5 ms·

Same thing for me. I last changed my master password on Oct 4 2021. password never used elsewhere and stored only in my head, which makes me suspect a bad chrom

Same thing for me. I last changed my master password on Oct 4 2021. password never used elsewhere and stored only in my head, which makes me suspect a bad chrome extension. ``` Someone just used your master password to try to log in to your account from a device or location we didn't recognize. LastPass blocked this attempt, but you should take a closer look. Was this you? Account xxx@xxx.com Time Monday, December 27, 2021 at 12:06 PM EST Location Berlin, BE 12529, GERMANY IP address 196.19.169.161 ```

tuwtuwtuwtuw 5y ago
Maybe you could share the list of extensions you use, unless you consider it too private? I haven't gotten any email like this myself and in my organization with 20 LP users no one else has as well it seems. I am using uBlock Origin and LastPass only.
ksec 5y ago
So they are using your "newer" password from Oct 2021? Because all the previous incident seems to relate to very old password usage dated back in 2017. If so then it is big, very big. Could it be log4J? Edit: 12 hours later still no update or response from LastPass.
- gregsadetsky 5y ago
  At least another reported incident in this thread is from someone who registered their account in November of this year...! https://news.ycombinator.com/item?id=29710262 https://news.ycombinator.com/item?id=29710262 (I ask them to confirm whether they mean November 2021 and further down in the thread, they confirm that) And yes, if it's a recent attack -- that's very troubling. (and would be more probable than an attacker sitting on passwords for 4 years)
palant 5y ago
It’s unlikely to be due to a browser extension. A browser extension that can steal your master password can steal all the other passwords as well, it doesn’t need LastPass for that. More importantly, an extension can only steal your master password when it is used – yet several people reported not having used LastPass for a year or more. It’s still not impossible that an extension has been stealing master passwords for years only for them to be used now, it’s merely unlikely. Judging by the reports here, the source of the leak appears to be LastPass after all. Given that most people write about old accounts, my original suspicion was https://palant.info/2018/07/09/is-your-lastpass-data-really-safe-in-the-encrypted-online-vault/ https://palant.info/2018/07/09/is-your-lastpass-data-really-... – from all I know, LastPass never investigated whether that websiteBackgroundScript.php issue was already being abused. It was obvious enough that someone might have discovered it independently of me. If on the other hand you changed your master password recently (and someone had a login attempt on a brand new account) then this theory is moot. While I am aware of a number of LastPass design flaws (see https://security.stackexchange.com/questions/45170/how-safe-are-password-managers-like-lastpass/137307#137307 https://security.stackexchange.com/questions/45170/how-safe-...), none of them could be the culprit here. It must be something new then. The weird thing: LastPass must have stored unencrypted passwords somewhere, because reversing 100,000 rounds of PBKDF2 wouldn’t have allowed such large-scale attacks.
- Havoc 5y ago
  >Given that most people write about old accounts, my original suspicion No - there are now reports of same thing happening with recent changes to password https://twitter.com/Valcristerra/status/1475734357805572098 https://twitter.com/Valcristerra/status/1475734357805572098
  - palant 5y ago
    Yes, I’ve already seen this. I’ve written https://palant.info/2021/12/29/how-did-lastpass-master-passwords-get-compromised/ https://palant.info/2021/12/29/how-did-lastpass-master-passw... discussing the possibilities here. So far the most likely suspicion is that LastPass infrastructure is compromised and a pass-the-hash attack is going on.

tuwtuwtuwtuw 5y ago

Maybe you could share the list of extensions you use, unless you consider it too private? I haven't gotten any email like this myself and in my organization with 20 LP users no one else has as well it seems. I am using uBlock Origin and LastPass only.

ksec 5y ago

So they are using your "newer" password from Oct 2021? Because all the previous incident seems to relate to very old password usage dated back in 2017. If so then it is big, very big. Could it be log4J? Edit: 12 hours later still no update or response from LastPass.

gregsadetsky 5y ago
At least another reported incident in this thread is from someone who registered their account in November of this year...! https://news.ycombinator.com/item?id=29710262 https://news.ycombinator.com/item?id=29710262 (I ask them to confirm whether they mean November 2021 and further down in the thread, they confirm that) And yes, if it's a recent attack -- that's very troubling. (and would be more probable than an attacker sitting on passwords for 4 years)

palant 5y ago

It’s unlikely to be due to a browser extension. A browser extension that can steal your master password can steal all the other passwords as well, it doesn’t need LastPass for that. More importantly, an extension can only steal your master password when it is used – yet several people reported not having used LastPass for a year or more. It’s still not impossible that an extension has been stealing master passwords for years only for them to be used now, it’s merely unlikely. Judging by the reports here, the source of the leak appears to be LastPass after all. Given that most people write about old accounts, my original suspicion was https://palant.info/2018/07/09/is-your-lastpass-data-really-safe-in-the-encrypted-online-vault/ https://palant.info/2018/07/09/is-your-lastpass-data-really-... – from all I know, LastPass never investigated whether that websiteBackgroundScript.php issue was already being abused. It was obvious enough that someone might have discovered it independently of me. If on the other hand you changed your master password recently (and someone had a login attempt on a brand new account) then this theory is moot. While I am aware of a number of LastPass design flaws (see https://security.stackexchange.com/questions/45170/how-safe-are-password-managers-like-lastpass/137307#137307 https://security.stackexchange.com/questions/45170/how-safe-...), none of them could be the culprit here. It must be something new then. The weird thing: LastPass must have stored unencrypted passwords somewhere, because reversing 100,000 rounds of PBKDF2 wouldn’t have allowed such large-scale attacks.

Havoc 5y ago
>Given that most people write about old accounts, my original suspicion No - there are now reports of same thing happening with recent changes to password https://twitter.com/Valcristerra/status/1475734357805572098 https://twitter.com/Valcristerra/status/1475734357805572098
- palant 5y ago
  Yes, I’ve already seen this. I’ve written https://palant.info/2021/12/29/how-did-lastpass-master-passwords-get-compromised/ https://palant.info/2021/12/29/how-did-lastpass-master-passw... discussing the possibilities here. So far the most likely suspicion is that LastPass infrastructure is compromised and a pass-the-hash attack is going on.