7 ms·

LastPass: Notice of Security Incident

315 points by marconey 4y ago

bearjaws 4y ago
This is definitely a better example of handling a breach, many others would disclose this years later (if at all) since nothing material has happened or is known to have happened. We're looking at you Twitter / GitHub
aborsy 4y ago
Suppose that LastPass is compromised. What can an attacker do? Passwords are encrypted, with keys on users’ side. Short of serving customers malicious JS code or an app to steal passwords, the production environment referred in the article can be made totally public, without secrets in vaults bring revealed, no?
- advisedwang 4y ago
  I suppose you could phish people into leaking the master password
  - pcthrowaway 4y ago
    Or inject malicious code into the apps/extensions to get users to submit their master passwords
  - eurasiantiger 4y ago
    Maybe sneak in an altered copy of the LastPass app by offering it as a security update by email.
- deleted 4y ago
  [deleted]
DreamFlasher 4y ago
Wouldn't have happened with Bitwarden ;)
- latchkey 4y ago
  More accurately, the source code is exposed all the time... https://github.com/bitwarden https://github.com/bitwarden
- stusmall 4y ago
  That's not a healthy assumption. Breaches can and will happen to anyone and we should assume they eventually will happen to everyone. What matters is how quickly you can detect the breach how limited the impact is. It's still too early to tell exactly whats happening here yet. That said, if this only impacted a development environment that contained no customer data then this is a good example of that principle.
  - cge 4y ago
    I assume it was meant as a bit of a joke with a point, because of the nature of the breach. Here, the concern is that the development environment was breached, and source code and confidential technical details were accessed. Bitwarden is fully open source, both for the client and server, and they also offer docker images to self-host the server. Unlike Lastpass, an attacker gains nothing by stealing the code that the general public doesn't already have. Bitwarden developers argue that this 'source code transparency' is important for such a security system. However, it is at the same time fair to say that there are possible breaches for Bitwarden as well that would involve stealing information, despite being open source. Their website, the securing of the process by which their downloads and updates are produced and distributed, the way the hosting for their web vault is secured...
tylervigen 4y ago
Incident impact and response seems adequate to me. Obviously I’d prefer no incidents, but this with the right layers of security in place to prevent out from impacting users and transparent reporting are the next best thing.
MintDice 4y ago
lawgimenez 4y ago
I liked how I was reading in the middle of the paragraph a "subscribe to our newsletter" popped up. It threw me off my rhythm. Clever.
- lioeters 4y ago
  The best implementation of this delightful UX pattern should shock the reader, make the hair on their back stand up, perhaps jump a little in their seat, and completely forget what they were reading - then immediately close the browser tab with adrenaline and anger.
autoexec 4y ago
Not enough data to say what the impact of this is. Good for them disclosing it early while they investigate. > we have seen no evidence that this incident involved any access to customer data or encrypted password vaults. One way to prevent risk to your passwords in the event of a security breach is to not store them in the cloud at all. KeePass is great!
- irrational 4y ago
  I have 5 laptops, 6 mobile devices and a desktop machine that I am constantly moving between. All of them are ios or macos. I have been using lastpass since it is so simple and works flawlessly. Will keepass work as simply for my use case?
- smt88 4y ago
  Most people use a work machine and a mobile device, so cloud syncing is absolutely necessary. LastPass and its competitors theoretically have zero-knowledge storage of everyone's passwords, so even a full breach of their servers would fail to leak passwords.
  - jrm4 4y ago
    That "theoretically" is carrying significantly more water in this example than is smart to assume.
  - autoexec 4y ago
    > Most people use a work machine and a mobile device, so cloud syncing is absolutely necessary. I keep a password database on the company network with all my work passwords and I have no need to keep a copy of those credentials on a bunch of my personal devices or cloud servers. My personal passwords are stored on my own personal devices. Syncing between them can be done using any number of methods without uploading to the cloud, but even if I wanted to use somebody else's servers to do that a properly encrypted file with a very strong password could be safely stored anywhere, so there's no need to limit myself to one company's servers. I can use whatever works best for my needs and won't have to worry about what I'd do if the one I was using goes under or becomes unavailable. In exchange for a little extra work you gain a ton of utility and resiliency
xenago 4y ago
Not really a big worry, thanks to zero knowledge encryption. Glad it was disclosed. Probably not a fun time over there right now lol
niros_valtos 4y ago
I like the way then handle the communication about the incident. There 2 ways to interpret the message: 1. Someone managed to get access to dev credentials and exfiltrated source code (the part that is explicitly mentioned). 2. Someone managed to push code on behalf of the compromised account and they responded to this change (not mentioned, but otherwise how would they know the account was compromised - each SCM has its logging limitations).
martinky24 4y ago
https://blog.lastpass.com/2022/08/notice-of-recent-security-incident/ https://blog.lastpass.com/2022/08/notice-of-recent-security-... Not good! All a password manager sells is trust. Without that they don't offer anything of value.
larrybud 4y ago
I wish they were more definitive as to if there was (or was not) any compromise of the source code repository credentials. Eg could the attacker have injected malware into the code as in the Solarwinds incident?
- woojoo666 4y ago
  They would have to push an infected update to all the client-side apps, which is something that would be extremely obvious and would have been immediately announced by Lastpass
  - woojoo666 4y ago
    Update: another comment mentioned that the SolarWinds hack was a hijacked download, and companies did not catch on until much later. It seems like companies are not monitoring their releases as much as I'd hoped
theshrike79 4y ago
I switched providers the last time this happened, or was it the one before that. Not a good look for an online password storage service.
- Ecstatify 4y ago
  Same, when I have to change my password for a service I know it's time to leave. Also it's so expensive €2.90/month to basically store text files. Office 365 is €7/month and includes 1TB of storage.
- NoPicklez 4y ago
  As someone else said. Breaches can and will happen to anyone and we should assume they eventually will happen to everyone. What matters is how quickly you can detect the breach how limited the impact is. It's still too early to tell exactly whats happening here yet. That said, if this only impacted a development environment that contained no customer data then this is a good example of that principle.
  - jackdawipper 4y ago
    hacked two weeks ago is what I am seeing. and they are still using words like "probably okay" wherever I look for answers. I havent had an email update from LP since the word salad notification they sent out yday that told me absolutely nothing but vagueries.
- jackdawipper 4y ago
  yea at this point it is about how well it is handled, and transparency of the incident. Currently I am seeing support staff on LP reddit complain about customers attitudes. I am done. moving my partner off LP, I was out to Bitwarden some time back but didnt have a reason to force her into a change, til now.
jrm4 4y ago
For all of its warts, at least crypto has managed to come up with a clever little motto that correctly states the issue, in the form of "not your keys, not your crypto." Putting your passwords in the hands of a third party drastically increases your threat surface and no amount of hand-wavy "but it's not as convenient" will change this fact. Now, it may be true that the convenience factor is very strong right now, but the solution will never be "let's keep hoping real hard that the third parties are good at this." Not unless any of the third parties are willing to take on indemnification or liability. The proper thing to do is to figure out how we can best empower people on their own. I know it's difficult, but that doesn't fundamentally cut into the fact that "this is what SHOULD be done."
- shigawire 4y ago
  My problem is that as an unskilled person - will I be any better at securing my own system?
  - DreamFlasher 4y ago
    No, but there are easy-to-use, reliable and secure solutions, such as Bitwarden.
    - Nextgrid 4y ago
      I don't particularly see why Bitwarden would be any better at defending against this kind of attack, unless you're talking about self-hosting (and I would trust a hosted service more than a non-technical person self-hosting in this case).
      - g_p 4y ago
        And even if you run self-hosted, you're still needing to either audit every line of the web vault (and changes made each time it's updated), or the browser extensions or client applications. Self hosting can help insulate you from a server side bulk compromise (with adequate security measures in place yourself which, as you say, not everyone will do), but it won't deal with the more pervasive software supply chain issues of compromised development environments etc.
mancini0 4y ago
Lesspass generates reproducible unique passwords from inputs (username, domain, masterpassword). It works without an internet connection and is open source. You only need their cloud storage if you want to backup metadata about the password requirements for specific sites (i.e, no special chars allowed by foo.com, bar.com requires a capital letter and a number, etc.) This metadata can also be stored locally. The command line utility is great, they also offer Mozilla / chrome extensions and mobile apps. I bash alias the command line command to copy the password into clipboard so when I navigate to a site on my laptop, I run genp chase or genp amazon and quickly have the pw ready to go in my clipboard. The apps / extensions and even the cli uses emojis as a visual cue to let you know you typed in the correct masterpassword (since it's masked)
- insane_dreamer 4y ago
  so simple even my grandma can do it! ;) in all seriousness, Lesspass has a cool concept (I hadn't heard of them before, just looked at their website now). I'd be interested in hearing what cryptography/security experts think about it.
  - mancini0 4y ago
    Yep I bet she could - don't let the way I described my use of it as a 'poweruser' (via the cli) scare you off...the browser extensions are very user friendly, just ctrl-shift-L and fill out a few inputs
- emerged 4y ago
- roustem 4y ago
  How does it solve the problem with the site is compromised and you are forced to change the password?
  - int_19h 4y ago
    The inputs are domain + username + counter. So you just increment the counter.
MikeKusold 4y ago
If you're looking to move off of LastPass, and your company has a 1Password Business subscription, then you can get a free Family Account. All your data is kept separate from the company, and if you depart you just need to add a credit card. https://support.1password.com/link-family/ https://support.1password.com/link-family/
koheripbal 4y ago
Access to a dev account means they might have pushed out a malicious code update. Huge huge potential loss here for people until they affirm this didn't happen.
whoisjohnkid 4y ago
Hmm, even though LastPass doesn’t have access to your pass, couldn’t a malicious software update cause attacker to view your passwords when it runs since the software ultimately has access? This doesn’t seem to be the case in this incident though.
- jiveturkey 4y ago
  I think you are referring to a malicious client software update. It doesn't even have to be that, since a common way to use LP is just over the web.
- g_p 4y ago
  Yes, absolutely - a compromised development environment might be the first step towards getting implanted code into shipping software, or getting to a signing environment (hopefully highly isolated, but you never know!), with a view to carrying out a supply chain attack. That's basically what happened in the solarwinds compromise.
- NoPicklez 4y ago
  The software has access, but only using your master password which is also encrypted much like the passwords you have within the app. So unlikely.
- woojoo666 4y ago
  Yes it's possible that attackers could release a malicious client-side update but it would be immediately noticed and an alarm would be raised. Also I believe lastpass's client-side apps are open source, making it even more obvious when something is changed
m4jor 4y ago
I wonder if this was nation-state backed hackers or just some rando. I'm guessing nation-state because it seems they stole some source code/R&D. I'd guess China. That's their entire MO. Further the Chinese economy by any means necessary. Why waste years and millions on R&D when you can just steal it? https://www.cbsnews.com/news/chinese-hackers-took-trillions-in-intellectual-property-from-about-30-multinational-companies/ https://www.cbsnews.com/news/chinese-hackers-took-trillions-...
- deepdriver 4y ago
  Allegedly France is also big on industrial espionage, but this doesn’t get as much press since they’re a key NATO ally: https://www.france24.com/en/20110104-france-industrial-espionage-economy-germany-russia-china-business https://www.france24.com/en/20110104-france-industrial-espio...
  - usehackernews 4y ago
    On Lex Friedman’s podcast with former CIA spy Andrew Bustamante, Andrew stated that the French spy agency is the top in the world with this type espionage. He said they put all their resources into industrial espionage and it’s pretty much their only focus.
    - deepdriver 4y ago
      That's where I heard of it too. Apparently this view is shared by others in government as well, as revealed in the Wikileaks diplomatic cable dump.
    - secfirstmd 4y ago
      Israel also very blatantly does it. The US does it also. Can't remember the exact number but contracts above 150 million can occasionally be "helped along" by national level assets.
- g_p 4y ago
  IP theft might also be a distraction for an attempt (perhaps unsuccessful, perhaps undetected as of yet) to gain a foothold in the development environment for introduction of future changes to the client code. For something like a password manager using client side crypto, compromising the software supply chain of the client is an interesting proposition for an attacker.
FridgeSeal 4y ago
I wonder if this is a “precursor” attack to the likes of a solar-winds style compromise? Get into their dev env (ideally unnoticed), exfiltrate the sensitive code you need, poke around their systems. Once you’ve got a handle on their code and have figured out what to add, do so and just begin the waiting game. Maybe that’s all happened, and this attack is “air cover” for the last-stage.
- notmelgibson 4y ago
theknocker 4y ago
dehrmann 4y ago
Didn't we decide to move off LastPasss 5 years ago?
robertwt7 4y ago
there might not be an impact straightaway, however gaining access to source code means that it's easier for hacker to find loophole is it not? lastpass has to be ready for some sort of attacks I guess, it's good that they identified this early
- mr90210 4y ago
  Not really. Take Wordpress as an example, the code is open source, yet the majority of loopholes come from plugins, not really the core. But, we never know.
aceazzameen 4y ago
I'm so glad we switched from LastPass to Bitwarden earlier this year. It seems like every few years there's some kind of breach with LastPass.
- notimetorelax 4y ago
  What advantages does Bitwarden have in terms of security? I’m on LastPass and curious if and why I should switch.
  - Ch4otic 4y ago
    All of the applications (Desktop, Mobile, CLI) and the API itself are completely open source: https://github.com/bitwarden https://github.com/bitwarden
  - aceazzameen 4y ago
    LastPass is a larger target for attacks, which is why there's some kind of breach or security issue with it every few years. It's too often. I already lost trust in them years ago, but was too lazy to switch until this year. BitWarden hasn't had the same issues yet. Plus BW is open source and critical bugs can't be hidden. There's also the option to self-host your data if you want. BitWarden's UX is a little different, and in some ways inferior to LastPass. Sharing passwords with my wife feels convoluted in BW, but it works perfectly fine. You have to create an "organization" where both users join, and then add your sites/pws to. In LastPass you just share it. But I've also found BitWarden works better, especially on mobile. LastPass would fail filling in passwords on some sites, and I'd have to use different autofill methods to get it to fill. But BitWarden doesn't have the same issue and mostly just works. I also like BitWarden's built-in 2FA field for each site's password, which eliminates having to use other authenticator apps. Except you'll still want to use a 2FA app for BitWarden's master password.
alexeiz 4y ago
I've switched to Bitwarden after the first of such incidents and never looked back. More incidents were just bound to happen to LastPass.
greatgib 4y ago
"engaged a leading cybersecurity and forensics firm." This is the current trend each time there is a breach: let's pretend/show that we are serious and waste money taking "security" consultants, that will in the end probably tell us obvious things. Pay more or listen to your own employees instead and eventually go hire competent engineers instead of funding bullshit jobs. Lastpass is supposed to be in the "cyber security" field, so it is a little bit ridiculous to say that you need external help on this subject...
- aldarisbm 4y ago
  Accidents can and will happen. If Lastpass conducted the review it wouldn't be seen as impartial, they need a third party to remain transparent.
- meowface 4y ago
  Security incident response is a very specialized role that the vast majority of not only ordinary tech companies but also security tech companies can't necessarily be expected to do entirely on their own in the event of suspicion of a serious breach. This isn't hiring an auditor or consultant to recommend better security practices but more like a team of world-class detectives, investigators, and forensicists to figure out exactly what happened and how, what they might have done or taken, if they still have or could regain access, and, potentially, ideas as to who or what the culprits may be and what their objectives were. In particular, you want to have as much confidence as possible in what they may have done when they had access to your systems and that they have been effectively shut out and don't have any other access points/backdoors. LastPass undoubtedly also has their own security incident response team - most companies probably should - but it's like the local county PD calling in the FBI when a serious or sophisticated crime occurs.
psygandhi 4y ago
Self-host with Bitwarden I guess?
Aicy 4y ago
Thanks for reminding me to delete my lastpass acount. I switched over to a self hosted bitwarden, and not only is the user experience a lot better, I've got better security confidence since my password store never leaves my home network.
- jackdawipper 4y ago
  it's better in all ways including export and backup solutions
niros_valtos 4y ago
LastPass did very well! Here’s why: https://www.arnica.io/blog/a-first-look-at-lastpass-security-incident-notification https://www.arnica.io/blog/a-first-look-at-lastpass-security...

315 points by marconey 4y ago

This is definitely a better example of handling a breach, many others would disclose this years later (if at all) since nothing material has happened or is known to have happened. We're looking at you Twitter / GitHub

aborsy 4y ago

Suppose that LastPass is compromised. What can an attacker do? Passwords are encrypted, with keys on users’ side. Short of serving customers malicious JS code or an app to steal passwords, the production environment referred in the article can be made totally public, without secrets in vaults bring revealed, no?

advisedwang 4y ago
I suppose you could phish people into leaking the master password
- pcthrowaway 4y ago
  Or inject malicious code into the apps/extensions to get users to submit their master passwords
- eurasiantiger 4y ago
  Maybe sneak in an altered copy of the LastPass app by offering it as a security update by email.
deleted 4y ago
[deleted]

DreamFlasher 4y ago

Wouldn't have happened with Bitwarden ;)

latchkey 4y ago
More accurately, the source code is exposed all the time... https://github.com/bitwarden https://github.com/bitwarden
stusmall 4y ago
That's not a healthy assumption. Breaches can and will happen to anyone and we should assume they eventually will happen to everyone. What matters is how quickly you can detect the breach how limited the impact is. It's still too early to tell exactly whats happening here yet. That said, if this only impacted a development environment that contained no customer data then this is a good example of that principle.
- cge 4y ago
  I assume it was meant as a bit of a joke with a point, because of the nature of the breach. Here, the concern is that the development environment was breached, and source code and confidential technical details were accessed. Bitwarden is fully open source, both for the client and server, and they also offer docker images to self-host the server. Unlike Lastpass, an attacker gains nothing by stealing the code that the general public doesn't already have. Bitwarden developers argue that this 'source code transparency' is important for such a security system. However, it is at the same time fair to say that there are possible breaches for Bitwarden as well that would involve stealing information, despite being open source. Their website, the securing of the process by which their downloads and updates are produced and distributed, the way the hosting for their web vault is secured...

tylervigen 4y ago

Incident impact and response seems adequate to me. Obviously I’d prefer no incidents, but this with the right layers of security in place to prevent out from impacting users and transparent reporting are the next best thing.

MintDice 4y ago

lawgimenez 4y ago

I liked how I was reading in the middle of the paragraph a "subscribe to our newsletter" popped up. It threw me off my rhythm. Clever.

lioeters 4y ago
The best implementation of this delightful UX pattern should shock the reader, make the hair on their back stand up, perhaps jump a little in their seat, and completely forget what they were reading - then immediately close the browser tab with adrenaline and anger.

autoexec 4y ago

Not enough data to say what the impact of this is. Good for them disclosing it early while they investigate. > we have seen no evidence that this incident involved any access to customer data or encrypted password vaults. One way to prevent risk to your passwords in the event of a security breach is to not store them in the cloud at all. KeePass is great!

irrational 4y ago
I have 5 laptops, 6 mobile devices and a desktop machine that I am constantly moving between. All of them are ios or macos. I have been using lastpass since it is so simple and works flawlessly. Will keepass work as simply for my use case?
smt88 4y ago
Most people use a work machine and a mobile device, so cloud syncing is absolutely necessary. LastPass and its competitors theoretically have zero-knowledge storage of everyone's passwords, so even a full breach of their servers would fail to leak passwords.
- jrm4 4y ago
  That "theoretically" is carrying significantly more water in this example than is smart to assume.
- autoexec 4y ago
  > Most people use a work machine and a mobile device, so cloud syncing is absolutely necessary. I keep a password database on the company network with all my work passwords and I have no need to keep a copy of those credentials on a bunch of my personal devices or cloud servers. My personal passwords are stored on my own personal devices. Syncing between them can be done using any number of methods without uploading to the cloud, but even if I wanted to use somebody else's servers to do that a properly encrypted file with a very strong password could be safely stored anywhere, so there's no need to limit myself to one company's servers. I can use whatever works best for my needs and won't have to worry about what I'd do if the one I was using goes under or becomes unavailable. In exchange for a little extra work you gain a ton of utility and resiliency

xenago 4y ago

Not really a big worry, thanks to zero knowledge encryption. Glad it was disclosed. Probably not a fun time over there right now lol

niros_valtos 4y ago

I like the way then handle the communication about the incident. There 2 ways to interpret the message: 1. Someone managed to get access to dev credentials and exfiltrated source code (the part that is explicitly mentioned). 2. Someone managed to push code on behalf of the compromised account and they responded to this change (not mentioned, but otherwise how would they know the account was compromised - each SCM has its logging limitations).

martinky24 4y ago

https://blog.lastpass.com/2022/08/notice-of-recent-security-incident/ https://blog.lastpass.com/2022/08/notice-of-recent-security-... Not good! All a password manager sells is trust. Without that they don't offer anything of value.

larrybud 4y ago

I wish they were more definitive as to if there was (or was not) any compromise of the source code repository credentials. Eg could the attacker have injected malware into the code as in the Solarwinds incident?

woojoo666 4y ago
They would have to push an infected update to all the client-side apps, which is something that would be extremely obvious and would have been immediately announced by Lastpass
- woojoo666 4y ago
  Update: another comment mentioned that the SolarWinds hack was a hijacked download, and companies did not catch on until much later. It seems like companies are not monitoring their releases as much as I'd hoped

theshrike79 4y ago

I switched providers the last time this happened, or was it the one before that. Not a good look for an online password storage service.

Ecstatify 4y ago
Same, when I have to change my password for a service I know it's time to leave. Also it's so expensive €2.90/month to basically store text files. Office 365 is €7/month and includes 1TB of storage.
NoPicklez 4y ago
As someone else said. Breaches can and will happen to anyone and we should assume they eventually will happen to everyone. What matters is how quickly you can detect the breach how limited the impact is. It's still too early to tell exactly whats happening here yet. That said, if this only impacted a development environment that contained no customer data then this is a good example of that principle.
- jackdawipper 4y ago
  hacked two weeks ago is what I am seeing. and they are still using words like "probably okay" wherever I look for answers. I havent had an email update from LP since the word salad notification they sent out yday that told me absolutely nothing but vagueries.
jackdawipper 4y ago
yea at this point it is about how well it is handled, and transparency of the incident. Currently I am seeing support staff on LP reddit complain about customers attitudes. I am done. moving my partner off LP, I was out to Bitwarden some time back but didnt have a reason to force her into a change, til now.

jrm4 4y ago

For all of its warts, at least crypto has managed to come up with a clever little motto that correctly states the issue, in the form of "not your keys, not your crypto." Putting your passwords in the hands of a third party drastically increases your threat surface and no amount of hand-wavy "but it's not as convenient" will change this fact. Now, it may be true that the convenience factor is very strong right now, but the solution will never be "let's keep hoping real hard that the third parties are good at this." Not unless any of the third parties are willing to take on indemnification or liability. The proper thing to do is to figure out how we can best empower people on their own. I know it's difficult, but that doesn't fundamentally cut into the fact that "this is what SHOULD be done."

shigawire 4y ago
My problem is that as an unskilled person - will I be any better at securing my own system?
- DreamFlasher 4y ago
  No, but there are easy-to-use, reliable and secure solutions, such as Bitwarden.
  - Nextgrid 4y ago
    I don't particularly see why Bitwarden would be any better at defending against this kind of attack, unless you're talking about self-hosting (and I would trust a hosted service more than a non-technical person self-hosting in this case).
    - g_p 4y ago
      And even if you run self-hosted, you're still needing to either audit every line of the web vault (and changes made each time it's updated), or the browser extensions or client applications. Self hosting can help insulate you from a server side bulk compromise (with adequate security measures in place yourself which, as you say, not everyone will do), but it won't deal with the more pervasive software supply chain issues of compromised development environments etc.

mancini0 4y ago

Lesspass generates reproducible unique passwords from inputs (username, domain, masterpassword). It works without an internet connection and is open source. You only need their cloud storage if you want to backup metadata about the password requirements for specific sites (i.e, no special chars allowed by foo.com, bar.com requires a capital letter and a number, etc.) This metadata can also be stored locally. The command line utility is great, they also offer Mozilla / chrome extensions and mobile apps. I bash alias the command line command to copy the password into clipboard so when I navigate to a site on my laptop, I run genp chase or genp amazon and quickly have the pw ready to go in my clipboard. The apps / extensions and even the cli uses emojis as a visual cue to let you know you typed in the correct masterpassword (since it's masked)

insane_dreamer 4y ago
so simple even my grandma can do it! ;) in all seriousness, Lesspass has a cool concept (I hadn't heard of them before, just looked at their website now). I'd be interested in hearing what cryptography/security experts think about it.
- mancini0 4y ago
  Yep I bet she could - don't let the way I described my use of it as a 'poweruser' (via the cli) scare you off...the browser extensions are very user friendly, just ctrl-shift-L and fill out a few inputs
emerged 4y ago
roustem 4y ago
How does it solve the problem with the site is compromised and you are forced to change the password?
- int_19h 4y ago
  The inputs are domain + username + counter. So you just increment the counter.

MikeKusold 4y ago

If you're looking to move off of LastPass, and your company has a 1Password Business subscription, then you can get a free Family Account. All your data is kept separate from the company, and if you depart you just need to add a credit card. https://support.1password.com/link-family/ https://support.1password.com/link-family/

koheripbal 4y ago

Access to a dev account means they might have pushed out a malicious code update. Huge huge potential loss here for people until they affirm this didn't happen.

whoisjohnkid 4y ago

Hmm, even though LastPass doesn’t have access to your pass, couldn’t a malicious software update cause attacker to view your passwords when it runs since the software ultimately has access? This doesn’t seem to be the case in this incident though.

jiveturkey 4y ago
I think you are referring to a malicious client software update. It doesn't even have to be that, since a common way to use LP is just over the web.
g_p 4y ago
Yes, absolutely - a compromised development environment might be the first step towards getting implanted code into shipping software, or getting to a signing environment (hopefully highly isolated, but you never know!), with a view to carrying out a supply chain attack. That's basically what happened in the solarwinds compromise.
NoPicklez 4y ago
The software has access, but only using your master password which is also encrypted much like the passwords you have within the app. So unlikely.
woojoo666 4y ago
Yes it's possible that attackers could release a malicious client-side update but it would be immediately noticed and an alarm would be raised. Also I believe lastpass's client-side apps are open source, making it even more obvious when something is changed

m4jor 4y ago

I wonder if this was nation-state backed hackers or just some rando. I'm guessing nation-state because it seems they stole some source code/R&D. I'd guess China. That's their entire MO. Further the Chinese economy by any means necessary. Why waste years and millions on R&D when you can just steal it? https://www.cbsnews.com/news/chinese-hackers-took-trillions-in-intellectual-property-from-about-30-multinational-companies/ https://www.cbsnews.com/news/chinese-hackers-took-trillions-...

deepdriver 4y ago
Allegedly France is also big on industrial espionage, but this doesn’t get as much press since they’re a key NATO ally: https://www.france24.com/en/20110104-france-industrial-espionage-economy-germany-russia-china-business https://www.france24.com/en/20110104-france-industrial-espio...
- usehackernews 4y ago
  On Lex Friedman’s podcast with former CIA spy Andrew Bustamante, Andrew stated that the French spy agency is the top in the world with this type espionage. He said they put all their resources into industrial espionage and it’s pretty much their only focus.
  - deepdriver 4y ago
    That's where I heard of it too. Apparently this view is shared by others in government as well, as revealed in the Wikileaks diplomatic cable dump.
  - secfirstmd 4y ago
    Israel also very blatantly does it. The US does it also. Can't remember the exact number but contracts above 150 million can occasionally be "helped along" by national level assets.
g_p 4y ago
IP theft might also be a distraction for an attempt (perhaps unsuccessful, perhaps undetected as of yet) to gain a foothold in the development environment for introduction of future changes to the client code. For something like a password manager using client side crypto, compromising the software supply chain of the client is an interesting proposition for an attacker.

FridgeSeal 4y ago

I wonder if this is a “precursor” attack to the likes of a solar-winds style compromise? Get into their dev env (ideally unnoticed), exfiltrate the sensitive code you need, poke around their systems. Once you’ve got a handle on their code and have figured out what to add, do so and just begin the waiting game. Maybe that’s all happened, and this attack is “air cover” for the last-stage.

notmelgibson 4y ago

theknocker 4y ago

dehrmann 4y ago

Didn't we decide to move off LastPasss 5 years ago?

robertwt7 4y ago

there might not be an impact straightaway, however gaining access to source code means that it's easier for hacker to find loophole is it not? lastpass has to be ready for some sort of attacks I guess, it's good that they identified this early

mr90210 4y ago
Not really. Take Wordpress as an example, the code is open source, yet the majority of loopholes come from plugins, not really the core. But, we never know.

aceazzameen 4y ago

I'm so glad we switched from LastPass to Bitwarden earlier this year. It seems like every few years there's some kind of breach with LastPass.

notimetorelax 4y ago
What advantages does Bitwarden have in terms of security? I’m on LastPass and curious if and why I should switch.
- Ch4otic 4y ago
  All of the applications (Desktop, Mobile, CLI) and the API itself are completely open source: https://github.com/bitwarden https://github.com/bitwarden
- aceazzameen 4y ago
  LastPass is a larger target for attacks, which is why there's some kind of breach or security issue with it every few years. It's too often. I already lost trust in them years ago, but was too lazy to switch until this year. BitWarden hasn't had the same issues yet. Plus BW is open source and critical bugs can't be hidden. There's also the option to self-host your data if you want. BitWarden's UX is a little different, and in some ways inferior to LastPass. Sharing passwords with my wife feels convoluted in BW, but it works perfectly fine. You have to create an "organization" where both users join, and then add your sites/pws to. In LastPass you just share it. But I've also found BitWarden works better, especially on mobile. LastPass would fail filling in passwords on some sites, and I'd have to use different autofill methods to get it to fill. But BitWarden doesn't have the same issue and mostly just works. I also like BitWarden's built-in 2FA field for each site's password, which eliminates having to use other authenticator apps. Except you'll still want to use a 2FA app for BitWarden's master password.

alexeiz 4y ago

I've switched to Bitwarden after the first of such incidents and never looked back. More incidents were just bound to happen to LastPass.

greatgib 4y ago

"engaged a leading cybersecurity and forensics firm." This is the current trend each time there is a breach: let's pretend/show that we are serious and waste money taking "security" consultants, that will in the end probably tell us obvious things. Pay more or listen to your own employees instead and eventually go hire competent engineers instead of funding bullshit jobs. Lastpass is supposed to be in the "cyber security" field, so it is a little bit ridiculous to say that you need external help on this subject...

aldarisbm 4y ago
Accidents can and will happen. If Lastpass conducted the review it wouldn't be seen as impartial, they need a third party to remain transparent.
meowface 4y ago
Security incident response is a very specialized role that the vast majority of not only ordinary tech companies but also security tech companies can't necessarily be expected to do entirely on their own in the event of suspicion of a serious breach. This isn't hiring an auditor or consultant to recommend better security practices but more like a team of world-class detectives, investigators, and forensicists to figure out exactly what happened and how, what they might have done or taken, if they still have or could regain access, and, potentially, ideas as to who or what the culprits may be and what their objectives were. In particular, you want to have as much confidence as possible in what they may have done when they had access to your systems and that they have been effectively shut out and don't have any other access points/backdoors. LastPass undoubtedly also has their own security incident response team - most companies probably should - but it's like the local county PD calling in the FBI when a serious or sophisticated crime occurs.

psygandhi 4y ago

Self-host with Bitwarden I guess?

Aicy 4y ago

Thanks for reminding me to delete my lastpass acount. I switched over to a self hosted bitwarden, and not only is the user experience a lot better, I've got better security confidence since my password store never leaves my home network.

jackdawipper 4y ago
it's better in all ways including export and backup solutions

niros_valtos 4y ago

LastPass did very well! Here’s why: https://www.arnica.io/blog/a-first-look-at-lastpass-security-incident-notification https://www.arnica.io/blog/a-first-look-at-lastpass-security...