I think something that should have been in the title is that the breach was facilitated by a vulnerability in an application that many users here might have, Plex. They don’t speak on the nature of the vulnerability in that application. Has it been addressed and fixed through security patches already, or is Plex still potentially dangerous right now?
LastPass says DevOps engineer’s hacked computer led to security breach in 2022
171–180 of 270 posts
Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022
#172There's a weird combination of "what happened" and causation in here:
>> the credentials for the servers were stolen from a DevOps engineer who had access to cloud storage at the company. This made it more difficult for LastPass to detect the suspicious activity.
How does A => B?
>> The threat actor was able to capture the employee’s master password as it was entered, after the employee authenticated with MFA, and gain access to the DevOps engineer’s LastPass corporate vault.
The part about authentication and MFA doesn't track with the rest of the sentence. How does a password without also having the MFA channel work? How would this give me access to a LP vault? Why were they on their home machine?
I understand it must be hard to try and come clean in a RCA without injecting some excuses and mitigating factors but you can't attempt soften the blow or the entire thing is a big, smelly mess. It should be a bunch of facts with no emotion, THEN the mitigation and lessons learned. LP just issued a bunch of press releases.
Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022
#173Only 4 engineers had this level of privilege at lastpass, how did the attacker identify the target? Linkedin... that's why you should not list where you work until you're no longer working there or list a completely different role than what you're currently in. I'm listed as a janitor of where I work. Only those that know me, know what I really do. I've tried to sell the policy forbidding employees from listing their…
Thank you for proposing to cure the lack of competence with the lack of freedom, but the easier source of target identity is the August 2022 breach of LastPass
Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022
#174Earlier quoted context omitted.
> I've tried to sell the policy forbidding employees from listing their positions or where they work on linkedin, each time management frowns and says no. One day they'll come around... Forbidding employees from listing their role on LinkedIn would put them at a major disadvantage in job searching and recruiting. Forcing employees to hide their role is unreasonable. The company doesn’t own the employee.
I disagree, but disclaimer I work at a company that allows you to. If you work at an organisation like LastPass in a privileged position, then you need to be aware that you are an enormous target. And it's not just your own or the companies security you potentially compromise, but millions of others arguably most sensitive information. In Australia, if you have a security defence clearance, you are not allowed to dis…
I would assume you're still allowed to post your to social media in Australia. Security clearance is not a role. I doubt people post they have access to all the infrastructure on their linkedin but you can infer it by the role.
Linkedin doesn't even matter since you can buy the data any way. Email Signatures are mined to get role and contact info for databrokers. Anytime you email outside of the org, the CRM software could be grabbing that info and feeding back to a databroker. Not to mention people using addons to their mail clients. Why I don't use one at my current company even though it is company policy to have one from our HR department. Thats just email. There's also the credit report data that has your role on credit applications and also when you donate money to politicians/PACs that makes you list your role for compliance reasons.
Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022
#175Earlier quoted context omitted.
I don’t think he’s necessarily working on his pc. He probably just had a shared LastPass account between work and his pc.
as a devop a shared account mixing private and business? would be a security breach if you ask me
I'm betting work gives him a free family subscription, ideally you'd have them as separate accounts, not sure how the local vault works under the hood in that situation.
Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022
#176I'm not sure the description is what actually happened. It doesn't have the ring of truth to it. That said, LastPass is not deserving of any trust as a password product of any kind. That a password was captured by a keylogger on a Dev Ops home computer shows that they don't understand how to secure remote computers, the meaning of defense in depth, the importance of proper login authentication, or how to secure data…
Are there any reliable ways to secure remote computers from keyloggers _and_ still provide an efficient software development environment for non-trivial projects? All of the software engineers I have seen have a fairly unrestricted environment -- Linux machines, with sudo access, often with passwordless root access via "docker" group, and with non-intrusive "endpoint protection" system. It would be normal to for some…
Don't do development on any system that has access to production. Develop on dev lane resources.
Production access should only be allowed from a locked down system with no open ports and a very small whitelist set of software. Operations for said system should be simple. Deploy version x with necessary provisioning. Backup system. Restore system. View monitoring and logs.
You must minimize the surface area connected to production.
On the network side the system with the keys for production is also firewalled off from general Internet access. So potential malware can't phone home.
Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022
#177Im not sure that they are just using this as a scapegoat but if your working from home, as a DevOps/Platform engineer, your very first ticket should be to activate MFA. Kubernetes does MFA, all the Clouds do MFA and the company you work for can afford a "cheap android phone as key". No matter if bare-metal, cloud or managed. If you habe ANY edit rights you need MFA.
MFA wouldnt have helped here. The hacker had the encrypted vault all they needed was the password.
which in turn should not be the end of the world, because its MFA all the way down right?
Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022
#178Earlier quoted context omitted.
Seems like a broken 2FA implementation.
2FA can't protect you from malware on your machine.
Sure, but I wouldn't expect the vault to be accessible without 2FA each time it is cached. 2FA should be used as part of the decryption process even if the vault is cached.
Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022
#179Earlier quoted context omitted.
How would you fix this problem with 2fa? I can't imagine how this would work technically. Maybe I am missing something.
You could ask user to present second factor (secure one, Webauthn) for every password they access. That would be a notable obstacle for me as an attacker, but I can't imagine any organization implementing this for real (maybe apart from military/spooks and their contractors). All of the IAM solutions I know of cache their creds and password manager usually is expected to work offline as well, so I don't think you can…
It doesn't need to be every password, just require 2FA to unlock the vault in the first place. Downloading the vault shouldn't strip one factor, but it seems like that is the implementation.
Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022
#180Am I assuming in this case the engineer was using his home PC to work? This isn't unheard of in the industry, Engineers using BYOD devices or similar to work from home. But with a company with a risk profile as high as LastPass this seems _incredibly dumb_. You would assume anyone with the keys to the kingdom was working on a company provided device, or any device that fits a compliance framework based on their own r…
i completly agree. Its not so hard to do MFA all the way down either