Lastpass Says Hackers Accessed Customer Data In New Breach (bleepingcomputer.com) 81
AmiMoJo writes: LastPass says unknown attackers breached its cloud storage using information stolen during a previous security incident from August 2022. The company added that, once in, the threat actors also managed to access customer data stored in the compromised storage service. "We recently detected unusual activity within a third-party cloud storage service, which is currently shared by both LastPass and its affiliate, GoTo," the company said. "We have determined that an unauthorized party, using information obtained in the August 2022 incident, was able to gain access to certain elements of our customers' information." Lastpass said it hired security firm Mandiant to investigate the incident and notified law enforcement of the attack. It also noted that customers' passwords have not been compromised and "remain safely encrypted due to LastPass's Zero Knowledge architecture."
Re: (Score:2)
More likely an encrypted volume. LastPass doesn't store password hashes.
They might be storing payment/billing data
Re: (Score:2)
More likely an encrypted volume. LastPass doesn't store password hashes.
They might be storing payment/billing data
So nothing important then. Just names and credit cards.
Re: (Score:2)
Nothing google doens't already have. :P
Re: (Score:2)
Nothing google doens't already have. :P
At least we can pretty well know Google won't use our CC's.
Re: Data harvesting (Score:2)
Quantum computers aren't some panacea to crypto cracking. It really depends on the particular cryptography. And even when the tech matures, you're not going to carry around quantum computers in your pocket any time soon, if ever. It's going to be relegated to the cloud for some time to come, meaning somebody else is likely to be aware of what you're doing with those quantum computers. By the time the scenario you're dreaming up could even matter, the owners of these passwords will probably be dead. I think
Re: (Score:2)
You don't need a quantum computer in many cases. If the user choose a poor password for their master key, a simple dictionary attack with off the shelf GPUs will suffice.
LastPass are not really telling the truth here.
Re:Data harvesting (Score:4, Informative)
Not with a sufficiently large salt/iterations of PBKDF2, which has been default encrypting behavior for ~20 years
Re: (Score:3)
Re: (Score:2)
That's where the Yubikey comes in handy. Shame that's only for the paid version.
Re: (Score:2)
1Password tries to mitigate this by having the user set aside a secondary key. This is used in addition to the user's passphrase to get access. It sounds cumbersome, but saving the key aside isn't difficult, and it acts like a client side keyfile, ensuring that if someone snarfed 1Password's database, brute forcing it is pretty much impossible, because every generated secondary key is 256 bits.
Re: (Score:2)
Hashes are one way. For a PW manager to be able to save passwords, it needs to be able to save the actual password, and not just a hash.
I wish LastPass and Keeper did what Codebook and 1Password do. Both, when one creates an account or sync repository generate a random key. Once generated, it is up to the user to keep that key safe, and neither Codebook or 1Password have that key stored. It is used in addition to the user's password to decrypt stored passwords.
Why is this such a good thing? If someone
They are toast (Score:2)
...this is their last pass.
Again? (Score:4, Insightful)
Re:Again? (Score:4, Informative)
Re: (Score:2)
Re: (Score:2)
VaultWarden is nice, but you can do pretty well with just KeePass compatible apps. If you use keyfiles, this ensures that what cloud repository the .kdbx file is on, it will remain secure, as if an attacker grabs the database, they not just have to guess your password, but also what was in the keyfile.
Alternatively, Codebook is nice, as it offers a sync key.
Re: (Score:2)
Re: (Score:3)
So they had a security breach a while back, but no customer data was exposed.
Now, months later, they're saying that customer data was exposed.
What are they going to say next? You can call it FUD, but if your entire business is keeping customer data secure and you didn't do that, you're a total failure who isn't deserving of my money. And then when you initially lie about that failure only to fess up later, you've done actual harm to customers that could have taken measures to protect themselves MONTHS AGO
Re:Again? (Score:4, Insightful)
They're not saying customer data was exposed in August. They're saying that data gathered in August (like system configurations or employee info) was used to enable a new breach that did expose customer data. Unless you have evidence they're lying, it seems like they're being very forthcoming and upfront.
Re: (Score:2)
Oh so they didn't bother investigating what could be done with the data that was exposed, and said "this is fine" while the house burned around them.
That's so much better.
Re: (Score:2)
That's a pretty dumb statement. If there was a vulnerability they knew about, I'd guess they'd try to fix it. Sounds like they did an investigation.
Re: (Score:2)
It's FUD. They had a security breach and no customer data was exposed. What was exposed was then used to enable this breach, in which some customer data was exposed. You seem to think the 2 are one in the same when they are not. And more importantly, password data was not exposed in either breach, which is actually their entire business.
Re: (Score:2)
Oh so they didn't bother investigating what could be done with the data that was exposed, and said "this is fine" while the house burned around them.
That's so much better.
What's to say they won't use data from this breach to go even further in a third, because clearly LastPass isn't in the business of learning from past mistakes, and you seem fine with that.
Re: (Score:2)
Because they are a paid service they have your name, address, and billing info. And now so do the hackers.
Zero Knowledge architecture? (Score:2)
> remain safely encrypted due to LastPass's Zero Knowledge architecture
It just occurred to me, maybe i'm late to the party ... but, If Lastpass has a zero knowledge architecture, could it be used as an encrypted chat system if e2e encrypted chats, like signal, are forced (due to regulation) to have a back door?
Will password managers like Lastpass or or self hosted ones like Bit Warden or Vault be the next place for criminals to communicate (since that's the whole rational for wanting a back-door e2e encr
So could Slashdot posts. And no. (Score:4, Informative)
> could it be used as an encrypted chat
Yes, any communication tool and any cloud service CAN be used to pass encrypted messages. After all:
The cat ate the grapes. What does that mean? Nobody knows without the key.
And besides, 8911 54dd 25d25 eb7a 0fae e16.
It's trivially easy to send encrypted messages using any platform or protocol that posts / sends whatever you type / paste.
> Will password managers like Lastpass or or self hosted ones like Bit Warden or Vault be the next place for criminals to communicate
No. They are particularly ill-suited for that purpose.
They would be a poor choice both in terms of practical use and also security. They are a poor choice simply because it's not a messaging platform. There's no contact list or anything. There's no notification that you received a new "message", etc.
They are also particularly poor for security, because to either read or update the password (message), you need to have THE master key/password. You'd have to share the master password with whomever you're communicating with! That makes the entire idea mostly useless. That's like sending an email with a password protected zip file and saying "unzip this file using the password "Kaboom". Well that's pointless, because anyone who sees the message has the password.
Encrypted messaging apps such as Whatsapp and Signal don't have *A* key for the conversation, used to encrypt and decrypt it. They have a total of FOUR keys. When I send you a Whatsapp message, I use your public key. The essential thing to understand here is that the public key, which I use to encrypt the message, can NOT be used to decrypt it! That means I can send you an encrypted message, without including the decryption key in the message.
You send me your public encryption key, and keep your decryption key private. That's how Whatsapp provides secure messaging, while LastPass doesn't. Lastpass and other password managers are secure only for sending messages to yourself, where you don't have to communicate the master password to someone else.
Dumb idea in the first place. (Score:4, Insightful)
Using cloud-based passwords managers, while convenient, is an absolutely dumb idea in the first place. You hand over all your passwords to a single entity, creating a single point of failure. At the same time, there is no way for you to verify that there is no backdoor built into their zero-knowledge encryption scheme. Zero-knowledge only means that the encryption key is secured with a unique user key not known to the provider. It doesn't preclude the existence of another provider-specific encryption key to the same data set. It's the provider who builds the service and they can do absolutely everything they want without your knowledge.
Re: (Score:2)
Re: (Score:2)
Something like Yubi where its a challenge response and the password is not stored on any server or any device where the private key can be directly read is the best.
Having the same password on 2 servers is not good, unless you don't care that they get your password, but having a central point of failure where if compromised a hacker now knows the sites you log into and all the passwords you and for millions of other uses is not good either. Its really a case of pick your poison.
Re: (Score:2)
As demonstrated many times even with open source security is hard. So who are these knowledgeable people rushing to audit everything? Certainly not their advocates.
Re: (Score:2)
No.. It's not a dumb idea At all. It is just imperfect. It is still a huge improvement over the alternative people use otherwise - which is making memorable but weaker passwords and reusing the same password on multiple websites.
And the real solution is to not have passwords at all. Use Passkeys [apple.com] Or rather Security Keys [google.com]
Also, Have the authentication undertaken through dedicated OAuth providers such as Apple or Google. There's no reason every website in the world need to implement their own (bad)
Re: (Score:3)
1. What if I don't use Apple or Google? (I don't)
2. What if I don't want Google or any other big company to know what other services around the Internet I use? (they would if they did auth)
3. Passkeys are terrible if you're forced into scanning your face or unlocking your phone, like many authorities around the globe ask you to.
4. Again, single point of failure.
5. Most passkey schemes refuse to work on rooted phones due to security implications. (I use rooted devices myself).
Re: (Score:2)
I use a gmail account made specifically for my mobile phone. All other services go through a certain Switzerand-based, privacy-friendly email provider. The mobile email account is basically there just so that the system works and not used for anything else, ever.
Re: (Score:2)
No - it's dumb right from the beginning.
Using cloud you are losing control of your data. Zero knowledge just makes it more difficult to crack.
With encryption standards historically backdoored, side channel attacks on shared cloud hardware, and brute force cracking capabilities becoming stronger your handing over your data to not only 'authorities' who simply cannot be trusted to act legally, but to OTHER parties who may gain access to that data.
Only smart storage for sensitive information is offline storage
Re: (Score:2)
If you're that paranoid you shouldn't have any passwords anyway because you shouldn't be using any online stuff. After all, the same 'authorities' could just break the encryption of whatever connections you have and steal your passwords that way.
Re: (Score:2)
Bingo.
As for me, if some government took the time to check out my browsing history and whatnot, they'd be bored to tears.
"Oh my god, this fuckin' dick is looking at goddamn belt sanders again? Jesus Christ just kill me now..."
Re: (Score:2)
With encryption standards historically backdoored,
Good thing they used modern crypto that isn't backdoored.
side channel attacks on shared cloud hardware,
Side channel attacks on cloud hardware aren't a concern, seeing as all the Crypto is client-side, and the server doesn't get the keys to decrypt the data - that's what zero knowledge means. If there's a concern, then it would have to be about malicious code running on the client.
and brute force cracking capabilities becoming stronger your handing over y
Re: (Score:3)
Depends on what I am wanting to secure. If someone is going to do a side channel attack on my PC at home which has a decent tier of LUKS, BitLocker + TPM, or FileVault, then I'm screwed from the get-go.
The perfect is the enemy of the good in this case. There are many ways to keep passwords secure:
1: Use a cloud provider like Dropbox, use something like KeePass, KeePassxc, Strongbox, or some app that works with the .kdbx format, have all the endpoints (phones, PCs), all use a keyfile which isn't stored on
Re: (Score:2)
1. Trusting Apple with every last ducking detail of your life. (wallet, health, geolocation,etc)
2. Trusting anyone with your biometric data.
Single point of failure. No oversight.
Apple (all companies) will keep your data private, except they will share it with any of their trusted partners or authorized law enforcement. Please note the contradiction. Resulting in practice, that anything that moves over the internet is de-facto public domain information because it's so widely shared with "trusted
Re: (Score:2)
I don't want my entire existence tied to Apple, Google, Amazon, Meta, or whatnot. I've seen people in a world of hurt because they lost access to their Facebook account, and had all their stuff authenticate using it. Stories abound about people getting locked out from Apple, Google, etc... and with thousands of dollars spent on apps and other items, having that is expensive.
Best thing are MFA mechanisms. Ask for the username, ask for a password, ask for what 2FA token to use... and this option should at
Re: (Score:3)
I think it's fine as long as you control the software. For example, Keepass allows you to keep a copy of the database (fully encrypted) in cloud storage.
You can be sure the key isn't shared or backdoored. You have a local copy. You don't have to give the cloud provider your real details, or you can run your own "cloud".
Single Point of Failure Unavoidable (Score:5, Insightful)
You hand over all your passwords to a single entity, creating a single point of failure.
It's inevitable that your password storage will have a single point of failure. Even if you have enough technical know-how to setup your own secure, encrypted repository that's still a single point of failure and if you never tell anyone your passwords your own brain becomes that single point of failure.
So really the question is whether you trust a provider like LastPass more than yourself to securely manage your password data. There I would compare it to banks. There is a good reason why most of us trust banks to look after our money and we don't keep it all stuffed under our mattresses or even in a home safe.
Re: (Score:2)
Re: (Score:2)
FDIC does not protect against being hacked, it protects against the bank becoming insolvent. The bank probably has other, independent, insurance against being hacked or robbed, but it isn't the FDIC.
Re: (Score:2)
Re: (Score:2)
Banks are FDIC insured
Faire enough but there is a limit on government insurance. I don't know what it is for the US but here in Canada it is $100k. So let's consider very rich people. Do you think they keep huge amounts of money stuffed in their mattress instead of in the bank even if only a fraction of it is insured by the government? I doubt it so you can't really argue that government insurance is the primary reason why people keep money in banks.
Second banks interface with the real world. You need to pay and get paid.
That is an additional function of banks but, if you fundamentally did not trus
Re: (Score:2)
Re: Single Point of Failure Unavoidable (Score:2)
Re: (Score:2)
Backups of what? Your brain? Did you even read the post you responded to?
Re: (Score:2)
You can backup from cloud providers too.
More that one way to fail (Score:3)
A single point of failure means that only one thing has to fail before there is a problem. It does not mean that there is only one way for that one thing to fail.
Re: (Score:2)
Re: (Score:2)
Cloud st-whore-age has never really been all that "safe", no matter who is providing what.
Always wrap (encrypt) your shit before sticking it in some online hole run by an internet byte pimp.
Re: (Score:2)
sticking it in some online hole run by an internet byte pimp.
I just found my new online persona...Internet Byte Pimp!
Re: (Score:2)
Re: (Score:2)
You're right - there's none. The sync requirement forces you into the cloud.
However, a thing to consider, is that you should never have one online password manager account for your entire family. If needs be, every single user should have their own, private account with cross-account shared passwords in very few, limited cases.
Re: (Score:2)
"It doesn't preclude the existence of another provider-specific encryption key to the same data set."
More simply, they can see every page output they send you and every input you send them, if they want. So it would be trivial to simply skim off all that data while it's in transit.
Re: (Score:2)
You're now 100% dependent on them.
Re: (Score:2)
Using cloud-based passwords managers, while convenient, is an absolutely dumb idea in the first place. You hand over all your passwords to a single entity, creating a single point of failure.
I simply don't see any alternative for sharing passwords between (1) laptop, (2) phone, (3) wife's laptop, (4) wife's phone. I view this kind of sharing as table-stakes.
Re:Dumb idea in the first place. (Score:4, Interesting)
Keepass. Open source, encrypted in your end. Use a free or home made cloud server for storage, so that if it gets hacked they don't get your billing details.
Re: (Score:2)
Eh that's the same thing just requires you to maintain a server. No one has yet to get a password from Lastpass despite all the doomsayers
Re: (Score:2)
The people who hacked Lastpass probably have your billing details though. Name, address, maybe CC number and other data needed to authorize recurring payments. Your email address too.
You can create an anonymous MEGA account and use that to store your encrypted Keepass file. Use a throwaway @mailinator.com email address.
Re: (Score:2)
Possibly, though if they were storing it correctly they wouldn't have most payment data on the same systems, not to mention most customers don't even have payment data with them. That vast majority of people are still probably better off using an established cloud service than rolling their own with the exception of a few people that are already maintaining servers.
Re: (Score:2)
"You hand over all your passwords to a single entity, creating a single point of failure."
Exactly, and that's why I won't use a web-based password manager.
Services like LastPass are super-juicy targets for bad actors. If you know anything about the internet then you know it's inevitable that they'd be compromised sooner or later.
This is old news (Score:3)
Re: (Score:2)
Oh, then everything must be fine then.
A company who's sole business offering is protecting customer data, leaked customer data. And then they didn't bother telling their customers that their data was leaked, instead offering weak shit platitudes instead of being honest. But hey, they all took security training after they completely failed in their mission, so I'm supposed to trust them now?
Fuck that.
Re: (Score:2)
Private Equity Buys -- Quality goes down (Score:3, Insightful)
Between horrible interface changes, buggy plugin and apps, then creating high subscription charges on the assumption they could milk the client base too lazy to move. All they did was motivated a ton of customers to finally migrate to better platforms and piss over the very users who likely got them enterprise contracts.
Not at all surprised this happened again to LastPass, the new owners have to figure out a way to make money after leveraging it.
Local Beats Cloud Password Management (Score:2)
Re: (Score:2)
I would... (Score:1)
Did URL's get stolen? (Score:2)
At least when I left LastPass the account URL's were being sent in the clear, not TNO encrypted. Metadata leaks are a huge problem.
https://hackernoon.com/psa-las... [hackernoon.com]
ZK has a specific meaning in crypto which is also sketch that they're misusing the term.
It's just too enticing a target. (Score:2)
How Ironic, LastPass's Zero Knowledge architecture (Score:2)
Cancelled? (Score:2)
Lastpass hired Mandiant to investigate (WTF) (Score:1)
“We have this category that Equifax calls unhandled malware, [with] which traditional security approaches haven’t been very helpful. Putting in FireEye has really helped us detect this unhandled malware [cnmeonline.com], then gives us the capability to take action to stay secure.”