Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass says DevOps engineer’s hacked computer led to security breach in 2022

9to5mac.com

Post reply on HN
Print view View original

211–220 of 270 posts

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#211

Post by trallnag »

crabbone wrote: post #167
gavanm wrote: post #68

Earlier quoted context omitted.

You've already included the answer - "using their machines as remote terminals, doing most their actual work on some remote server". The developer uses MFA (TOTP, Push Notification, Yubikey etc) into a virtual desktop inside the organisation (Citrix, VMWare Horizon, etc). From there, the developer can SSH / whatever into their development environment - which is hosted "inside" the corporate network, or their cloud pr…

This is both a misunderstanding of the problem and an attempt to solve an administrative problem using technology... which cannot really solve it. Developers have nothing to do with this. It's a common practice in companies that have "expensive" production environment (eg. VMs rented from AWS) that developers never get any kind of access to production environment. Ever. At all. No need to tie developers' hand by putt…

Are you misunderstanding the term "DevOps"? You build it, you run it. If a DevOps team only runs things other developers have build, it is not a DevOps team.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#212

Post by trallnag »

Johnny555 wrote: post #210
execveat wrote: post #140

Earlier quoted context omitted.

Preventing this thing from happening costs a lot of $$$, so pretty much everyone just "accepts the risk" seeing that probability of something like this happening to your company (during your tenure) is still super low. All companies with somewhat robust security posture I know have had a string of incidents in the past, that seems to be the only thing that can motivate to put $ in security.

It's not really very expensive to issue employees a laptop (which costs a percent or two of an engineers annual salary) and tell them "All work must be done on the work laptop, no personal files/software allowed on the work laptop". For a little more money, they can add active management of the work devices, but just keeping work and personal device use separate would have prevented this.

No there's no way to install a key logger on a company device?!

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#213

Post by trallnag »

bobleeswagger wrote: post #203
secabeen wrote: post #198

Earlier quoted context omitted.

Okay, but the attacker has RCE on the system doing the decryption, so they can scrape the encryption keys or the vault data out of memory. This appears to be a APT, probably a State-level actor. Once the production work machine was compromised, it's all over.

I get what you're saying, but the implementation of 2FA is still broken. If we don't fix that, we can't fix what comes next either.

Good job moving the goal post.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#214

Post by trallnag »

dividedbyzero wrote: post #104
unit_circle wrote: post #96

First of all: If you have the title of "DevOps" what you're doing is "Operations", you aren't practicing DevOps. Anyway, this company has had incident after incident. This will keep happening every few years for them like it has for the past 10. As will lack of transparency/ outright lying. Some commenters are saying they wish the company the best. I don't. Use something else. LastPass needs to die.

> First of all: If you have the title of "DevOps" what you're doing is "Operations", you aren't practicing DevOps. So what title do you need to have to practice DevOps?

Something according to "You build it, you run it".

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#215

Post by Johnny555 »

trallnag wrote: post #212
Johnny555 wrote: post #210

Earlier quoted context omitted.

It's not really very expensive to issue employees a laptop (which costs a percent or two of an engineers annual salary) and tell them "All work must be done on the work laptop, no personal files/software allowed on the work laptop". For a little more money, they can add active management of the work devices, but just keeping work and personal device use separate would have prevented this.

No there's no way to install a key logger on a company device?!

There is, but in this case it was the employee's personal software that allowed the back door. It's ludicrous that LastPass allowed employees to put sensitive data (i.e. their password manager) on personal computers with, apparently, no restrictions on what software they run.

Closing the barn door doesn't guarantee that the horses can't escape, but when you don't even have a barn door, it's hard to blame the stable boy when the horses get out.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#216

Post by forty »

secabeen wrote: post #199
forty wrote: post #113

Earlier quoted context omitted.

I work for a LastPass competitor. As far as I know, no popular password manager seriously includes "fully compromised local device" in their threat model. I don't think it can be done without hurting seriously usability (like having one 2fa verification each time you use a credential would work) and the predictable outcome of hurting usability too much is that people will find more handy insecure ways to store their…

> like having one 2fa verification each time you use a credential would work I'm interested in the technical idea here. You have a set of credentials encrypted with AES. So each vault item is encrypted with a symmetric key. How would you build a system to generate those keys using a rotating 2FA that isn't reversible by an attacker that can watch the entire process and can fake the timestamp or other elements on the…

Don't store the encrypted passwords locally. Have them on a server that deliver them only against a valid otp/push notification confirmation on your phone/yubikey tap etc.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#217

Post by thisgoesnowhere »

jhoelzel wrote: post #177
thisgoesnowhere wrote: post #149

Earlier quoted context omitted.

MFA wouldnt have helped here. The hacker had the encrypted vault all they needed was the password.

which in turn should not be the end of the world, because its MFA all the way down right?

MFA is not used when you decrypt your vault on any password platform. It's just to receive the encrypted vault

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#218

Post by dvngnt_ »

secabeen wrote: post #201
j-bos wrote: post #157

Am I understanding correctly: A single engineer had both access to the prod database AND the data decryption values?

Depends on what you mean by "the data decryption values". If you mean the encryption keys for the vaults themselves, no. Those are derived from the individual master passwords (in non-SSO setups, with SSO it's more complicated, and I don't fully understand the impact). So the attackers have a bunch of encrypted vaults from a backup. They can now brute-force the vaults, but if the original Master Passwords were secure…

the exposed passwords isn't even the worst part. it's the fact that user vaults sites are unencrypted so now attackers know every website that you thought was important enough to save.

they know what bank you use, which adult sites you visit, what medical conditions you might have

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#219

Post by NoPicklez »

adrr wrote: post #174
NoPicklez wrote: post #72

Earlier quoted context omitted.

I disagree, but disclaimer I work at a company that allows you to. If you work at an organisation like LastPass in a privileged position, then you need to be aware that you are an enormous target. And it's not just your own or the companies security you potentially compromise, but millions of others arguably most sensitive information. In Australia, if you have a security defence clearance, you are not allowed to dis…

I would assume you're still allowed to post your to social media in Australia. Security clearance is not a role. I doubt people post they have access to all the infrastructure on their linkedin but you can infer it by the role. Linkedin doesn't even matter since you can buy the data any way. Email Signatures are mined to get role and contact info for databrokers. Anytime you email outside of the org, the CRM software…

Yes, I don't know any company in Australia that doesn't allow you to post to social media. In fact in the company I work for it is actively encouraged.

My point being is that there are details you aren't allowed to put on your social media accounts, for the reasons we're debating.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#220

Post by throwaway47362 »

pid-1 wrote: post #163
jstummbillig wrote: post #134

Earlier quoted context omitted.

> Restricting access to corporate environments from trusted machines is trivial using any form of MDM. Until somebody pulls out their personal cell phone, and takes a photo of a screen containing highly confidential data, to then send it to someone else, because, dang it, they had to get something done NOW and it seemed very convenient.

No security measure is 100% effective nor 100% moron proof, but in many companies that would be a fireable offense, which gets you pretty far.

Some consumer electronics companies have security guards enforcing that no cellphone gets on premises. If you want security you can get security, but is the price worth paying? All depends on the cost of a breach. Given that last pass still has customers maybe they estimated their costs just right ;) that cannot be said of some certificate authorities..
Post reply on HN