6 ms·

Hey, I'm the OP from yesterday's story. A few people and I are trying to chase down which software in common could have resulted in our passwords being stolen.

Hey, I'm the OP from yesterday's story. A few people and I are trying to chase down which software in common could have resulted in our passwords being stolen. The most egregious and hard-to-understand related cases (now 3!): https://twitter.com/Valcristerra/status/1475734357805572098 https://twitter.com/Valcristerra/status/1475734357805572098 "Someone tried my @LastPass master password earlier yesterday [Dec 27] and then someone just tried it again a few hours ago after I changed it. What the hell is going on?" https://twitter.com/shift_plusone/status/1475959354742525956 https://twitter.com/shift_plusone/status/1475959354742525956 "Exactly the same thing happened to me last night. They tried again literally minutes after I changed the password to something not used on any other form." https://twitter.com/Pablohere/status/1475966760130125828 https://twitter.com/Pablohere/status/1475966760130125828 "I had this same thing happen to me. Saw attempts yesterday, changed password last night to random generated pass from pass utility and had attempts today again from different countries." --- I saw a few mentions of uBlock origin in yesterday's thread. I definitely might have used it in 2017 (the last time when my compromised LastPass password was used). Could people that received the "Someone just used your master password to try to log in to your account from a device or location we didn't recognize" email please reply and confirm whether or not they have the uBlock origin extension installed? The other alternative is for the LastPass extension itself to have been compromised (and to still be..?). There are other alternatives as well (some clipboard sniffing malware for example). Let's try to rule out uBlock if possible. Thanks!

pfg 5y ago
I've been using LastPass for work since mid-2018 as well as uBlock origin for Chrome; no blocked login notification so far.
gruez 5y ago
>I saw a few mentions of uBlock origin in yesterday's thread Statistically speaking it's probably because everyone has ublock origin installed, rather than it getting hacked. It's used by 5M+ users on firefox and "10,000,000+" on chrome. If ublock was really compromised you'd expect widespread reports of account compromise, rather than for only one password manager.
- gregsadetsky 5y ago
  That's a good point. I'm happy to delete my message if this way of finding out doesn't make sense.
  - azinman2 5y ago
    Because it’s popular makes it an even bigger target.
- ksec 5y ago
  Yes that is what is so weird about the whole thing. 1. If LastPass has been compromised, the scale of these attack would have been tens of thousands times higher. But it isn't. And I think it is reasonable to trust and assume Lastpass does not hold the masterpassword, as they have stated. 2. If it was browser extension, and clipboard sniffing, the scale would have been higher as well. But it is important to note there are many reports of those password have not been used for 3-4 years. They would have sat on a drove of password and decide today is the day. And yet report of these attacks, while scary, are still very very limited. 3. It is hard make a guess without everyone posting their OS, Computer, Browser, extensions, list of software, and even Router, Location, Network ( MITM ? ) etc. 4. We have tested the theory of Lastpass triggering the wrong email notification even with wrong password. So far doesn't seems to be the case here. 5. Nearly all reported cases are unique passwords. ( A few didn't specify ) 6. There was a case where the whole Lastpass App and passcode was stored on an old laptop which hasn't been used for a long long time. 7. And yet there are also cases where account was only created in October / November this year. Meaning this activity is fairly recent. ( Doesn't rule out they could be two independent leaks or attack ) 8. I was expecting someone working in InforSec would jump in, but I guess they are all on holiday at the moment. 9. This happened just after LogMeIn announced they will spin off Lastpass. I am thinking of the incident with Ubnt where the actual problem was internal, an employees hacking their own companies for bitcoin or something. Still I dont know how any Lastpass staff, without storing any Masterpassword could have gained access to it. 10. For now this doesn't seem like a coordinated PR attack on LastPass. If it was, seriously guys you need to do a better job with Social Media marketing. :P Anyway It is an interesting thread to watch.
caconym_ 5y ago
I'd be pretty surprised if uBlock Origin had been exfiltrating data since 2017 without being caught, and (as the sibling comment points out) I'd expect a lot more than LastPass to be compromised. I think it exists at an intersection of (relatively) trustworthy and necessary that makes it extremely popular among the kinds of people participating in these discussions.
johtso 5y ago
It still seems that the most likely answer might be that lastpass are incorrectly alerting that someone's correct passphrase had been used, and that the email is being triggered by a bug, or something like a login attempt using the wrong password from a suspicious IP. The fact that lastpass support says that it means that the correct password was used doesn't mean it's true, the support staff might just be mistaken.
- johtso 5y ago
  Seems like this was infact the case: "Our investigation has since found that some of these security alerts, which were sent to a limited subset of LastPass users, were likely triggered in error. As a result, we have adjusted our security alert systems and this issue has since been resolved."
- gregsadetsky 5y ago
  I agree that's a possibility i.e. false positive emails. Counterpoints: - LastPass officially responded to this story by saying that all of our passwords were compromised elsewhere and then someone attempted to login with those i.e credentials stuffing. If it was a false positive email, it would have been easier to say that and a lesser reputation hit on them. Right now, they're saying "oh yeah those passwords were valid -- it's just that the attacker got them somewhere else, we weren't breached." - The (now 3!) twitter reports mentioned in https://news.ycombinator.com/item?id=29719033 https://news.ycombinator.com/item?id=29719033 point out that someone attempted to login again after they changed their password. They received the "Someone just used your master password" email a 2nd time. If those emails are not false positives (per LastPass), how could that have happened?
- theunquietone 5y ago
  Agree here.
- eksployted 5y ago
  That's what I was hoping, but I tested it. Used a VPN endpoint in a country that would surely get blocked. Attempted to login with wrong password, did not receive email. Logged in with correct passphrase, received email. Both scenarios looked the same on the login screen, so there wasn't any indication that I logged in with the correct password if I were the attacker edit: last night they released something that says they sent some of those emails in error. I hope that is the case, but it's still not very re-assuring. I went through and changed all of my financial/critical accounts yesterday in precaution, today my bank account was locked out from brute force. Could be a coincidence, but that is the first time it's ever happened with that account
blitzar 5y ago
My money is on compromised hardware, someone has bought the stealer logs and tried to scrape the whole lot at once. If you got it, assume you have malware and all your passwords you have entered have been captured.
- gregsadetsky 5y ago
  I agree that active malware is still a possibility. However: I was in touch with a security researcher on Twitter who has access to the RedLine Stealer stolen credentials. Neither my email nor LastPass password (the one that was compromised) were in there. The researcher looked for another email/password (of someone else affected who reported it here on HN and contacted me via email) and no result as well.
- theunquietone 5y ago
  Best way to confirm this?
  - blitzar 5y ago
    10's of GB of credential data is being harvested daily, and personally I think these stealer logs are the greatest security threat at the moment <insert usual lecture about 2fa / unique passwords here>. To confirm, you would have to basically get access to all the stuff that has been sold, as the malware is pretty widely sold and distributed it is effectively ad infinite data set, and constantly growing. A previous responder checked with a security researcher who has a Redline Dataset and was not in there. Some of the annecdotes suggest it is from an old breech likely before 2020. Given the age and how these things get bought / sold / compiled into bigger datasets, there is a fair chance that researchers have the data and hopefully lastpass can dig into it to find the source.
kevinslashslash 5y ago
I'm one of the people that replied yesterday. I haven't used LastPass since, at the latest, 2017. I had actually deleted all my passwords from my LastPass vault, but originally kept the account because of LastPass's password sharing feature, though I stopped using that as well. I believe I had the LastPass extension installed on both Chrome and Firefox, on both Mac and Ubuntu. I primarily used Chrome on Mac. I did have uBlock Origin on those setups as well, but I really doubt that's the vector, it's likely just incredibly popular with all users of Hacker News. My LastPass password was globally unique and between 15 and 20 characters long (with some symbols and digits). This password shows no matches at https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords . I considered sharing the password here, but just in case an old version of my vault is out there somewhere somehow I'm not going to. My understanding is that such a password would be so incredibly impractical to brute force that it's not worth considering. Unless I'm outdated/wrong on that, that means the password leaked in clear text (or hashed with a broken hashing method). As I haven't typed that password since at least 2017 and I can't imagine LastPass is storing passwords in clear text, I'm inclined to believe the password was stolen in clear text from client machines (either LastPass extension exploit or malware) in or before 2017. It's weird they were not used earlier, but as LastPass doesn't allow new IPs by default, maybe the attackers knew this and were sitting hoping an additional exploit would allow their user. But now they're just trying in the off chance someone clicks the "That's me" link in the email. This doesn't explain the more recent claims, personally I'm inclined to disregard them as unrelated noise (user confusion, reused password, etc).
- gregsadetsky 5y ago
  Thanks -- my own case is pretty much identical to yours. My LastPass account was from 2017, and haven't used it since. I can also suspect a LastPass extension exploit from 2017 i.e. that's maybe how my password was stolen. (I actually found an email from LastPass dating back to 2017 where they were confirming that a vulnerability with their extension had been fixed. The subject of that email is "Security Update for LastPass Extensions" and it dates back to March 31st, 2017) I also agree with you that the attackers may have been hoping this time that some people would click the email link by mistake. What's most baffling to me are the 3 independent reports of people changing their passwords, and getting the "Someone just used your master password" emails again i.e. the same attackers that attacked you and me somehow also having access to these new passwords. That can be explained in some ways (those 3 people are currently infected with the same malware) but that explanation seems, to me, very unsatisfying.
theunquietone 5y ago
I haven't used uBlock and also got the LastPass email where someone had my password that wasn't stored or used anywhere else. I also haven't used my account in a few years.
trajcek 5y ago
+1 on uBlock Origin, but I think that's just a too common of an extension rather than the cause.
- gregsadetsky 5y ago
  Agreed that it's quite common. Also, at least 2 users who were compromised (or at least, received the email from LastPass) have confirmed not using it. So it's a wrong trail.
Schiendelman 5y ago
Given these experiences, especially the same message after changing the password, makes me think that LastPass’ message is wrong - that it claims someone used your password, but the attacker is not actually doing so. This would explain all the data I’ve seen so far, including LastPass’ reaction. Speculation: LastPass might use this message even if someone tries an old password? Does that fit the data so far?
- gregsadetsky 5y ago
  That's an interesting new avenue -- that older passwords are/were recognized too. I just tried my old password and the error message only says to check the password -- there are no emails sent saying that someone attempted to log into my account with my password. LastPass did change their systems, supposedly correcting for the issue that we all saw. So the test I just did also isn't really indicative of how their systems were working 2 days ago. There are still remaining questions: - the use of "some" and "likely" in LastPass' new announcement -- https://www.bleepingcomputer.com/news/security/lastpass-users-warned-their-master-passwords-are-compromised/ https://www.bleepingcomputer.com/news/security/lastpass-user... - an explanation on how the false positives happened. What made the system think those attempts were using the correct master passwords? - an assurance that no correct master passwords were used during the attack -- that they were all false positives (i.e. this attack was strictly credentials stuffing i.e. someone tried a bunch of passwords they obtained from other sources) - finally, an explanation for the 3 independent cases where people changed their passwords and then received an email again saying someone had attempted to login using their passwords. Those emails may have been false positives as well, but we would have to know.
  - Schiendelman 5y ago
    Great point that we have no idea how to verify anything now since they changed their systems. I switched to using icloud keychain a while back, after a breach LastPass had a few years ago.

pfg 5y ago

I've been using LastPass for work since mid-2018 as well as uBlock origin for Chrome; no blocked login notification so far.

gruez 5y ago

>I saw a few mentions of uBlock origin in yesterday's thread Statistically speaking it's probably because everyone has ublock origin installed, rather than it getting hacked. It's used by 5M+ users on firefox and "10,000,000+" on chrome. If ublock was really compromised you'd expect widespread reports of account compromise, rather than for only one password manager.

gregsadetsky 5y ago
That's a good point. I'm happy to delete my message if this way of finding out doesn't make sense.
- azinman2 5y ago
  Because it’s popular makes it an even bigger target.
ksec 5y ago
Yes that is what is so weird about the whole thing. 1. If LastPass has been compromised, the scale of these attack would have been tens of thousands times higher. But it isn't. And I think it is reasonable to trust and assume Lastpass does not hold the masterpassword, as they have stated. 2. If it was browser extension, and clipboard sniffing, the scale would have been higher as well. But it is important to note there are many reports of those password have not been used for 3-4 years. They would have sat on a drove of password and decide today is the day. And yet report of these attacks, while scary, are still very very limited. 3. It is hard make a guess without everyone posting their OS, Computer, Browser, extensions, list of software, and even Router, Location, Network ( MITM ? ) etc. 4. We have tested the theory of Lastpass triggering the wrong email notification even with wrong password. So far doesn't seems to be the case here. 5. Nearly all reported cases are unique passwords. ( A few didn't specify ) 6. There was a case where the whole Lastpass App and passcode was stored on an old laptop which hasn't been used for a long long time. 7. And yet there are also cases where account was only created in October / November this year. Meaning this activity is fairly recent. ( Doesn't rule out they could be two independent leaks or attack ) 8. I was expecting someone working in InforSec would jump in, but I guess they are all on holiday at the moment. 9. This happened just after LogMeIn announced they will spin off Lastpass. I am thinking of the incident with Ubnt where the actual problem was internal, an employees hacking their own companies for bitcoin or something. Still I dont know how any Lastpass staff, without storing any Masterpassword could have gained access to it. 10. For now this doesn't seem like a coordinated PR attack on LastPass. If it was, seriously guys you need to do a better job with Social Media marketing. :P Anyway It is an interesting thread to watch.

caconym_ 5y ago

I'd be pretty surprised if uBlock Origin had been exfiltrating data since 2017 without being caught, and (as the sibling comment points out) I'd expect a lot more than LastPass to be compromised. I think it exists at an intersection of (relatively) trustworthy and necessary that makes it extremely popular among the kinds of people participating in these discussions.

johtso 5y ago

It still seems that the most likely answer might be that lastpass are incorrectly alerting that someone's correct passphrase had been used, and that the email is being triggered by a bug, or something like a login attempt using the wrong password from a suspicious IP. The fact that lastpass support says that it means that the correct password was used doesn't mean it's true, the support staff might just be mistaken.

johtso 5y ago
Seems like this was infact the case: "Our investigation has since found that some of these security alerts, which were sent to a limited subset of LastPass users, were likely triggered in error. As a result, we have adjusted our security alert systems and this issue has since been resolved."
gregsadetsky 5y ago
I agree that's a possibility i.e. false positive emails. Counterpoints: - LastPass officially responded to this story by saying that all of our passwords were compromised elsewhere and then someone attempted to login with those i.e credentials stuffing. If it was a false positive email, it would have been easier to say that and a lesser reputation hit on them. Right now, they're saying "oh yeah those passwords were valid -- it's just that the attacker got them somewhere else, we weren't breached." - The (now 3!) twitter reports mentioned in https://news.ycombinator.com/item?id=29719033 https://news.ycombinator.com/item?id=29719033 point out that someone attempted to login again after they changed their password. They received the "Someone just used your master password" email a 2nd time. If those emails are not false positives (per LastPass), how could that have happened?
theunquietone 5y ago
Agree here.
eksployted 5y ago
That's what I was hoping, but I tested it. Used a VPN endpoint in a country that would surely get blocked. Attempted to login with wrong password, did not receive email. Logged in with correct passphrase, received email. Both scenarios looked the same on the login screen, so there wasn't any indication that I logged in with the correct password if I were the attacker edit: last night they released something that says they sent some of those emails in error. I hope that is the case, but it's still not very re-assuring. I went through and changed all of my financial/critical accounts yesterday in precaution, today my bank account was locked out from brute force. Could be a coincidence, but that is the first time it's ever happened with that account

blitzar 5y ago

My money is on compromised hardware, someone has bought the stealer logs and tried to scrape the whole lot at once. If you got it, assume you have malware and all your passwords you have entered have been captured.

gregsadetsky 5y ago
I agree that active malware is still a possibility. However: I was in touch with a security researcher on Twitter who has access to the RedLine Stealer stolen credentials. Neither my email nor LastPass password (the one that was compromised) were in there. The researcher looked for another email/password (of someone else affected who reported it here on HN and contacted me via email) and no result as well.
theunquietone 5y ago
Best way to confirm this?
- blitzar 5y ago
  10's of GB of credential data is being harvested daily, and personally I think these stealer logs are the greatest security threat at the moment <insert usual lecture about 2fa / unique passwords here>. To confirm, you would have to basically get access to all the stuff that has been sold, as the malware is pretty widely sold and distributed it is effectively ad infinite data set, and constantly growing. A previous responder checked with a security researcher who has a Redline Dataset and was not in there. Some of the annecdotes suggest it is from an old breech likely before 2020. Given the age and how these things get bought / sold / compiled into bigger datasets, there is a fair chance that researchers have the data and hopefully lastpass can dig into it to find the source.

kevinslashslash 5y ago

I'm one of the people that replied yesterday. I haven't used LastPass since, at the latest, 2017. I had actually deleted all my passwords from my LastPass vault, but originally kept the account because of LastPass's password sharing feature, though I stopped using that as well. I believe I had the LastPass extension installed on both Chrome and Firefox, on both Mac and Ubuntu. I primarily used Chrome on Mac. I did have uBlock Origin on those setups as well, but I really doubt that's the vector, it's likely just incredibly popular with all users of Hacker News. My LastPass password was globally unique and between 15 and 20 characters long (with some symbols and digits). This password shows no matches at https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords . I considered sharing the password here, but just in case an old version of my vault is out there somewhere somehow I'm not going to. My understanding is that such a password would be so incredibly impractical to brute force that it's not worth considering. Unless I'm outdated/wrong on that, that means the password leaked in clear text (or hashed with a broken hashing method). As I haven't typed that password since at least 2017 and I can't imagine LastPass is storing passwords in clear text, I'm inclined to believe the password was stolen in clear text from client machines (either LastPass extension exploit or malware) in or before 2017. It's weird they were not used earlier, but as LastPass doesn't allow new IPs by default, maybe the attackers knew this and were sitting hoping an additional exploit would allow their user. But now they're just trying in the off chance someone clicks the "That's me" link in the email. This doesn't explain the more recent claims, personally I'm inclined to disregard them as unrelated noise (user confusion, reused password, etc).

gregsadetsky 5y ago
Thanks -- my own case is pretty much identical to yours. My LastPass account was from 2017, and haven't used it since. I can also suspect a LastPass extension exploit from 2017 i.e. that's maybe how my password was stolen. (I actually found an email from LastPass dating back to 2017 where they were confirming that a vulnerability with their extension had been fixed. The subject of that email is "Security Update for LastPass Extensions" and it dates back to March 31st, 2017) I also agree with you that the attackers may have been hoping this time that some people would click the email link by mistake. What's most baffling to me are the 3 independent reports of people changing their passwords, and getting the "Someone just used your master password" emails again i.e. the same attackers that attacked you and me somehow also having access to these new passwords. That can be explained in some ways (those 3 people are currently infected with the same malware) but that explanation seems, to me, very unsatisfying.

theunquietone 5y ago

I haven't used uBlock and also got the LastPass email where someone had my password that wasn't stored or used anywhere else. I also haven't used my account in a few years.

trajcek 5y ago

+1 on uBlock Origin, but I think that's just a too common of an extension rather than the cause.

gregsadetsky 5y ago
Agreed that it's quite common. Also, at least 2 users who were compromised (or at least, received the email from LastPass) have confirmed not using it. So it's a wrong trail.

Schiendelman 5y ago

Given these experiences, especially the same message after changing the password, makes me think that LastPass’ message is wrong - that it claims someone used your password, but the attacker is not actually doing so. This would explain all the data I’ve seen so far, including LastPass’ reaction. Speculation: LastPass might use this message even if someone tries an old password? Does that fit the data so far?

gregsadetsky 5y ago
That's an interesting new avenue -- that older passwords are/were recognized too. I just tried my old password and the error message only says to check the password -- there are no emails sent saying that someone attempted to log into my account with my password. LastPass did change their systems, supposedly correcting for the issue that we all saw. So the test I just did also isn't really indicative of how their systems were working 2 days ago. There are still remaining questions: - the use of "some" and "likely" in LastPass' new announcement -- https://www.bleepingcomputer.com/news/security/lastpass-users-warned-their-master-passwords-are-compromised/ https://www.bleepingcomputer.com/news/security/lastpass-user... - an explanation on how the false positives happened. What made the system think those attempts were using the correct master passwords? - an assurance that no correct master passwords were used during the attack -- that they were all false positives (i.e. this attack was strictly credentials stuffing i.e. someone tried a bunch of passwords they obtained from other sources) - finally, an explanation for the 3 independent cases where people changed their passwords and then received an email again saying someone had attempted to login using their passwords. Those emails may have been false positives as well, but we would have to know.
- Schiendelman 5y ago
  Great point that we have no idea how to verify anything now since they changed their systems. I switched to using icloud keychain a while back, after a breach LastPass had a few years ago.