teamer I know has a bunch of ready to use exploits (most of them public) up their sleeve. And it is virtually impossible to get a good baseline of a developer's machine, so I'm pretty sure every SOC out there is simply allowlisting huge swaths of your software.

You can sorta kinda harden these systems, but that would only work against common malware. And you generally can't isolate senior engineers in their own little DMZ, so any RAT on their machines usually leads to catastrophic consequences.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#140

Post by execveat »

BLKNSLVR wrote: post #64
hackernewds wrote: post #34

Earlier quoted context omitted.

As much as LastPass seems to be trying to pin this on a single engineer, and not a broad vuln, the fact that they have such lax policies around access management, especially for a password management system, tells me enough I need to know never to use them again. Waiting for the rebrand and the incoming lawsuits.

Yep. The symptom being that a problem of this scale can be caused by a single engineer, which points to the root cause being deeper and potentially systemic. The question for future trust is: what's been / being done to prevent the same thing from happening again due to another single engineer?

Preventing this thing from happening costs a lot of $$$, so pretty much everyone just "accepts the risk" seeing that probability of something like this happening to your company (during your tenure) is still super low. All companies with somewhat robust security posture I know have had a string of incidents in the past, that seems to be the only thing that can motivate to put $ in security.
Post reply on HN