Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass says DevOps engineer’s hacked computer led to security breach in 2022

9to5mac.com

Post reply on HN
Print view View original

231–240 of 270 posts

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#231

Post by Thorrez »

bobleeswagger wrote: post #178
Thorrez wrote: post #77

Earlier quoted context omitted.

2FA can't protect you from malware on your machine.

Sure, but I wouldn't expect the vault to be accessible without 2FA each time it is cached. 2FA should be used as part of the decryption process even if the vault is cached.

You expect 2FA to be used for decryption? I'm not aware of any system with that does that that has any significant amount of usage.

Even if the 2FA was used for decryption, it wouldn't really make you much safer, because malware can steal the decrypted vault out of memory right after you type in the 2FA. A HSM would solve this, as long as the HSM has some out of band way to communicate with the user, such as an approval button that malware can't press and a screen saying what password to release.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#232

Post by Thorrez »

jhoelzel wrote: post #181
Thorrez wrote: post #77

Earlier quoted context omitted.

2FA can't protect you from malware on your machine.

why wouldn't it? And its not so much about protecting me, but to protect company interest right?

Malware can steal everything that's accessible right after you type in the 2FA.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#233

Post by Thorrez »

secabeen wrote: post #206
jhoelzel wrote: post #181

Earlier quoted context omitted.

why wouldn't it? And its not so much about protecting me, but to protect company interest right?

Read the technical details of TOTP, at root, you and the other end are performing similar mathematical operations on a shared secret such that knowledge of a single result gives you no information about later results. The actual check is just a string compare; the result is not included in the vault decryption operations in any way. Thus, if you have root, you can just alter the Check2FA() function to return true. I'…

There's a keypass plugin that allows you to encrypt and decrypt your database with HOTP. I doubt it has much usage. It seems really inconvenient, and also potentially dangerous, because if your HOTP provider gets too far ahead of your database (you press the button too many times, or typo too many times), you permanently lose access to your data. You would want a HOTP provider that supports rewinding to avoid that problem. But I think HOTP doesn't really support rewinding very much.

https://keepass.info/plugins.html#otpkeyprov

But this is beside the point I was making. My point was that even if the the database was encrypted with 2FA, right after you enter your 2FA malware can steal the decrypted database out of memory.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#234

Post by razemio »

bobleeswagger wrote: post #208
Fabricio20 wrote: post #207

Earlier quoted context omitted.

I'm not aware of any encryption algos that can encrypt data using a rotating key such as a TOTP code. The vault file is encrypted using the master password, if you encrypted it with the TOTP code you wouldn't be able to decrypt it 30s later, and if you have logic to parse the 2FA I can just replace your logic with return true;

Wouldn't this be an implementation detail of the password manager? Either way, I hear you that this is asking for new functionality. Still, I don't think most people think that a factor disappears depending on the caching policy of the vault on your machine. It's quite a footgun.

No, since the cached data has nothing todo with the password manager. The cached data is just an encrypted file. Sure the password manager could ask for the otp but the cache file was attacked directly. That is why I was wondering if I was missing something. To my knowledge it isn't possible to protect a file with a rotating key.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#235

Post by jhoelzel »

secabeen wrote: post #206
jhoelzel wrote: post #181

Earlier quoted context omitted.

why wouldn't it? And its not so much about protecting me, but to protect company interest right?

Read the technical details of TOTP, at root, you and the other end are performing similar mathematical operations on a shared secret such that knowledge of a single result gives you no information about later results. The actual check is just a string compare; the result is not included in the vault decryption operations in any way. Thus, if you have root, you can just alter the Check2FA() function to return true. I'…

ah i get it!

I was trying imply that you need 2fa for the services itself so the passwort alone is useless.

Ironically office 365 has a nice implementation, where it for instance requires all admins to use MFA

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#236

Post by jhoelzel »

thisgoesnowhere wrote: post #217
jhoelzel wrote: post #177

Earlier quoted context omitted.

which in turn should not be the end of the world, because its MFA all the way down right?

MFA is not used when you decrypt your vault on any password platform. It's just to receive the encrypted vault

well i was more thinking along the lines of every service in your vault implementing additional 2fa.

In the kubernetes world it really is not so difficult

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#237

Post by CoolCold »

mhitza wrote: post #183
antihero wrote: post #122

Earlier quoted context omitted.

I expect the amount of companies that would get fucking owned by simply managing to execute cat ~/.aws/* | On a devops/senior dev machine is colossal.

What I want is a secure shell (somehow) where my env variables are encrypted and on access I get a prompt to either use a fingerprint reader or a password to unlock them for the process. Anyone know of any such option? What I've come to use are separate env files that I source in various directories before running the commands that need crednetials, or a tool that decrypts a file, loads it into an subprocesses env va…

Combining direnv with sops can be partial solution here.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#238

Post by eviks »

technick wrote: post #230
eviks wrote: post #173

Earlier quoted context omitted.

Thank you for proposing to cure the lack of competence with the lack of freedom, but the easier source of target identity is the August 2022 breach of LastPass

Insider Threat is real, can't discount that at all. What I can tell you as someone who participates in OSINT competitions and has engaged in red team activities, Linkedin is always the first stop when shopping for info. Edit: Also wanted to mention 3 out of 4 incidents I am involved in is related to insider threat.

We can't discount the insider threat at all, but it's very easy to discount such shallow measures. Also, this wasn't a competition, and even there "the first stop" tells us nothing about its effectiveness (maybe the next 5 steps take 5 mins longer, but are even more accurate, so the benefit of the ban would still not exist)

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#239

Post by avianlyric »

dogma1138 wrote: post #225
avianlyric wrote: post #155

Earlier quoted context omitted.

All this might be true in the US where realtime transfers don’t really exist. But here in true UK where we‘be had realtime, high volume transfers for at least a decade, it’s very possible to steal digital money and move it on before the bank notices. Faster Payments in the UK are expected to be credited and spendable within 20min, normally it’s spendable within milliseconds. The actual settlements happen every few ho…

I’m from the UK that’s for relatively very small amounts and it’s insured, this is the cost of doing business and there are still a lot of fraud checks especially for new payees. If your account all of a sudden has 10’s yet alone of 100’s 1000’s or of transfers in it will be quarantined. HSBC locked my account just last week for 7 or 8 transfers of circa £10 all being made all in the same day from colleagues from my…

> If your account all of a sudden has 10’s yet alone of 100’s 1000’s or of transfers in it will be quarantined.

> HSBC locked my account just last week for 7 or 8 transfers of circa £10 all being made all in the same day from colleagues from my work since we bought a gift for someone that was leaving and settled the payment.

I would be careful assuming that HSBC is representative of how banks in the UK work. They’re well know to be the most trigger happy bank when it comes to account and transfer freezes. HSBC was probably the number one cause of complaints related to transfers while I was working in the fincrime team of a different bank.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#240

Post by crabbone »

trallnag wrote: post #211
crabbone wrote: post #167

Earlier quoted context omitted.

This is both a misunderstanding of the problem and an attempt to solve an administrative problem using technology... which cannot really solve it. Developers have nothing to do with this. It's a common practice in companies that have "expensive" production environment (eg. VMs rented from AWS) that developers never get any kind of access to production environment. Ever. At all. No need to tie developers' hand by putt…

Are you misunderstanding the term "DevOps"? You build it, you run it. If a DevOps team only runs things other developers have build, it is not a DevOps team.

No. I'm not.
Post reply on HN