Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass says DevOps engineer’s hacked computer led to security breach in 2022

9to5mac.com

Post reply on HN
Print view View original

151–160 of 270 posts

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#151

Post by trollied »

Johnny555 wrote: post #20
LilBytes wrote: post #2

Am I assuming in this case the engineer was using his home PC to work? This isn't unheard of in the industry, Engineers using BYOD devices or similar to work from home. But with a company with a risk profile as high as LastPass this seems _incredibly dumb_. You would assume anyone with the keys to the kingdom was working on a company provided device, or any device that fits a compliance framework based on their own r…

My company isn't nearly as high profile or security focused and we're not allowed to use our own computers for any work related purposes,and our work laptops run threat detection software and we have a whitelist of software we're allowed to install. I'm surprised that LastPass's policies aren't at least that strict. My company has what I think is a big hole in this policy in that we're allowed to use our own phone fo…

My company fixed that by only allowing SSO login on company devices. Everything else is SSO. Systems that weren’t SSO-enabled were replaced.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#152

Post by execveat »

oxfordmale wrote: post #111
jstummbillig wrote: post #107

Earlier quoted context omitted.

> That a password was captured by a keylogger on a Dev Ops home computer shows that they don't understand how to secure remote computers I tend to disagree. The potential for any single employee to do substantial harm to any business is incredible and designing a system to make that not possible is nigh impossible. It's neither the humans nor the institutions fault. It's just that systems involving humans are incredi…

If a password was captured by a key logger, rather than a session token being stolen, they didn't implement 2FA for this login. They are also talking about a home computer. In my company, VPN access is limited to trusted devices; therefore, sensitive systems can only be accessed from a corporate machine. Security at LastPass seems substandard for a company storing security credentials. Unfortunately, from my experien…

There isn't enough information to tell. With keylogger you can steal password every time it's used, MFA will just prevent / limit it's use. So it doesn't tell us anything about their MFA implementation and whether attackers reused session or did some other trick (e.g. time based tokens by design can be used to multiple times within the given time period or you could hijack first MFA token while it's being sent to the server and present an error; now you can use this token yourself while user successfully logs in with the second token).

Once you get password vault, it's very likely that you also get creds necessary to set up VPN. Besides, there are ways to bypass (poorly implemented) VPN and relying on VPNs isn't even the best practice nowadays.

I agree with you that a few CISOs getting sentences would be the fastest way to raise the bar across the tech sector, but that's never going to happen.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#153

Post by execveat »

konha wrote: post #146
forty wrote: post #113

Earlier quoted context omitted.

I work for a LastPass competitor. As far as I know, no popular password manager seriously includes "fully compromised local device" in their threat model. I don't think it can be done without hurting seriously usability (like having one 2fa verification each time you use a credential would work) and the predictable outcome of hurting usability too much is that people will find more handy insecure ways to store their…

> I don't think it can be done without hurting seriously usability (like having one 2fa verification each time you use a credential would work) I wouldn’t mind tapping a YubiKey or my MacBook‘s Touch ID every time a password is accessed from the vault. That’s essentially how ssh keys work with smartcards or security keys as a second factor.

Usually non-technical management are the ones that are against this kind of measures. This recent Passkeys initiative (that's what allows using secure enclave as a Webauthn key) is amazing though, I really hope it changes the game and maybe finally obsoletes passwords as a whole.

Also, as an aside. While correctly implemented Passkeys (without fallback auth methods) would make my life as a red teamer much harder, that would have only prevented this attack if the infected machine was engineer's private PC where they used corporate LastPass account and nothing else from their work. If the machine that's used for DevOps work gets infected, that's still and endgame because you're generating all sessions I need during your regular workday, so I don't really need the passwords / decrypted vault.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#154

Post by worksonmine »

theamk wrote: post #52
IncRnd wrote: post #5

I'm not sure the description is what actually happened. It doesn't have the ring of truth to it. That said, LastPass is not deserving of any trust as a password product of any kind. That a password was captured by a keylogger on a Dev Ops home computer shows that they don't understand how to secure remote computers, the meaning of defense in depth, the importance of proper login authentication, or how to secure data…

Are there any reliable ways to secure remote computers from keyloggers _and_ still provide an efficient software development environment for non-trivial projects? All of the software engineers I have seen have a fairly unrestricted environment -- Linux machines, with sudo access, often with passwordless root access via "docker" group, and with non-intrusive "endpoint protection" system. It would be normal to for some…

Anyone with this level of access should know not to run random github projects or npm install in the most sensitive context. The choice is between easy or secure. You can't have both and that's a reality one has to accept. It's not that difficult to spin up a VM when you want to fuck around and isolate it from sensitive data.

Especially as a "DevOps engineer", gatekeeping and providing least privilege access is in the job description. I understand getting lazy and relaxing the rules in some contexts but not when running a password manager on this scale, unacceptable.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#155

Post by avianlyric »

dogma1138 wrote: post #106
chii wrote: post #91

Earlier quoted context omitted.

> I hope they recover from this, but they need to understand security to produce a security product. it's because the market doesn't actually pay for a secure product, but the appearance of one. The end-user buying cannot really discern whether the company's product is actually secure. There's no third-party standard auditing (let's say, a gov't organization). Banks are run securely, not because I personally audit th…

Eh banks run securely because it’s very difficult to steal money. Hard currency theft requires a physical attack and “digital currency” is just essentially a spreadsheet that requires a settlement mechanism such as correspondent banking to work. Banks transfers are nothing more than messages going between different branches and banks there is nothing being transferred other than orders. The attack surface on modern b…

All this might be true in the US where realtime transfers don’t really exist.

But here in true UK where we‘be had realtime, high volume transfers for at least a decade, it’s very possible to steal digital money and move it on before the bank notices.

Faster Payments in the UK are expected to be credited and spendable within 20min, normally it’s spendable within milliseconds. The actual settlements happen every few hours, and all of it is pretty much automated. Additionally because the money can be credited so fast, there is no recourse for a bank to recover a payment they’ve authorised, they have to settle it. The sending to the transfer message is as good as sending the money, once it’s sent, they have to pay, if they refuse, the money is taken from their collateral at the payment network to pay their debt, and they’re disconnected from the payment network.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#156

Post by usrusr »

chii wrote: post #91
IncRnd wrote: post #5

I'm not sure the description is what actually happened. It doesn't have the ring of truth to it. That said, LastPass is not deserving of any trust as a password product of any kind. That a password was captured by a keylogger on a Dev Ops home computer shows that they don't understand how to secure remote computers, the meaning of defense in depth, the importance of proper login authentication, or how to secure data…

> I hope they recover from this, but they need to understand security to produce a security product. it's because the market doesn't actually pay for a secure product, but the appearance of one. The end-user buying cannot really discern whether the company's product is actually secure. There's no third-party standard auditing (let's say, a gov't organization). Banks are run securely, not because I personally audit th…

Unfortunately losses from insecure banks are considerably easier to quantify than losses from insecure secrets storage.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#158

Post by j16sdiz »

chii wrote: post #141
dogma1138 wrote: post #106

Earlier quoted context omitted.

Eh banks run securely because it’s very difficult to steal money. Hard currency theft requires a physical attack and “digital currency” is just essentially a spreadsheet that requires a settlement mechanism such as correspondent banking to work. Banks transfers are nothing more than messages going between different branches and banks there is nothing being transferred other than orders. The attack surface on modern b…

> Eh banks run securely because it’s very difficult to steal money. i think you got the cause and effect wrong - banks are run securely because it's made to be very difficult to steal money. And stolen money gets tracked (if you did steal a large amount) by anti-money laundering laws, which makes it hard to spend it. Why is banks' attack surface small? Why is all these other "systems" in place to make stealing money…

I think you got them wrong.

Bank customer data breach is not that rare.

Money in bank is "secure" because they are cross checked with counterparties. Their data leaks like everybody else.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#159

Post by ta1243 »

chii wrote: post #141
dogma1138 wrote: post #106

Earlier quoted context omitted.

Eh banks run securely because it’s very difficult to steal money. Hard currency theft requires a physical attack and “digital currency” is just essentially a spreadsheet that requires a settlement mechanism such as correspondent banking to work. Banks transfers are nothing more than messages going between different branches and banks there is nothing being transferred other than orders. The attack surface on modern b…

> Eh banks run securely because it’s very difficult to steal money. i think you got the cause and effect wrong - banks are run securely because it's made to be very difficult to steal money. And stolen money gets tracked (if you did steal a large amount) by anti-money laundering laws, which makes it hard to spend it. Why is banks' attack surface small? Why is all these other "systems" in place to make stealing money…

It's telling that in areas banks don't have responsibility (criminals breaking into individual accounts and draining them for example) they are insecure. SMS 2FA, short pin numbers, etc.

https://www.bbc.com/news/business-64240140.amp

> He said Barclays told him it would do an internal fraud investigation which later resulted in Mr de Simone being held liable for all the losses.

> "They could not identify a point of compromise from the back end - to them it looked like the pin had been entered.

> "The only thing they could suggest was that someone knew the code therefore it's gross negligence on my part apparently.

In the olden days banks used to have decent security. Once you gain access to the account, to pay a new payee you'd need your bank card and pin number to do the 2FA. Now it's all the same phone.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#160

Post by drowsspa »

eru wrote: post #108
chii wrote: post #91

Earlier quoted context omitted.

> I hope they recover from this, but they need to understand security to produce a security product. it's because the market doesn't actually pay for a secure product, but the appearance of one. The end-user buying cannot really discern whether the company's product is actually secure. There's no third-party standard auditing (let's say, a gov't organization). Banks are run securely, not because I personally audit th…

Banks are a lot less secure than eg Google. And Google has fewer government mandates on them than banks do. (I worked both in banks and at Google.) However you are right that Google thinks they would lose a lot from being less secure.

Banks' true security is rooted in the real world.
Post reply on HN