Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass says DevOps engineer’s hacked computer led to security breach in 2022

9to5mac.com

Post reply on HN
Print view View original

241–250 of 270 posts

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#241

Post by TheRealDunkirk »

forty wrote: post #113
mcsniff wrote: post #10

So, with most password managers, when you authenticate on a new device, you are prompted for MFA. The user had a keylogger installed on their machine, so the attacker could collect the master password, but how did they login to the vault on a new machine without MFA? Did they get the MFA seed and login on a different machine, and nobody received a "You're using LastPass on a new machine, if this wasn't you..." messag…

I work for a LastPass competitor. As far as I know, no popular password manager seriously includes "fully compromised local device" in their threat model. I don't think it can be done without hurting seriously usability (like having one 2fa verification each time you use a credential would work) and the predictable outcome of hurting usability too much is that people will find more handy insecure ways to store their…

1Password has become really onerous to use in these days of Javascript front ends and PWA's that do norm-breaking things to the UI in a browser. I often get stuck in some sort of crazy loop trying to authenticate the browser plugin versus the app, and then have more frustrations with taps in the apps being re-captured back from the plugin. If any more frustration gets added to the workflow than I'm already experiencing, I'm going to abandon it for Apple's keychain, though I loathe the idea of letting Apple have this last piece of my personal data footprint.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#242

Post by antihero »

yunwal wrote: post #192
mhitza wrote: post #183

Earlier quoted context omitted.

What I want is a secure shell (somehow) where my env variables are encrypted and on access I get a prompt to either use a fingerprint reader or a password to unlock them for the process. Anyone know of any such option? What I've come to use are separate env files that I source in various directories before running the commands that need crednetials, or a tool that decrypts a file, loads it into an subprocesses env va…

aws-vault[0] does this, but only for aws creds 0 - https://github.com/99designs/aws-vault

Yeah this is a good tool, if annoying at times.

A better way would be to not allow user accounts to deploy anything in any sort of prod accounts, instead only allowing this to happen through CI.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#243

Post by bobleeswagger »

razemio wrote: post #234
bobleeswagger wrote: post #208

Earlier quoted context omitted.

Wouldn't this be an implementation detail of the password manager? Either way, I hear you that this is asking for new functionality. Still, I don't think most people think that a factor disappears depending on the caching policy of the vault on your machine. It's quite a footgun.

No, since the cached data has nothing todo with the password manager. The cached data is just an encrypted file. Sure the password manager could ask for the otp but the cache file was attacked directly. That is why I was wondering if I was missing something. To my knowledge it isn't possible to protect a file with a rotating key.

> To my knowledge it isn't possible to protect a file with a rotating key.

This is my point, it is an implementation detail of the password manager to integrate OTP or another second with decryption of the vault. Any password manager can implement this.

From the perspective of the user, you are stripping a factor for some arbitrary period of time. It's a broken implementation.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#244

Post by bobleeswagger »

Thorrez wrote: post #231
bobleeswagger wrote: post #178

Earlier quoted context omitted.

Sure, but I wouldn't expect the vault to be accessible without 2FA each time it is cached. 2FA should be used as part of the decryption process even if the vault is cached.

You expect 2FA to be used for decryption? I'm not aware of any system with that does that that has any significant amount of usage. Even if the 2FA was used for decryption, it wouldn't really make you much safer, because malware can steal the decrypted vault out of memory right after you type in the 2FA. A HSM would solve this, as long as the HSM has some out of band way to communicate with the user, such as an appro…

> Even if the 2FA was used for decryption, it wouldn't really make you much safer

If the second factor is stripped for some arbitrary time, you don't have 2FA anymore. Your argument that "any adversary can read the vault from memory" is a weak one, we might as well not have passwords with that attitude.

The point of a second factor is that BOTH need to be present to get to the secrets. If one of those factors is stripped away for "convenience" we're misunderstanding the point of 2FA entirely. I can't make this any clearer.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#245

Post by secabeen »

Thorrez wrote: post #233
secabeen wrote: post #206

Earlier quoted context omitted.

Read the technical details of TOTP, at root, you and the other end are performing similar mathematical operations on a shared secret such that knowledge of a single result gives you no information about later results. The actual check is just a string compare; the result is not included in the vault decryption operations in any way. Thus, if you have root, you can just alter the Check2FA() function to return true. I'…

There's a keypass plugin that allows you to encrypt and decrypt your database with HOTP. I doubt it has much usage. It seems really inconvenient, and also potentially dangerous, because if your HOTP provider gets too far ahead of your database (you press the button too many times, or typo too many times), you permanently lose access to your data. You would want a HOTP provider that supports rewinding to avoid that pr…

Indeed. That's a neat plugin, each time you lock the database, it rolls forward your HOTP key some number of rounds, then uses the results of those rounds to encrypt a piece of key material for the vault. Then, when you go to decrypt, as long as your HOTP app hasn't generated more than the number of rounds it rolled forward, it can generate the decryption key from the HOTP stream and decrypt the vault. A little fragile, but a neat implementation.

> right after you enter your 2FA malware can steal the decrypted database out of memory.

There's probably a creative protection here where each key is encrypted individually, but you'd still need some solution like the above HOTP trick or the attacker could scrape the key information out of memory, then decrypt each entry individually.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#246

Post by misto »

remram wrote: post #195
misto wrote: post #142

Earlier quoted context omitted.

I do not like the title either, but I do understand the motivation of taking all those "non-software engineering", technical roles and putting them under the same umbrella, due to a lack for a better title, because a company might not afford to have separate roles for each of those areas you have listed above. "OPERATIONS ENGINEER" might work, but it raises another set of problems, e.g. does it imply operational resp…

What's wrong with system administrator? IT specialist? Cloud engineer? Reliability expert? There are many options that don't tack "dev" into your non-dev job titles.

Did you even read my comment? None of your provided alternatives solve the issue of the current market being in demand of such a wide set of skills outside of the "normal software development" practice (whatever that even is), that labeling all of those under whatever title will get some people butthurt.

If its a matter of gatekeeping the "developer" status, go read some actual job posts with the title DevOps in them. Its not uncommon to come across proficiency requirements in at least one programming language (e.g. Go/Python/Rust), used in automation libraries, cli tools or whatever, which the applicants are expected to "develop". Or is it just constructions that can be developed?

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#247

Post by razemio »

bobleeswagger wrote: post #243
razemio wrote: post #234

Earlier quoted context omitted.

No, since the cached data has nothing todo with the password manager. The cached data is just an encrypted file. Sure the password manager could ask for the otp but the cache file was attacked directly. That is why I was wondering if I was missing something. To my knowledge it isn't possible to protect a file with a rotating key.

> To my knowledge it isn't possible to protect a file with a rotating key. This is my point, it is an implementation detail of the password manager to integrate OTP or another second with decryption of the vault. Any password manager can implement this. From the perspective of the user, you are stripping a factor for some arbitrary period of time. It's a broken implementation.

That is not correct. You can not have offline caching and otp enabled at the same time. That is why things like yubikey exist. If your are not using another 2fa method besides otp it's either the security risk or entering otp each time you access the vault. Obviously the later is not feasible.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#248

Post by j-bos »

secabeen wrote: post #201
j-bos wrote: post #157

Am I understanding correctly: A single engineer had both access to the prod database AND the data decryption values?

Depends on what you mean by "the data decryption values". If you mean the encryption keys for the vaults themselves, no. Those are derived from the individual master passwords (in non-SSO setups, with SSO it's more complicated, and I don't fully understand the impact). So the attackers have a bunch of encrypted vaults from a backup. They can now brute-force the vaults, but if the original Master Passwords were secure…

ah, thanks for the clarification.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#249

Post by schainks »

NoPicklez wrote: post #66
schainks wrote: post #60

Earlier quoted context omitted.

> The buck is supposed to stop at security, not at each employee's personal hygiene … if your game plan depends on the latter, it's game over. I have to take security trainings twice a year that literally talk about the buck stopping at my digital hygiene and I better not fuck it up for The Company. Companies have to understand breaches will happen, but preparing employees on how to spot attacks or understand when th…

Right, but for your average user. If your machine is infected with a keylogger that results in a stolen password because of a vulnerability not timely identified and corrected. That's not on you as an employee, that's on the security team for not implementing compensating controls/defence in depth. Yes you have a responsibility to detect phishing emails, not writing down passwords, inserting USB's etc. But if somethi…

I agree with this assessment. I am also required to run security scanning software by corporate that inspects a lot of activity on my machine.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#250

Post by schainks »

davewritescode wrote: post #161
schainks wrote: post #60

Earlier quoted context omitted.

> The buck is supposed to stop at security, not at each employee's personal hygiene … if your game plan depends on the latter, it's game over. I have to take security trainings twice a year that literally talk about the buck stopping at my digital hygiene and I better not fuck it up for The Company. Companies have to understand breaches will happen, but preparing employees on how to spot attacks or understand when th…

Security is basically layering imperfect solutions on top of each other until the statistical probability of breaching ALL of them gets small enough to satisfy the requirements of the organization. In the case of LastPass, they're holding data (which they shouldn't have been to be fair) that's INCREDIBLY attractive to everyone from script kiddies to nation state actors. When it comes to keeping out nation states the…

LastPass’ lackadaisical attitude internally for defense in depth is indeed embarrassing.
Post reply on HN