Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass says DevOps engineer’s hacked computer led to security breach in 2022

9to5mac.com

Post reply on HN
Print view View original

201–210 of 270 posts

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#201

Post by secabeen »

j-bos wrote: post #157

Am I understanding correctly: A single engineer had both access to the prod database AND the data decryption values?

Depends on what you mean by "the data decryption values". If you mean the encryption keys for the vaults themselves, no. Those are derived from the individual master passwords (in non-SSO setups, with SSO it's more complicated, and I don't fully understand the impact). So the attackers have a bunch of encrypted vaults from a backup. They can now brute-force the vaults, but if the original Master Passwords were secure (16+ characters, all 4 classes), those vaults should remain secure. Of course, many people use bad passwords, and those people are at risk.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#202

Post by q1w2 »

lrvick wrote: post #168

In my experience the majority of hacks are from a compromised laptop of a production engineer. Everyone blindly NPM installs away all their problems and no one checks signatures anymore. Most are using package managers like Brew that don't sign anything to begin with. At Distrust, my security consulting firm, we train all our clients to build production systems that require a minimum of two engineers to mutate and th…

In this case, the anonymous source says that Plex server was compromised, so I assume it was a developer's home PC, not a work laptop.

The breach was preceded a couple of days by Plex corporate breach which devulged the engineer's credentials and home IP address.

This would have allowed the attackers to access Plex sever remotely, after which the source claims they used an RCE to install a keylogger (and probably a back door) on the engineer's PC.

The concerning part is that according to Plex devs (in their reddit sub), they have NO KNOWLEDGE of any RCE. They also haven't communicated with Lastpass, and no one reached out to them.

So if there's a Plex remote code exploit - it is still unpatched and actively being exploited - 8 months later!

Given that there is still no information on this Plex RCE, we should not assume that it requires authentication to function. So if you're using Plex, make sure to turn off public accessibility asap!

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#203

Post by bobleeswagger »

secabeen wrote: post #198
bobleeswagger wrote: post #185

Earlier quoted context omitted.

Require the second factor for decrypting the vault. It seems the second factor is "removed" as soon as you cache the vault on your machine.

Okay, but the attacker has RCE on the system doing the decryption, so they can scrape the encryption keys or the vault data out of memory. This appears to be a APT, probably a State-level actor. Once the production work machine was compromised, it's all over.

I get what you're saying, but the implementation of 2FA is still broken. If we don't fix that, we can't fix what comes next either.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#204

Post by q1w2 »

skarz wrote: post #171

I think something that should have been in the title is that the breach was facilitated by a vulnerability in an application that many users here might have, Plex. They don’t speak on the nature of the vulnerability in that application. Has it been addressed and fixed through security patches already, or is Plex still potentially dangerous right now?

Plex devs commented in Reddit that this is the first they've heard of it and haven't identified any RCE, let alone patched anything.

So if you're running a Plex server, you should disable public access immediately.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#205

Post by secabeen »

bobleeswagger wrote: post #203
secabeen wrote: post #198

Earlier quoted context omitted.

Okay, but the attacker has RCE on the system doing the decryption, so they can scrape the encryption keys or the vault data out of memory. This appears to be a APT, probably a State-level actor. Once the production work machine was compromised, it's all over.

I get what you're saying, but the implementation of 2FA is still broken. If we don't fix that, we can't fix what comes next either.

I'm not aware of any 2FA that could be successfully integrated into a symmetric-key encryption algorithm. How do we fix 2FA without making the entire password vault system dependent on network access to a central LP server that is not compromised?

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#206

Post by secabeen »

jhoelzel wrote: post #181
Thorrez wrote: post #77

Earlier quoted context omitted.

2FA can't protect you from malware on your machine.

why wouldn't it? And its not so much about protecting me, but to protect company interest right?

Read the technical details of TOTP, at root, you and the other end are performing similar mathematical operations on a shared secret such that knowledge of a single result gives you no information about later results. The actual check is just a string compare; the result is not included in the vault decryption operations in any way. Thus, if you have root, you can just alter the Check2FA() function to return true. I'm not aware of any encryption algorithm that can include rotating 2FA data in the actual decryption process.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#207

Post by Fabricio20 »

bobleeswagger wrote: post #179
execveat wrote: post #143

Earlier quoted context omitted.

You could ask user to present second factor (secure one, Webauthn) for every password they access. That would be a notable obstacle for me as an attacker, but I can't imagine any organization implementing this for real (maybe apart from military/spooks and their contractors). All of the IAM solutions I know of cache their creds and password manager usually is expected to work offline as well, so I don't think you can…

It doesn't need to be every password, just require 2FA to unlock the vault in the first place. Downloading the vault shouldn't strip one factor, but it seems like that is the implementation.

I'm not aware of any encryption algos that can encrypt data using a rotating key such as a TOTP code. The vault file is encrypted using the master password, if you encrypted it with the TOTP code you wouldn't be able to decrypt it 30s later, and if you have logic to parse the 2FA I can just replace your logic with return true;

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#208

Post by bobleeswagger »

Fabricio20 wrote: post #207
bobleeswagger wrote: post #179

Earlier quoted context omitted.

It doesn't need to be every password, just require 2FA to unlock the vault in the first place. Downloading the vault shouldn't strip one factor, but it seems like that is the implementation.

I'm not aware of any encryption algos that can encrypt data using a rotating key such as a TOTP code. The vault file is encrypted using the master password, if you encrypted it with the TOTP code you wouldn't be able to decrypt it 30s later, and if you have logic to parse the 2FA I can just replace your logic with return true;

Wouldn't this be an implementation detail of the password manager? Either way, I hear you that this is asking for new functionality. Still, I don't think most people think that a factor disappears depending on the caching policy of the vault on your machine. It's quite a footgun.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#209

Post by Fabricio20 »

jhoelzel wrote: post #177
thisgoesnowhere wrote: post #149

Earlier quoted context omitted.

MFA wouldnt have helped here. The hacker had the encrypted vault all they needed was the password.

which in turn should not be the end of the world, because its MFA all the way down right?

If you have an encrypted vault file and the master password (or decryption key) you don't need 2FA, there is no known encryption algo that uses a rotating key like TOTP, the implementation of 2FA is always software-sided, and in the case of a vault file (like here), you don't need the software.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#210

Post by Johnny555 »

execveat wrote: post #140
BLKNSLVR wrote: post #64

Earlier quoted context omitted.

Yep. The symptom being that a problem of this scale can be caused by a single engineer, which points to the root cause being deeper and potentially systemic. The question for future trust is: what's been / being done to prevent the same thing from happening again due to another single engineer?

Preventing this thing from happening costs a lot of $$$, so pretty much everyone just "accepts the risk" seeing that probability of something like this happening to your company (during your tenure) is still super low. All companies with somewhat robust security posture I know have had a string of incidents in the past, that seems to be the only thing that can motivate to put $ in security.

It's not really very expensive to issue employees a laptop (which costs a percent or two of an engineers annual salary) and tell them "All work must be done on the work laptop, no personal files/software allowed on the work laptop". For a little more money, they can add active management of the work devices, but just keeping work and personal device use separate would have prevented this.
Post reply on HN