Earlier quoted context omitted.
Seems like a broken 2FA implementation.
2FA can't protect you from malware on your machine.
why wouldn't it?
And its not so much about protecting me, but to protect company interest right?
LastPass says DevOps engineer’s hacked computer led to security breach in 2022
181–190 of 270 posts
Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022
#182I really wonder how many companies have figured out how to properly secure equipment and access used by a distributed work force.
Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022
#183Earlier quoted context omitted.
Yeah, because the description is inadequate. Is this BYOD? (… seems like not the employee's fault.) Is this the employee used the same password on the laptop and home, got credential stuffed, and LastPass isn't using MFA¹? (…seems like not the employee's fault.) Was there some jump from compromised home laptop to corp laptop? (The network is never to be trusted. …seems like not the employee's fault.) The buck is supp…
I expect the amount of companies that would get fucking owned by simply managing to execute cat ~/.aws/* | On a devops/senior dev machine is colossal.
What I want is a secure shell (somehow) where my env variables are encrypted and on access I get a prompt to either use a fingerprint reader or a password to unlock them for the process.
Anyone know of any such option? What I've come to use are separate env files that I source in various directories before running the commands that need crednetials, or a tool that decrypts a file, loads it into an subprocesses env vars and runs a program (something like mozilla/sops), but I still find that too cumbersome, I'd like it transparent and integrated with my shell.
Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022
#184There's a weird combination of "what happened" and causation in here: >> the credentials for the servers were stolen from a DevOps engineer who had access to cloud storage at the company. This made it more difficult for LastPass to detect the suspicious activity. How does A => B? >> The threat actor was able to capture the employee’s master password as it was entered, after the employee authenticated with MFA, and ga…
[deleted]
Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022
#185Earlier quoted context omitted.
Seems like a broken 2FA implementation.
How would you fix this problem with 2fa? I can't imagine how this would work technically. Maybe I am missing something.
Require the second factor for decrypting the vault. It seems the second factor is "removed" as soon as you cache the vault on your machine.
Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022
#186Earlier quoted context omitted.
> Eh banks run securely because it’s very difficult to steal money. i think you got the cause and effect wrong - banks are run securely because it's made to be very difficult to steal money. And stolen money gets tracked (if you did steal a large amount) by anti-money laundering laws, which makes it hard to spend it. Why is banks' attack surface small? Why is all these other "systems" in place to make stealing money…
I think you got them wrong. Bank customer data breach is not that rare. Money in bank is "secure" because they are cross checked with counterparties. Their data leaks like everybody else.
This. At the end of the day, if it is a significant transfer there are people in locked rooms that have to call each other and independently verify a transaction brokered by a third party. And if you don't pass a background check, and don't need to be there, you don't get in that room.
Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022
#187Only 4 engineers had this level of privilege at lastpass, how did the attacker identify the target? Linkedin... that's why you should not list where you work until you're no longer working there or list a completely different role than what you're currently in. I'm listed as a janitor of where I work. Only those that know me, know what I really do. I've tried to sell the policy forbidding employees from listing their…
[deleted]
Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022
#188I'm not sure the description is what actually happened. It doesn't have the ring of truth to it. That said, LastPass is not deserving of any trust as a password product of any kind. That a password was captured by a keylogger on a Dev Ops home computer shows that they don't understand how to secure remote computers, the meaning of defense in depth, the importance of proper login authentication, or how to secure data…
Yeah, because the description is inadequate. Is this BYOD? (… seems like not the employee's fault.) Is this the employee used the same password on the laptop and home, got credential stuffed, and LastPass isn't using MFA¹? (…seems like not the employee's fault.) Was there some jump from compromised home laptop to corp laptop? (The network is never to be trusted. …seems like not the employee's fault.) The buck is supp…
We are looking at a highly sensitive asset, though. A vault that is only used by four employees (per the original press release, not in the 9to5mac article) and contains keys for the production backups.
At this level of sensitivity you need to consider "should the employee's personal plex server be able to connect to this" and the answer might be a No. At this point you should be issuing them a PAW and a physical security key and auditing the shit out of it. It's not like lastpass can't afford it.
Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022
#189Earlier quoted context omitted.
> I hope they recover from this, but they need to understand security to produce a security product. it's because the market doesn't actually pay for a secure product, but the appearance of one. The end-user buying cannot really discern whether the company's product is actually secure. There's no third-party standard auditing (let's say, a gov't organization). Banks are run securely, not because I personally audit th…
Also for convenience over security. Like how Signal was the best secure option out there but people went to Telegram instead because even if it was (slightly?) less secured it’s a lot more convenient.
Telegram isn't end-to-end encrypted by default.
Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022
#190Earlier quoted context omitted.
> Eh banks run securely because it’s very difficult to steal money. i think you got the cause and effect wrong - banks are run securely because it's made to be very difficult to steal money. And stolen money gets tracked (if you did steal a large amount) by anti-money laundering laws, which makes it hard to spend it. Why is banks' attack surface small? Why is all these other "systems" in place to make stealing money…
It's telling that in areas banks don't have responsibility (criminals breaking into individual accounts and draining them for example) they are insecure. SMS 2FA, short pin numbers, etc. https://www.bbc.com/news/business-64240140.amp > He said Barclays told him it would do an internal fraud investigation which later resulted in Mr de Simone being held liable for all the losses. > "They could not identify a point of c…
The case isnt settled yet.
> After eight months of evidence gathering and dealing with the police, an investigator at the Financial Ombudsman Service (FOS) upheld Mr de Simone's complaint against Barclays which now, if it disagrees with this, has the opportunity to ask the ombudsman to examine the case.
They are just trying to wear him down.