5 ms·

> 1. If LastPass has been compromised, the scale of these attack would have been tens of thousands times higher. But it isn't. Wait wait, what do we know about

> 1. If LastPass has been compromised, the scale of these attack would have been tens of thousands times higher. But it isn't. Wait wait, what do we know about the scale of the attack and how? Even if the attacker had every single LP master password, that says nothing about how much resources they're spending hammering the service.

gruez 5y ago
If the attacker only got a hold of password hashes or something, then it's true that they'll only be crack a limited amount. However, if that were the case you'd expect the people with easy passwords to get hit first, because an attacker would presumably go through the common words in the wordlist before the uncommon words, and finally a brute force search. Doing attacks in this manner would maxitimize the speed at which you gain access to accounts. However, this doesn't seem to be the case? You'd expect all the people with easy passwords "p4ssw0rd" or whatever to fall first, and in great numbers. This doesn't seem to be the case because many people seem to be swearing their passwords were unique/secure. If the attacker got a hold of the raw passwords, then the speed of compromise could be easily thousands of accounts per hour. Just set up a bunch of TOR clients and bruteforce over that, or pay $10 for a few leaked VPN account credentials.
- foxfluff 5y ago
  It's not a given that brute forcing is the strategy the attacker would choose. That might just lead to their Tor & VPN IPs getting quickly blocked, if they aren't already. There are only around 1500 Tor exit nodes and it's trivial to block them. Sometimes trying to stay under the radar might be the smarter choice. Anyway, we still have no idea what the scale of the attack is or when exactly it started (IIRC someone reported this happening much earlier this month).

5 ms·

> 1. If LastPass has been compromised, the scale of these attack would have been tens of thousands times higher. But it isn't. Wait wait, what do we know about

by foxfluff 5y ago

gruez 5y ago
If the attacker only got a hold of password hashes or something, then it's true that they'll only be crack a limited amount. However, if that were the case you'd expect the people with easy passwords to get hit first, because an attacker would presumably go through the common words in the wordlist before the uncommon words, and finally a brute force search. Doing attacks in this manner would maxitimize the speed at which you gain access to accounts. However, this doesn't seem to be the case? You'd expect all the people with easy passwords "p4ssw0rd" or whatever to fall first, and in great numbers. This doesn't seem to be the case because many people seem to be swearing their passwords were unique/secure. If the attacker got a hold of the raw passwords, then the speed of compromise could be easily thousands of accounts per hour. Just set up a bunch of TOR clients and bruteforce over that, or pay $10 for a few leaked VPN account credentials.
- foxfluff 5y ago
  It's not a given that brute forcing is the strategy the attacker would choose. That might just lead to their Tor & VPN IPs getting quickly blocked, if they aren't already. There are only around 1500 Tor exit nodes and it's trivial to block them. Sometimes trying to stay under the radar might be the smarter choice. Anyway, we still have no idea what the scale of the attack is or when exactly it started (IIRC someone reported this happening much earlier this month).