5 ms·

Wait a second. I mean it's nice and all that LastPass was being overly cautious. But how reassuring is it that they noticed an anomaly but weren't able to fig

by arn 15y ago

Wait a second. I mean it's nice and all that LastPass was being overly cautious. But how reassuring is it that they noticed an anomaly but weren't able to figure out what it was? And this is a serious question, as I'm no expert in the field, but it seemed strange to me that they couldn't explain what actually happened with any certainty.

Joakal 15y ago
If they were logging access logs, the logs may have not shown what was accessed specifically in a program. Just ip addresses connecting to machine/software but no request disclosure. They have reasonable suspicion to be overly cautious: "After delving into the anomaly we found a similar but smaller matching traffic anomaly from one of our databases in the opposite direction (more traffic was sent from the database compared to what was received on the server)." I hope they explain how they are going to resolve this for the future.
crcastle 15y ago
I would bet that many of us who manage servers have multiple anomalies in logs we can't explain, but we just don't scan our logs in enough detail to find the anomalies in the first place. The fact that LastPass has methods to notice small anomalies like this is reassuring.
mcherm 15y ago
Here is an attempt to answer your serious question. When was the last time that you "could have sworn" that you left your keys on the desk, but they're on the counter instead. Suppose that happened; it almost certainly means you just misremembered where you left your keys, but there is a TINY chance that someone might have stolen the keys, copied them, and put them back in the wrong place. Just to be 100% certain, you immediately call a locksmith, and get your locks changed. And all the neighbors start talking about how poor you are at security for having allowed a burglar into your house. THAT would be a reasonable analogy for what LastPass did.
- arn 15y ago
  Yes, I didn't need an analogy. I wanted to know why, in a secure house which presumably had cameras and sign in sheets, why couldn't they review the video tapes to see if someone had actually taken the keys or not. (to extend your analogy)
  - swombat 15y ago
    And they do - and the cameras and sign sheets didn't explain the mysterious key movement. So they're replacing the locks.
  - lurkinggrue 15y ago
    The traffic is encrypted and they couldn't read it.

by arn 15y ago

Joakal 15y ago

If they were logging access logs, the logs may have not shown what was accessed specifically in a program. Just ip addresses connecting to machine/software but no request disclosure. They have reasonable suspicion to be overly cautious: "After delving into the anomaly we found a similar but smaller matching traffic anomaly from one of our databases in the opposite direction (more traffic was sent from the database compared to what was received on the server)." I hope they explain how they are going to resolve this for the future.

crcastle 15y ago

I would bet that many of us who manage servers have multiple anomalies in logs we can't explain, but we just don't scan our logs in enough detail to find the anomalies in the first place. The fact that LastPass has methods to notice small anomalies like this is reassuring.

mcherm 15y ago

Here is an attempt to answer your serious question. When was the last time that you "could have sworn" that you left your keys on the desk, but they're on the counter instead. Suppose that happened; it almost certainly means you just misremembered where you left your keys, but there is a TINY chance that someone might have stolen the keys, copied them, and put them back in the wrong place. Just to be 100% certain, you immediately call a locksmith, and get your locks changed. And all the neighbors start talking about how poor you are at security for having allowed a burglar into your house. THAT would be a reasonable analogy for what LastPass did.

arn 15y ago
Yes, I didn't need an analogy. I wanted to know why, in a secure house which presumably had cameras and sign in sheets, why couldn't they review the video tapes to see if someone had actually taken the keys or not. (to extend your analogy)
- swombat 15y ago
  And they do - and the cameras and sign sheets didn't explain the mysterious key movement. So they're replacing the locks.
- lurkinggrue 15y ago
  The traffic is encrypted and they couldn't read it.