Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass says DevOps engineer’s hacked computer led to security breach in 2022

9to5mac.com

Post reply on HN
Print view View original

161–170 of 270 posts

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#161

Post by davewritescode »

schainks wrote: post #60
deathanatos wrote: post #19

Earlier quoted context omitted.

Yeah, because the description is inadequate. Is this BYOD? (… seems like not the employee's fault.) Is this the employee used the same password on the laptop and home, got credential stuffed, and LastPass isn't using MFA¹? (…seems like not the employee's fault.) Was there some jump from compromised home laptop to corp laptop? (The network is never to be trusted. …seems like not the employee's fault.) The buck is supp…

> The buck is supposed to stop at security, not at each employee's personal hygiene … if your game plan depends on the latter, it's game over. I have to take security trainings twice a year that literally talk about the buck stopping at my digital hygiene and I better not fuck it up for The Company. Companies have to understand breaches will happen, but preparing employees on how to spot attacks or understand when th…

Security is basically layering imperfect solutions on top of each other until the statistical probability of breaching ALL of them gets small enough to satisfy the requirements of the organization.

In the case of LastPass, they're holding data (which they shouldn't have been to be fair) that's INCREDIBLY attractive to everyone from script kiddies to nation state actors. When it comes to keeping out nation states the threat model can get kind of wild and difficult to engineer for while building what's ultimately a consumer facing product. However, in this particular case it's fairly obvious that bad IT policies lead to an issue and LastPass got burned.

I would be more forging of LastPass but letting employees do BYOD means you have to trust everyone that ever uses that computer including spouses and children. It's just really dumb.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#162

Post by ethbr0 »

dogma1138 wrote: post #106
chii wrote: post #91

Earlier quoted context omitted.

> I hope they recover from this, but they need to understand security to produce a security product. it's because the market doesn't actually pay for a secure product, but the appearance of one. The end-user buying cannot really discern whether the company's product is actually secure. There's no third-party standard auditing (let's say, a gov't organization). Banks are run securely, not because I personally audit th…

Eh banks run securely because it’s very difficult to steal money. Hard currency theft requires a physical attack and “digital currency” is just essentially a spreadsheet that requires a settlement mechanism such as correspondent banking to work. Banks transfers are nothing more than messages going between different branches and banks there is nothing being transferred other than orders. The attack surface on modern b…

> Eh banks run securely because it’s very difficult to steal money.

Banks run securely because they have serious and mandated change control processes, applied against a formal classification of the importance of systems.

Something you generally won't see outside the T100 of non-bank companies.

This means their IT evolves glacially slow, but it does keep things stable.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#163

Post by pid-1 »

jstummbillig wrote: post #134
pid-1 wrote: post #115

Earlier quoted context omitted.

Restricting access to corporate environments from trusted machines is trivial using any form of MDM. No one should be working from their personal machines. That's gross negligence.

> Restricting access to corporate environments from trusted machines is trivial using any form of MDM. Until somebody pulls out their personal cell phone, and takes a photo of a screen containing highly confidential data, to then send it to someone else, because, dang it, they had to get something done NOW and it seemed very convenient.

No security measure is 100% effective nor 100% moron proof, but in many companies that would be a fireable offense, which gets you pretty far.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#164

Post by Cthulhu_ »

IncRnd wrote: post #5

I'm not sure the description is what actually happened. It doesn't have the ring of truth to it. That said, LastPass is not deserving of any trust as a password product of any kind. That a password was captured by a keylogger on a Dev Ops home computer shows that they don't understand how to secure remote computers, the meaning of defense in depth, the importance of proper login authentication, or how to secure data…

To me it says their security is not up to par, and that employees were allowed to take secrets home. Which is fine to a point, but it has to be a company managed, remote-wipable and locked down system if it's people that hold the literal keys to the secure castle.

Same with the Canadian ban on Tik Tok, why are they even allowed to have phones where they can install any software on?

BYOD and personalization is fine to a point, but only if you don't have high level access.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#165

Post by nazka »

chii wrote: post #91
IncRnd wrote: post #5

I'm not sure the description is what actually happened. It doesn't have the ring of truth to it. That said, LastPass is not deserving of any trust as a password product of any kind. That a password was captured by a keylogger on a Dev Ops home computer shows that they don't understand how to secure remote computers, the meaning of defense in depth, the importance of proper login authentication, or how to secure data…

> I hope they recover from this, but they need to understand security to produce a security product. it's because the market doesn't actually pay for a secure product, but the appearance of one. The end-user buying cannot really discern whether the company's product is actually secure. There's no third-party standard auditing (let's say, a gov't organization). Banks are run securely, not because I personally audit th…

Also for convenience over security. Like how Signal was the best secure option out there but people went to Telegram instead because even if it was (slightly?) less secured it’s a lot more convenient.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#166

Post by [deleted] »

pid-1 wrote: post #163
jstummbillig wrote: post #134

Earlier quoted context omitted.

> Restricting access to corporate environments from trusted machines is trivial using any form of MDM. Until somebody pulls out their personal cell phone, and takes a photo of a screen containing highly confidential data, to then send it to someone else, because, dang it, they had to get something done NOW and it seemed very convenient.

No security measure is 100% effective nor 100% moron proof, but in many companies that would be a fireable offense, which gets you pretty far.

[deleted]

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#167

Post by crabbone »

gavanm wrote: post #68
theamk wrote: post #52

Earlier quoted context omitted.

Are there any reliable ways to secure remote computers from keyloggers _and_ still provide an efficient software development environment for non-trivial projects? All of the software engineers I have seen have a fairly unrestricted environment -- Linux machines, with sudo access, often with passwordless root access via "docker" group, and with non-intrusive "endpoint protection" system. It would be normal to for some…

You've already included the answer - "using their machines as remote terminals, doing most their actual work on some remote server". The developer uses MFA (TOTP, Push Notification, Yubikey etc) into a virtual desktop inside the organisation (Citrix, VMWare Horizon, etc). From there, the developer can SSH / whatever into their development environment - which is hosted "inside" the corporate network, or their cloud pr…

This is both a misunderstanding of the problem and an attempt to solve an administrative problem using technology... which cannot really solve it.

Developers have nothing to do with this. It's a common practice in companies that have "expensive" production environment (eg. VMs rented from AWS) that developers never get any kind of access to production environment. Ever. At all. No need to tie developers' hand by putting them behind a ton of unnecessary firewalls. They have no need for the sensitive information and shouldn't be burdened by protecting it.

The few people who do have access to company's "expensive" production environment are / should be very few people, most likely in the infra / DevOps department. These people do need to follow special protocol for communicating with the "expensive" environment, which, likely, doesn't happen all that often. Depends on the product, of course, but unlikely to be more than once a day, or even once a week.

----

PS. In many, many years of being in infra / system / automation I had never typed any passwords for any important services I had to use. They are usually difficult to type due to having all kinds of Unicode characters I wouldn't know how to reproduce w/o a little research. It's also very rare that they end up in system clipboard, since I usually end up using something like vi+tmux over SSH in Emacs' ascii-term to copy the password from somewhere and paste it somewhere else. So, stuff like AWS keys would have to be stolen by taking screenshots of my screen or something like that...

I mean, why on Earth would anyone deploy to production environment from their personal laptop? Normally, deployment is made from some sort of a testing / staging environment where the system was being tested / archived before shipping it to the next stop... It sounds like some kind of emergency / unplanned situation where a DevOps had to log into the remote system from their laptop.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#168

Post by lrvick »

In my experience the majority of hacks are from a compromised laptop of a production engineer. Everyone blindly NPM installs away all their problems and no one checks signatures anymore. Most are using package managers like Brew that don't sign anything to begin with.

At Distrust, my security consulting firm, we train all our clients to build production systems that require a minimum of two engineers to mutate and that only pristine operating systems access production that have only signed reproducible used packages that have never been used for anything else.

Production environments need to be managed like careful methodical clean-room labs with strict accountability. Instead they are managed like collaborative art projects where everyone is trusted and nothing bad can happen.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#169

Post by oxfordmale »

execveat wrote: post #152
oxfordmale wrote: post #111

Earlier quoted context omitted.

If a password was captured by a key logger, rather than a session token being stolen, they didn't implement 2FA for this login. They are also talking about a home computer. In my company, VPN access is limited to trusted devices; therefore, sensitive systems can only be accessed from a corporate machine. Security at LastPass seems substandard for a company storing security credentials. Unfortunately, from my experien…

There isn't enough information to tell. With keylogger you can steal password every time it's used, MFA will just prevent / limit it's use. So it doesn't tell us anything about their MFA implementation and whether attackers reused session or did some other trick (e.g. time based tokens by design can be used to multiple times within the given time period or you could hijack first MFA token while it's being sent to the…

A secure MFA implication requires a second device to authorise the login. As you correctly point out, generating a code then and entering it on a compromised machine is SFA, as it treats the token as a second password. If MFA is implemented correctly, the only attack vector should be the session token.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#170

Post by ChrisRR »

chii wrote: post #91
IncRnd wrote: post #5

I'm not sure the description is what actually happened. It doesn't have the ring of truth to it. That said, LastPass is not deserving of any trust as a password product of any kind. That a password was captured by a keylogger on a Dev Ops home computer shows that they don't understand how to secure remote computers, the meaning of defense in depth, the importance of proper login authentication, or how to secure data…

> I hope they recover from this, but they need to understand security to produce a security product. it's because the market doesn't actually pay for a secure product, but the appearance of one. The end-user buying cannot really discern whether the company's product is actually secure. There's no third-party standard auditing (let's say, a gov't organization). Banks are run securely, not because I personally audit th…

There's no such thing as a secure product, but secure enough. And lastpass storing billions of password is a very high value target. They probably have hackers banging on their firewalls all day, every day
Post reply on HN