How did LastPass master passwords get compromised?
1–10 of 189 posts
Re: How did LastPass master passwords get compromised?
#2I am the author of this article. I’ve kept it short, some points made there could have been expanded considerably. So if there are questions, feel free to ask here.
Re: How did LastPass master passwords get compromised?
#3I am the author of this article. I’ve kept it short, some points made there could have been expanded considerably. So if there are questions, feel free to ask here.
What is your opinion of the analysis from LastPass themselves?[0]
It seems to have been some internal alerting that went wrong, which does happen from time to time.
> Our initial findings led us to believe that these alerts were triggered in response to attempted “credential stuffing” activity [...] We quickly worked to investigate this activity and, at this time, have no indication that any LastPass accounts were compromised by an unauthorized third-party as a result of these credential stuffing attempts, nor have we found any indication that user’s LastPass credentials were harvested by malware, rogue browser extensions, or phishing campaigns.
> Our investigation has since found that some of these security alerts, which were sent to a limited subset of LastPass users, were likely triggered in error.
[0] https://blog.lastpass.com/2021/12/unusual-attempted-login-ac...
Re: How did LastPass master passwords get compromised?
#4I am the author of this article. I’ve kept it short, some points made there could have been expanded considerably. So if there are questions, feel free to ask here.
There might be a cluster of old accounts in play and perhaps a smaller cluster of newly created or newly changed accounts. This hints at the possibility of more than one bad actor.
It's possible the old accounts could be some old stock sold on a darknet forum and are being bundled in with the newer hashes/pwds. It's also possible that the entity harvesting the newer hashes/pwds isn't the same one who is amateurishly attempting to access the accounts.
Note: Lastpass's geolocation may be off (even more than usual for geolocation) as some of the IPs are in ownership dispute and all of them may be for VPNs.
Re: How did LastPass master passwords get compromised?
#5I am the author of this article. I’ve kept it short, some points made there could have been expanded considerably. So if there are questions, feel free to ask here.
What is your opinion of the analysis from LastPass themselves?[0] It seems to have been some internal alerting that went wrong, which does happen from time to time. > Our initial findings led us to believe that these alerts were triggered in response to attempted “credential stuffing” activity [...] We quickly worked to investigate this activity and, at this time, have no indication that any LastPass accounts were co…
>Our investigation has since found that some of these security alerts, which were sent to a limited subset of LastPass users, were likely triggered in error. As a result, we have adjusted our security alert systems and this issue has since been resolved.
This added bit hints that these emails were erroneously sent in response to the wrong password being attempted against the master account (which normally doesn't rate an email). It isn't fully spelled out tho.
LP spends most of the blogpost going on about bad user practices - which feels a lot like gaslighting in this context.
edit: I'm leaning toward accepting LP's incomplete, forced explanation and that hackery isn't in play here.
Re: How did LastPass master passwords get compromised?
#6I am the author of this article. I’ve kept it short, some points made there could have been expanded considerably. So if there are questions, feel free to ask here.
They claim to have 30,000,000 users but we've only seen a handful of reports about this, why such a small percentage? Wouldn't someone with a full list of passwords want to exfiltrate as much data as possible before it became obvious they had the creds?
Re: How did LastPass master passwords get compromised?
#7I am the author of this article. I’ve kept it short, some points made there could have been expanded considerably. So if there are questions, feel free to ask here.
They claim to have 30,000,000 users but we've only seen a handful of reports about this, why such a small percentage? Wouldn't someone with a full list of passwords want to exfiltrate as much data as possible before it became obvious they had the creds?
There are ways this scenario could manifest. The person submitting the passwords could have purchased them on the darkweb and may be figuring out how to use them. We'd be seeing the trial+error part of their learning curve.
Re: How did LastPass master passwords get compromised?
#8I am the author of this article. I’ve kept it short, some points made there could have been expanded considerably. So if there are questions, feel free to ask here.
Good write up. They have been in full PR deflection mode rather than to actually engage those users to which it apparently happened in dialogue to try to nail down the root cause and were much too quick with their denial of their own involvement for that to be believable.
Re: How did LastPass master passwords get compromised?
#9I am the author of this article. I’ve kept it short, some points made there could have been expanded considerably. So if there are questions, feel free to ask here.
They claim to have 30,000,000 users but we've only seen a handful of reports about this, why such a small percentage? Wouldn't someone with a full list of passwords want to exfiltrate as much data as possible before it became obvious they had the creds?
Whoever first gets a hold of the password hashes would need to bruteforce individual entries or cross-check them against known leaks for reuse, which takes time. It's natural that they would only go after high value targets like famous people, cryptocurrency users, etc, then resell the database after they got as much value out of it as possible.
Re: How did LastPass master passwords get compromised?
#10Earlier quoted context omitted.
What is your opinion of the analysis from LastPass themselves?[0] It seems to have been some internal alerting that went wrong, which does happen from time to time. > Our initial findings led us to believe that these alerts were triggered in response to attempted “credential stuffing” activity [...] We quickly worked to investigate this activity and, at this time, have no indication that any LastPass accounts were co…
>Our investigation has since found that some of these security alerts, which were sent to a limited subset of LastPass users, were likely triggered in error. As a result, we have adjusted our security alert systems and this issue has since been resolved. This added bit hints that these emails were erroneously sent in response to the wrong password being attempted against the master account (which normally doesn't rat…
> erroneously sent in response to the wrong password being attempted against the master account
This seems likely. After the original HN post, I went to delete my LastPass account as I've been using Bitwarden for several years. I initially used the wrong password, but then successfully logged in.
I got the alert email in question, so either it was sent in response to the wrong password (incorrectly) or it was sent in response to the full login, which of course wasn't blocked. The former seems more likely to me.