4 ms·

This article claims LastPass has responded to their request for comment: https://www.howtogeek.com/776450/lastpass-says-it-didnt-leak https://www.howtogeek.com/

This article claims LastPass has responded to their request for comment: https://www.howtogeek.com/776450/lastpass-says-it-didnt-leak https://www.howtogeek.com/776450/lastpass-says-it-didnt-leak... "LastPass investigated recent reports of blocked login attempts and determined the activity is related to fairly common bot-related activity, in which a malicious or bad actor attempts to access user accounts (in this case, LastPass) using email addresses and passwords obtained from third-party breaches related to other unaffiliated services. It’s important to note that we do not have any indication that accounts were successfully accessed or that the LastPass service was otherwise compromised by an unauthorized party. We regularly monitor for this type of activity and will continue to take steps designed to ensure that LastPass, its users, and their data remain protected and secure."

ksec 5y ago
Finally, if it is indeed not Lastpass's fault and as they say they dont store master password on their server, then there must be a software all these victims have in common. And it has to be fairly common so we could get at least 20 report on a HN thread. Side Note: Interesting all it takes was AppleInsider publishing, getting some sort of traction. And Lastpass had a response within two hours. Edit: This still doesn't make sense though. Unless @gregsadetsky had his computer access full hacked. Otherwise I dont see how his master password could have been stolen. Many of similar reports were from dead account they had a long time ago and wasn't actively being used.
- drakonka 5y ago
  I wonder how high the chance is of the master password itself having been reused, and of one of _those_ password sets getting compromised. Although I'd expect most people using a password manager would not be likely to reuse a master password. On the other hand, my paranoia is now kicking in and I am on my way to change my (non-LastPass) master password, just in case past-me was very stupid a few years ago and then forgot about it...
- gregsadetsky 5y ago
  Yeah, what doesn't make sense is that the emails we all received says: "Someone just used your master password to try to log in to your account from a device or location we didn't recognize" so either: - the email was sent incorrectly i.e. our master passwords were /not/ used to login. In that case, why was the email sent? - the email is correct i.e. someone does indeed have access to our master password (it was confirmed to me by one of the support agents -- that email is supposed to be sent out when the password is correct but used from a new IP) -- in that case, how is it possible that >20 people here were compromised? In addition: - many people here report never using their master password anywhere else - and... not all accounts were old i.e. from 2017. A few accounts were from October/November 2021: https://news.ycombinator.com/item?id=29711950 https://news.ycombinator.com/item?id=29711950 https://news.ycombinator.com/item?id=29710262 https://news.ycombinator.com/item?id=29710262
  - tuwtuwtuwtuw 5y ago
    It does make sense if you consider that there can be more than 1 vulnerability and that some attacker targeting LastPass may use recent password from a fresh vulnerability mixed with older passwords from some previous breach. I'm not actually following what does not make sense.
    - gregsadetsky 5y ago
      What's confusing to me is that my password was never used elsewhere (it was generated only to be used with LastPass and stored in KeePass). Other reports here say that their passwords were unique as well. I just have a doubt right now about the possibiliy that this attack was using passwords from past breaches (which is what LastPass is saying)
      - tuwtuwtuwtuw 5y ago
        But when they are talking about breaches they aren't just referring to other web sites being hacked. In theory, your computer may have been compromised some time during the last years. It was just weeks ago some very popular package on NPM was found to collect credentials. Again, not saying that's what happened but theoretically your computer was breached with some malware which collected credentials. I just meant it "makes sense" from a technical point of view. The likelyhood of this being the issue I am more unsure about.
- tuwtuwtuwtuw 5y ago
  > Unless @gregsadetsky had his computer access full hacked. He stored the LastPass password in KeePass, right? KeePass has had vulnerabilities allowing JavaScript on any web page read secrets from the KeePass storage. I'm not saying that's what happened, but I don't think it's safe to say that "had his computer access full hacked.". There's also plenty of NPM packages and similar which has had vulnerabilities which could have extracted passwords from whatever storage is used. Then it doesn't matter if the account was dead or not. Also, it's not safe to say that "there must be a software all these victims have in common". An attacker can specialize in LastPass and may have purchased several credential lists right? Maybe some credentials were extracted via some vulnerable NPM library, maybe some via KeePass vuln, maybe some from password stuffing. We're just speculating here, but I think what you're saying is a bit too definitive based on what we know so far. To me, LastPass seems a bit like a mess so I would not be surprised if they are to blame though.
  - ksec 5y ago
    Yes and agree, pure speculation / inferring guesses. Based on the assumption the attacker would choose the easiest path. Although I did thought of Keepass leak, but most of the other incidents doesn't use KeePass though. I just wish HN has a show newest comment first, it is bit hard to follow at the moment. >LastPass seems a bit like a mess so I would not be surprised if they are to blame though. Reading that. There is another possibility... no one was hacked..... it was just attacker trying to log in using the wrong password and the email Lasspass generated completely messed up.
aflag 5y ago
So, in other words, they have no idea about what's going on. I'm not sure whether that's good or bad.
trajcek 5y ago
My master password was specifically for LastPass and it's a quite complex non-English language non-dictionary variant. There is no way that it's due to another breach or that it's a dictionary attack.

ksec 5y ago

Finally, if it is indeed not Lastpass's fault and as they say they dont store master password on their server, then there must be a software all these victims have in common. And it has to be fairly common so we could get at least 20 report on a HN thread. Side Note: Interesting all it takes was AppleInsider publishing, getting some sort of traction. And Lastpass had a response within two hours. Edit: This still doesn't make sense though. Unless @gregsadetsky had his computer access full hacked. Otherwise I dont see how his master password could have been stolen. Many of similar reports were from dead account they had a long time ago and wasn't actively being used.

drakonka 5y ago
I wonder how high the chance is of the master password itself having been reused, and of one of _those_ password sets getting compromised. Although I'd expect most people using a password manager would not be likely to reuse a master password. On the other hand, my paranoia is now kicking in and I am on my way to change my (non-LastPass) master password, just in case past-me was very stupid a few years ago and then forgot about it...
gregsadetsky 5y ago
Yeah, what doesn't make sense is that the emails we all received says: "Someone just used your master password to try to log in to your account from a device or location we didn't recognize" so either: - the email was sent incorrectly i.e. our master passwords were /not/ used to login. In that case, why was the email sent? - the email is correct i.e. someone does indeed have access to our master password (it was confirmed to me by one of the support agents -- that email is supposed to be sent out when the password is correct but used from a new IP) -- in that case, how is it possible that >20 people here were compromised? In addition: - many people here report never using their master password anywhere else - and... not all accounts were old i.e. from 2017. A few accounts were from October/November 2021: https://news.ycombinator.com/item?id=29711950 https://news.ycombinator.com/item?id=29711950 https://news.ycombinator.com/item?id=29710262 https://news.ycombinator.com/item?id=29710262
- tuwtuwtuwtuw 5y ago
  It does make sense if you consider that there can be more than 1 vulnerability and that some attacker targeting LastPass may use recent password from a fresh vulnerability mixed with older passwords from some previous breach. I'm not actually following what does not make sense.
  - gregsadetsky 5y ago
    What's confusing to me is that my password was never used elsewhere (it was generated only to be used with LastPass and stored in KeePass). Other reports here say that their passwords were unique as well. I just have a doubt right now about the possibiliy that this attack was using passwords from past breaches (which is what LastPass is saying)
    - tuwtuwtuwtuw 5y ago
      But when they are talking about breaches they aren't just referring to other web sites being hacked. In theory, your computer may have been compromised some time during the last years. It was just weeks ago some very popular package on NPM was found to collect credentials. Again, not saying that's what happened but theoretically your computer was breached with some malware which collected credentials. I just meant it "makes sense" from a technical point of view. The likelyhood of this being the issue I am more unsure about.
tuwtuwtuwtuw 5y ago
> Unless @gregsadetsky had his computer access full hacked. He stored the LastPass password in KeePass, right? KeePass has had vulnerabilities allowing JavaScript on any web page read secrets from the KeePass storage. I'm not saying that's what happened, but I don't think it's safe to say that "had his computer access full hacked.". There's also plenty of NPM packages and similar which has had vulnerabilities which could have extracted passwords from whatever storage is used. Then it doesn't matter if the account was dead or not. Also, it's not safe to say that "there must be a software all these victims have in common". An attacker can specialize in LastPass and may have purchased several credential lists right? Maybe some credentials were extracted via some vulnerable NPM library, maybe some via KeePass vuln, maybe some from password stuffing. We're just speculating here, but I think what you're saying is a bit too definitive based on what we know so far. To me, LastPass seems a bit like a mess so I would not be surprised if they are to blame though.
- ksec 5y ago
  Yes and agree, pure speculation / inferring guesses. Based on the assumption the attacker would choose the easiest path. Although I did thought of Keepass leak, but most of the other incidents doesn't use KeePass though. I just wish HN has a show newest comment first, it is bit hard to follow at the moment. >LastPass seems a bit like a mess so I would not be surprised if they are to blame though. Reading that. There is another possibility... no one was hacked..... it was just attacker trying to log in using the wrong password and the email Lasspass generated completely messed up.

aflag 5y ago

So, in other words, they have no idea about what's going on. I'm not sure whether that's good or bad.

trajcek 5y ago

My master password was specifically for LastPass and it's a quite complex non-English language non-dictionary variant. There is no way that it's due to another breach or that it's a dictionary attack.