Live data from Hacker News

LastPass says DevOps engineer’s hacked computer led to security breach in 2022

9to5mac.com

141–150 of 270 posts

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#141
post #91

Earlier quoted context omitted.

> I hope they recover from this, but they need to understand security to produce a security product. it's because the market doesn't actually pay for a secure product, but the appearance of one. The end-user buying cannot really discern whether the company's product is actually secure. There's no third-party standard auditing (let's say, a gov't organization). Banks are run securely, not because I personally audit th…

Eh banks run securely because it’s very difficult to steal money. Hard currency theft requires a physical attack and “digital currency” is just essentially a spreadsheet that requires a settlement mechanism such as correspondent banking to work. Banks transfers are nothing more than messages going between different branches and banks there is nothing being transferred other than orders. The attack surface on modern b…

> Eh banks run securely because it’s very difficult to steal money.

i think you got the cause and effect wrong - banks are run securely because it's made to be very difficult to steal money. And stolen money gets tracked (if you did steal a large amount) by anti-money laundering laws, which makes it hard to spend it.

Why is banks' attack surface small? Why is all these other "systems" in place to make stealing money difficult?

Why isn't the same happening with stolen credentials, or data?

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#142

Earlier quoted context omitted.

> First of all: If you have the title of "DevOps" what you're doing is "Operations", you aren't practicing DevOps. So what title do you need to have to practice DevOps?

"DevOps enables coordination and collaboration between formerly siloed roles like development, IT operations, quality engineering, and security." - https://learn.microsoft.com/en-us/devops/what-is-devops It's not a job title, it's an engineering practice. People who participate in DevOps include "software engineer", "network engineer", "IT operations engineer", "platform engineer", "cloud engineer", "quality engineer…

I do not like the title either, but I do understand the motivation of taking all those "non-software engineering", technical roles and putting them under the same umbrella, due to a lack for a better title, because a company might not afford to have separate roles for each of those areas you have listed above.

"OPERATIONS ENGINEER" might work, but it raises another set of problems, e.g. does it imply operational responsibility (on-duty) work, which I don't think is a given in DevOps jobs nowadays.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#143
post #78

Earlier quoted context omitted.

Seems like a broken 2FA implementation.

How would you fix this problem with 2fa? I can't imagine how this would work technically. Maybe I am missing something.

You could ask user to present second factor (secure one, Webauthn) for every password they access. That would be a notable obstacle for me as an attacker, but I can't imagine any organization implementing this for real (maybe apart from military/spooks and their contractors). All of the IAM solutions I know of cache their creds and password manager usually is expected to work offline as well, so I don't think you can avoid having recoverable (in the CS meaning of the word) database locally.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#144
post #93

Earlier quoted context omitted.

While it's very civil of you to wish recovery upon LastPass, I don't really think the product is deserving of redemption. This is not the first major incident and it demonstrates little growth in relation to prior breaches. The world as a whole would probably be better off if LastPass were to breathe its last.

They need to sell it to someone else with a better track record.

I agree with the GP. Why would selling it solve the issues with the product?

How much of the product can be salvaged?

They have a well-known brandname, but it is arguably radioactive now.

The product as software can be rebranded, but why go through this effort if the ubderlying software has proven faulty so many times in the past?

A similar effort can be invested in making open-source password managers better, so there is a clear opportunity cost to salvaging LastPass.

Plus a sale would surely only directly benefit those most responsible for LastPass' issues. It would mean they are directly rewarded for their incompetent execution..

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#145
post #78

Earlier quoted context omitted.

Seems like a broken 2FA implementation.

How would you fix this problem with 2fa? I can't imagine how this would work technically. Maybe I am missing something.

If you have the master password and the encrypted vault then you are in. The 2FA portion is for access to the encrypted vault.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#146
post #113
post #10

So, with most password managers, when you authenticate on a new device, you are prompted for MFA. The user had a keylogger installed on their machine, so the attacker could collect the master password, but how did they login to the vault on a new machine without MFA? Did they get the MFA seed and login on a different machine, and nobody received a "You're using LastPass on a new machine, if this wasn't you..." messag…

I work for a LastPass competitor. As far as I know, no popular password manager seriously includes "fully compromised local device" in their threat model. I don't think it can be done without hurting seriously usability (like having one 2fa verification each time you use a credential would work) and the predictable outcome of hurting usability too much is that people will find more handy insecure ways to store their…

> I don't think it can be done without hurting seriously usability (like having one 2fa verification each time you use a credential would work)

I wouldn’t mind tapping a YubiKey or my MacBook‘s Touch ID every time a password is accessed from the vault. That’s essentially how ssh keys work with smartcards or security keys as a second factor.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#147
post #3

> “More specifically, the credentials for the servers were stolen from a DevOps engineer who had access to cloud storage at the company. This made it more difficult for LastPass to detect the suspicious activity.” This comes off as spin to me by LastPass or LogMeIn’s PR department. Even if this was the case, how is it possible for intrusion detection systems to not observe and report abnormally high egress traffic? D…

Intrusion detection systems are utter shit and usually undergo even less real-world testing than recovery from a cold backup. Although we don't know LastPass'es architecture, it's also highly likely that with engineer's creds it was possible to exfiltrate database without any registered egress traffic at all.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#148

If lastpass was well designed, the company would store no private user data. Ie. they would be a 'dumb' storage system for the customers encrypted data. The data would be encrypted by the customer before upload. And then decrypted again by the customer after download. Users would be identified by a unique random ID, and users would auth by signing a challenge with a secret key known only to the customer. That way, ev…

What part of this is not happening right now with lastpass?

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#149

Im not sure that they are just using this as a scapegoat but if your working from home, as a DevOps/Platform engineer, your very first ticket should be to activate MFA. Kubernetes does MFA, all the Clouds do MFA and the company you work for can afford a "cheap android phone as key". No matter if bare-metal, cloud or managed. If you habe ANY edit rights you need MFA.

MFA wouldnt have helped here. The hacker had the encrypted vault all they needed was the password.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#150
post #123

Earlier quoted context omitted.

> An attacker can only hack the paper with physical access to my office. ... and there are lots of unrelated people with physical access to your office. Cleaning staff, building maintenance, HVAC technicians, printer service staff... and all of these may not have the same level of background checks as your company has. And even if you hire all of these yourself (which makes sense at a certain scale), that still doesn…

Nobody said the piece of paper has to be a post-it on your monitor. It could in a folder in a locked cabinet.

Just write it in your class syllabus; no one will ever find it there.
Post reply on HN