5 ms·
> the attacker(s) had access to privileged credentials that were previously stored in the LastPass account of a Ubiquiti IT employee The interesting part of th
by jniedrauer 6y ago
> the attacker(s) had access to privileged credentials that were previously stored in the LastPass account of a Ubiquiti IT employee
The interesting part of this story is how the employee's LastPass got popped. My guess is their local workstation was compromised, and their LastPass was either not logged out in a browser plugin, or they didn't have 2 factor auth required for each login and a keylogger got the password. In either case, it's a good reminder to be paranoid about your password manager, make sure it's got a logout timer, and use 2 factor auth.
I also don't let my cloud password managers touch a mobile device. It's fairly inconvenient, so I hesitate to recommend this to others. But I don't trust mobile devices very much. Anyone have thoughts on this?
- baybal2 6y agoEasy to imagine they just got a spiked chrome binary installed
- cutemonster 6y agoHow could an attacker make that happen?
- baybal2 6y agoHack the admin machine
- cutemonster 6y ago> My guess is their local workstation was compromised You mean someone was physically at the laptop/desktop and could access the OS and apps? Maybe if the employee was working remote (covid?) from, say, a cafe and left the laptop unattended when refilling coffee? Or something else? ... Hmm, could also have been eg a browser zero day that gave someone remote access to the computer? Or a dev tools supply chain attack?
- hn_throwaway_99 6y agoIt's not that complicated. The local workstation could have had a trojan or virus that installed a keylogger or screengrabber.
- cutemonster 6y agoOk, thanks
- junon 6y agoOr someone watched over their shoulder. 1Password makes it all too easy to accidentally reveal your password within the app. Someone with a video camera just needs one clear frame - 1/60th of a second - with a good enough view.
- seppin 6y agoMost password managers protect against keylogging and screenshots.
- benjaminwai 6y agoOr keylogger?
- rossipedia 6y ago> My guess is their local workstation was compromised Honestly I don't think it was even that complicated, considering when I needed to spend money on some SaaS product the "chief accountant" (because there was no CFO) straight up sent me a photo of the corporate credit card and said "delete that when you're done".
- nhumrich 6y agoSure, but to be fair, credit cards really aren't that dangerous of a credential to wave around. You can cancel your card at anytime, and even dispute the charges. Its like instant key rotation, with a way to also roll back time.
- cutemonster 6y agoAnd they can have monthly spending limits too