Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass says DevOps engineer’s hacked computer led to security breach in 2022

9to5mac.com

Post reply on HN
Print view View original

261–270 of 270 posts

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#261

Post by Fire-Dragon-DoL »

j45 wrote: post #260
Fire-Dragon-DoL wrote: post #76

Earlier quoted context omitted.

Sharing with family sucks with these. No permission control and no simultaneous write from multiple devices make those unusable

Wouldn't most of the use cases be reading, instead of writing? I have seen people create multiple files on a share that works fine. I wasn't too keen on it at first but it did seem to work OK.

I create accounts quite often, so I would expect collisions to happen, the cost of mistake is high.

The other problem is that there is stuff you want for yourself, stuff shared with your partner, stuff shared with all the family (children included) and stuff shared 1-on-1 with each child.

That gets messy quickly.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#262

Post by Thorrez »

bobleeswagger wrote: post #258
Thorrez wrote: post #254

Earlier quoted context omitted.

>Your argument that "any adversary can read the vault from memory" is a weak one, we might as well not have passwords with that attitude. It all comes down to threat model. If you don't have malware on your machine, 2FA and passwords are quite useful. If you do have malware on your machine, they're basically useless. This is basically the same for any service. Name one website or program that's safe even if you have…

> You seem to think there's some practical way to do it, but there isn't. It is an implementation detail of the password manager itself. Any password manager can update their implementation to ensure the second factor is always needed when decrypting the vault. I'm not sure why you think this is an impossible feat. It's a choice that can be made.

How? What type of 2FA are you talking about? Is there any that does this that many people use?

The only thing I know that does encryption with 2FA is https://keepass.info/plugins.html#otpkeyprov . But I highly doubt it has much usage. It's going to be annoying typing in a 2FA every time you decrypt your password database (I decrypt my password database maybe 10 times per day). More concerningly, if you press the button on your 2FA device (this is HOTP, which requires you to press a button to get a new code) too many times, or typo the 2FA too many times, you can permanently lose access to your database because the HOTP device will advance past the point that the database supports.

So yes, it's a choice that can be made, but it has very major downsides.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#263

Post by Thorrez »

bobleeswagger wrote: post #259
Thorrez wrote: post #253

Earlier quoted context omitted.

>There's probably a creative protection here where each key is encrypted individually, but you'd still need some solution like the above HOTP trick or the attacker could scrape the key information out of memory, then decrypt each entry individually. It seems to me like that would require a separate HOTP device for each password database entry, otherwise the malware can steal one HOTP token and use it against a differ…

> It seems to me like that would require a separate HOTP device for each password database entry That would be a paranoid level of implementation. As it sits, the HOTP device is only _sometimes_ needed depending on the caching policy. Fix that broken implementation first, then we can figure out how to update the threat model to account for an adversary that has already infected your computer.

>As it sits, the HOTP device is only _sometimes_ needed depending on the caching policy.

I don't understand what you mean. Are you talking about https://keepass.info/plugins.html#otpkeyprov or are you talking about LastPass? LastPass doesn't support HOTP AFAIK. HOTP isn't a very good form of 2FA (it's phishable, sometimes inconvenient, and it can become desynced), U2F is much better, but you can't encrypt a database with U2F.

KeepPass has a very customizable policy of when to lock the database. I have KeePass on my desktop set to lock if KeePass is inactive for 1 hour, or if my computer is inactive for 10 minutes, or if I lock my screen. Are you saying there should be a semi-locked state that requires a password but not a 2FA? Sure that's possible.

None of this protects you from malware on your computer though, so I don't know why we're talking about it.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#264

Post by morelish »

Johnny555 wrote: post #20
LilBytes wrote: post #2

Am I assuming in this case the engineer was using his home PC to work? This isn't unheard of in the industry, Engineers using BYOD devices or similar to work from home. But with a company with a risk profile as high as LastPass this seems _incredibly dumb_. You would assume anyone with the keys to the kingdom was working on a company provided device, or any device that fits a compliance framework based on their own r…

My company isn't nearly as high profile or security focused and we're not allowed to use our own computers for any work related purposes,and our work laptops run threat detection software and we have a whitelist of software we're allowed to install. I'm surprised that LastPass's policies aren't at least that strict. My company has what I think is a big hole in this policy in that we're allowed to use our own phone fo…

How exactly can your IT department whitelist all software on your device? Are you using any build tools that install third party dependencies or are you using any development tools that do the same? Is your shell locked down so you can’t run command as a super user?

I assume your IT just has a whitelist for some stuff but I can’t imagine actually being a developed without super user privileges. Unless your doing some sort of very controlled software development.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#265

Post by jjeaff »

Phemist wrote: post #144
jjeaff wrote: post #93

Earlier quoted context omitted.

They need to sell it to someone else with a better track record.

I agree with the GP. Why would selling it solve the issues with the product? How much of the product can be salvaged? They have a well-known brandname, but it is arguably radioactive now. The product as software can be rebranded, but why go through this effort if the ubderlying software has proven faulty so many times in the past? A similar effort can be invested in making open-source password managers better, so the…

It seems like nothing is necessarily wrong with the software itself. Its the opsec surrounding the software. The most secure software in the world can be pwned if you can get access to the lead dev's system or the build system itself.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#266

Post by bgro »

Sometimes I wonder if I shouldn’t google the weather on my work computer because it might have some crazy exploit or cause an alert.

DevOps guy here is just running a Plex server and probably pirating porn on his work laptop because why not at that point. Can’t even bother updating this which Plex makes literally about as easy as they possibly could. It’s a one click fully automated process with zero interruption. Was he using internet explorer too?

Or was it his work laptop or did they just let him log in to work on any random computer?

Did he actually get any work done? I want to hear an interview from this guy. How did he get hired as DevOps while avoiding all the basics of fundamental basic work practices?

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#267

Post by j45 »

Fire-Dragon-DoL wrote: post #261
j45 wrote: post #260

Earlier quoted context omitted.

Wouldn't most of the use cases be reading, instead of writing? I have seen people create multiple files on a share that works fine. I wasn't too keen on it at first but it did seem to work OK.

I create accounts quite often, so I would expect collisions to happen, the cost of mistake is high. The other problem is that there is stuff you want for yourself, stuff shared with your partner, stuff shared with all the family (children included) and stuff shared 1-on-1 with each child. That gets messy quickly.

Hopefully an upsurge project will eat this problem soon.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#268

Post by wepzen »

gavanm wrote: post #68
theamk wrote: post #52

Earlier quoted context omitted.

Are there any reliable ways to secure remote computers from keyloggers _and_ still provide an efficient software development environment for non-trivial projects? All of the software engineers I have seen have a fairly unrestricted environment -- Linux machines, with sudo access, often with passwordless root access via "docker" group, and with non-intrusive "endpoint protection" system. It would be normal to for some…

You've already included the answer - "using their machines as remote terminals, doing most their actual work on some remote server". The developer uses MFA (TOTP, Push Notification, Yubikey etc) into a virtual desktop inside the organisation (Citrix, VMWare Horizon, etc). From there, the developer can SSH / whatever into their development environment - which is hosted "inside" the corporate network, or their cloud pr…

In my experience, I find that working with Virtual Desktops is the most frustrating user experience as a developer you could have. I prefer working in containerized environments which are more efficient and do not require the same amount of configuration processes as a Virtual Desktop.

You should check some solutions out.

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#269

Post by trallnag »

crabbone wrote: post #240
trallnag wrote: post #211

Earlier quoted context omitted.

Are you misunderstanding the term "DevOps"? You build it, you run it. If a DevOps team only runs things other developers have build, it is not a DevOps team.

No. I'm not.

There seem to be two competing definitions

Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022

#270

Post by IncRnd »

trallnag wrote: post #211
crabbone wrote: post #167

Earlier quoted context omitted.

This is both a misunderstanding of the problem and an attempt to solve an administrative problem using technology... which cannot really solve it. Developers have nothing to do with this. It's a common practice in companies that have "expensive" production environment (eg. VMs rented from AWS) that developers never get any kind of access to production environment. Ever. At all. No need to tie developers' hand by putt…

Are you misunderstanding the term "DevOps"? You build it, you run it. If a DevOps team only runs things other developers have build, it is not a DevOps team.

In this case, DevOps shouldn't be rearchitecting, developing, or changing a password management's solution, crypto, architechture, or design in any way. Not in the slightest.
Post reply on HN