![]() So where on earth were the access controls? Why wasn't an alert raised when the senior developer, apparently one of only four holding the keys to these services, started using their home computer to access them? A password manager company should have processes in place, beyond bring your own device and work from home policy, to prevent a 'home computer' with apparently vulnerable third-party software installed from getting anywhere near these services. But targeting high-value employees in a valuable organization is a familiar attack model. Admittedly, this was a persistent and seemingly well-resourced attacker. ![]() My trust in LastPass has now been broken into little pieces. This is why even minor breaches should not be overlooked," Javvad Malik, lead security awareness advocate at KnowBe4, said. "This attack is a textbook persistent attack where the attackers increased their foothold in stages and without rushing the process. The threat actor was able to capture the employee’s master password as it was entered, after the employee authenticated with MFA, and gain access to the DevOps engineer’s LastPass corporate vault." MORE FROM FORBES Hacker Reveals Microsoft's New AI-Powered Bing Chat Search Secrets By Davey Winder A textbook persistent attack, experts say " This was accomplished by targeting the DevOps engineer’s home computer and exploiting a vulnerable third-party media software package, which enabled remote code execution capability and allowed the threat actor to implant keylogger malware. I will quote the paragraph that broke this security camel's back in full as it relates to how the attacker got access to the decryption keys for the cloud storage service: LastPass confirms senior developer using home computer was hacked LastPassĮven now, in the same statement that assured customers that LastPass had listened to concerns about communicating more comprehensively, the bombshell disclosure was contained in a separate 'additional details' document. ![]() The security incidents were not, the statement read, "caused by any LastPass product defect." Maybe not, but corporate security processes and controls appear to have fallen even shorter than corporate comms. However, the red flags started waving for me when the statement confirmed that a threat actor had "targeted a senior DevOps engineer by exploiting vulnerable third-party software." Wait, what?īy doing so, we were informed that the attacker delivered malware that could bypass security controls and gain access to those cloud backups. That's fair enough file under lessons learned. This confirmed that LastPass needed to catch up regarding communication regarding the security incidents being comprehensive and frequent enough. "Trust is paramount in the world of password management," I concluded, "and there can be little doubt that trust is being tested hard right now." MORE FROM FORBES LastPass Password Vaults Stolen By Hackers-Change Your Master Password Now By Davey Winder The final LastPass hack attack bombshell dropsĪnd then, on March 1, yet another update to the December 22 incident disclosure dropped. This gave the attacker a head start on any attempts to decrypt vaults, as users had been advised that no further action was required up until this point. This wouldn't help anyone with a weak master password in terms of the stolen vaults, of course, so those customers were advised to change all their passwords as soon as possible.Īt this point, I stated that if I were a LastPass user, I'd be looking for alternatives given the drip feed of breach information, especially since it took so long to determine that customer vaults had been stolen. At this point, I recommended that users change their master password, which would also re-encrypt their password vault, based on better safe than sorry. With local access to the encrypted databases, this becomes a lot easier to pull off but is still dependent on the user either having a weakly constructed master password or one reused across services, including one that has been compromised. Unless, of course, they used brute-force methods to try known passwords from other breaches. This meant the attacker now had customer password vaults but not the means to open them. LastPass attacker stole customer password vaults
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |