8 ms·

I'm not sure the description is what actually happened. It doesn't have the ring of truth to it. That said, LastPass is not deserving of any trust as a passwor

• deathanatos 4y ago
  Yeah, because the description is inadequate. Is this BYOD? (… seems like not the employee's fault.) Is this the employee used the same password on the laptop and home, got credential stuffed, and LastPass isn't using MFA¹? (…seems like not the employee's fault.) Was there some jump from compromised home laptop to corp laptop? (The network is never to be trusted. …seems like not the employee's fault.) The buck is supposed to stop at security, not at each employee's personal hygiene … if your game plan depends on the latter, it's game over. There's more here than is being written, and I can only imagine because the truth probably stinks. ¹except TFA mentions MFA … but the mention of it doesn't really make sense.
  • deebosong 4y ago
    I understand what I'm asking for is "educated conjecture" more or less, but what would you surmise might be actual plausible situations rather than what LastPass is putting out as PR? Just asking as a laymen who is curious with no skin in the game.
  • schainks 4y ago
    > The buck is supposed to stop at security, not at each employee's personal hygiene … if your game plan depends on the latter, it's game over. I have to take security trainings twice a year that literally talk about the buck stopping at my digital hygiene and I better not fuck it up for The Company. Companies have to understand breaches will happen, but preparing employees on how to spot attacks or understand when they've been breached is a huge component of their ability to repel or minimize attacks.
    • NoPicklez 4y ago
      Right, but for your average user. If your machine is infected with a keylogger that results in a stolen password because of a vulnerability not timely identified and corrected. That's not on you as an employee, that's on the security team for not implementing compensating controls/defence in depth. Yes you have a responsibility to detect phishing emails, not writing down passwords, inserting USB's etc. But if something happens to you completely behind the scenes during your normal business, it's not on the employee.
      • rightbyte 4y ago
        > Yes you have a responsibility to [...] not writing down passwords Most places force you to rotate the password so I would not say it is a responsibility to not write it down. I do it. It is like there is a fixed number of passwords per life you can remember or something.
        • geoelectric 4y ago
          I'm sure they meant something analog like on a sticky note rather than in a password manager, where it should be stored.
          • ed_elliott_asc 4y ago
            My bank still won’t let me paste a password so at least that bank doesn’t mean use a password manager!
            • faeyanpiraat 4y ago
              If you start dragging a password from 1Password, the window disappears and you can release your mouse over a field elsewhere, and it will get typed in there (instead of pasting). This may or may not work for your case.
        • deleted 4y ago
          [deleted]
  • chromanoid 4y ago
    > ¹except TFA mentions MFA … but the mention of it doesn't really make sense. I guess there was a loophole in their MFA integration. Maybe they accepted the same TOTP twice - in a multi-region setup I guess this might be a trade-off that somebody might risk. With a keylogger one can theoretically steal a TOTP anyway or do other more sophisticated shenanigans. > We enabled Microsoft’s conditional access PIN-matching multifactor authentication using an upgrade to the Microsoft Authenticator application which became generally available during the incident. Maybe switching to push notifications with number matching is their mitigation for that (e.g. without affecting multi-region replication / performance).
  • secondcoming 4y ago
    If you BYOD then do your work stuff on a VM. It’ll help with security and has the benefit that you can just delete the VM when you change jobs.
  • antihero 4y ago
    I expect the amount of companies that would get fucking owned by simply managing to execute cat ~/.aws/* | <some sort of curl to a pastebin> On a devops/senior dev machine is colossal.
    • mhitza 4y ago
      What I want is a secure shell (somehow) where my env variables are encrypted and on access I get a prompt to either use a fingerprint reader or a password to unlock them for the process. Anyone know of any such option? What I've come to use are separate env files that I source in various directories before running the commands that need crednetials, or a tool that decrypts a file, loads it into an subprocesses env vars and runs a program (something like mozilla/sops), but I still find that too cumbersome, I'd like it transparent and integrated with my shell.
      • yunwal 4y ago
        aws-vault[0] does this, but only for aws creds 0 - https://github.com/99designs/aws-vault https://github.com/99designs/aws-vault
        • antihero 4y ago
          Yeah this is a good tool, if annoying at times. A better way would be to not allow user accounts to deploy anything in any sort of prod accounts, instead only allowing this to happen through CI.
      • CoolCold 4y ago
        Combining direnv with sops can be partial solution here.
  • jabroni_salad 4y ago
    We are looking at a highly sensitive asset, though. A vault that is only used by four employees (per the original press release, not in the 9to5mac article) and contains keys for the production backups. At this level of sensitivity you need to consider "should the employee's personal plex server be able to connect to this" and the answer might be a No. At this point you should be issuing them a PAW and a physical security key and auditing the shit out of it. It's not like lastpass can't afford it.
• chaorace 4y ago
  While it's very civil of you to wish recovery upon LastPass, I don't really think the product is deserving of redemption. This is not the first major incident and it demonstrates little growth in relation to prior breaches. The world as a whole would probably be better off if LastPass were to breathe its last.
  • jjeaff 4y ago
    They need to sell it to someone else with a better track record.
    • Phemist 4y ago
      I agree with the GP. Why would selling it solve the issues with the product? How much of the product can be salvaged? They have a well-known brandname, but it is arguably radioactive now. The product as software can be rebranded, but why go through this effort if the ubderlying software has proven faulty so many times in the past? A similar effort can be invested in making open-source password managers better, so there is a clear opportunity cost to salvaging LastPass. Plus a sale would surely only directly benefit those most responsible for LastPass' issues. It would mean they are directly rewarded for their incompetent execution..
      • jjeaff 4y ago
        It seems like nothing is necessarily wrong with the software itself. Its the opsec surrounding the software. The most secure software in the world can be pwned if you can get access to the lead dev's system or the build system itself.
• theamk 4y ago
  Are there any reliable ways to secure remote computers from keyloggers _and_ still provide an efficient software development environment for non-trivial projects? All of the software engineers I have seen have a fairly unrestricted environment -- Linux machines, with sudo access, often with passwordless root access via "docker" group, and with non-intrusive "endpoint protection" system. It would be normal to for someone to run "npm install" on their machine, or check out a random github repo they read about and run code from it. Such machine would be a prime target for malware. And endpoint protection I have seen seems to be really stupid -- basically hooking "exec" calls and checking for exact hash match (!). Any serious malware should be able to bypass it without much effort, and if it only stays on a single computer, the detection chance is pretty low. (I have also seen some poor souls who were stuck on locked-down Windows machines.. but they usually ended up using their machines as remote terminals, doing most their actual work on some remote server. And that server is sudo-capable Linux with light/no protection, and see previous paragraph. I suppose if _that_ is infected, at least Lastpass might not be stolen... unless people start browser on server and log into lastpass there, I've seen this happen)
  • gavanm 4y ago
    You've already included the answer - "using their machines as remote terminals, doing most their actual work on some remote server". The developer uses MFA (TOTP, Push Notification, Yubikey etc) into a virtual desktop inside the organisation (Citrix, VMWare Horizon, etc). From there, the developer can SSH / whatever into their development environment - which is hosted "inside" the corporate network, or their cloud provider, via internal links. All code, and dev boxes live "inside" the corporate network, and only keypresses, mouse movement, and screen diffs are sent back and forth. Most remote access packages can prevent clipboard, USB device, file transfer etc. If you need a password manager for work purposes, then it lives on the corporate managed network - not your remote laptop/desktop - and to be really paranoid - you only ever "copy/paste" those passwords - you don't type them in. If you really want to lock it down further, give the remote workers dedicated corporate equipment that they only use to access the remote desktops, so you can prevent some things like screen capturing, and really lock down the software to prevent things like keylogging software/malware. You also should have the entire development environment segregated from the "business" corporate network as well. It's only really an issue if you want to have offline developers - in which case I don't have any thoughts ready to hand - (but would expect it to be a very locked down machine, possibly with an even more locked down VM inside it). As someone who regularly uses multiple layers of Virtual Desktop -> Virtual Desktop -> Remote Desktop, provided the network can handle it (on both your local network, and the corporate network), it works surprisingly well.
• luxuryballs 4y ago
  Even if they got pwned and the hackers got full system access like this the screw up is still definitely in the implementation right? Isn't this like basic stuff where you would use encryption that only the end-user can bypass?
• chii 4y ago
  > I hope they recover from this, but they need to understand security to produce a security product. it's because the market doesn't actually pay for a secure product, but the appearance of one. The end-user buying cannot really discern whether the company's product is actually secure. There's no third-party standard auditing (let's say, a gov't organization). Banks are run securely, not because I personally audit them, but that the gov't mandates liability onto the banks for losses from their insecure systems. So the banks are secure, because they stand to lose a lot. The same must be mandated for all companies imho, or insecure companies would continue to exist and thrive.
  • dogma1138 4y ago
    Eh banks run securely because it’s very difficult to steal money. Hard currency theft requires a physical attack and “digital currency” is just essentially a spreadsheet that requires a settlement mechanism such as correspondent banking to work. Banks transfers are nothing more than messages going between different branches and banks there is nothing being transferred other than orders. The attack surface on modern banks especially large ones is actually ridiculously small since you don’t only need to defraud or compromise a single bank but also the entire system and all other banks which are using it since once the offended bank notices some inconsistency it can issue a notice to reverse any offending transactions. Also since bank transfers are often liabilities for most banks e.g. when an account in First Capital transfers $1M to someone in First Direct it means that First Capital now owes First Direct $1M which makes First Direct a creditor which is why it will likely quarantine the funds until the transaction is fully verified and settled and even then there still likely going to be a cooldown period to reduce the risk even further. Most of the security within banks is designed to deal with internal threats since the entire banking system is essentially based on mutual trust which gives individuals even fairly low ranking branch employees the ability to authorize fairly substantial transactions.
    • chii 4y ago
      > Eh banks run securely because it’s very difficult to steal money. i think you got the cause and effect wrong - banks are run securely because it's made to be very difficult to steal money. And stolen money gets tracked (if you did steal a large amount) by anti-money laundering laws, which makes it hard to spend it. Why is banks' attack surface small? Why is all these other "systems" in place to make stealing money difficult? Why isn't the same happening with stolen credentials, or data?
• jstummbillig 4y ago
  > That a password was captured by a keylogger on a Dev Ops home computer shows that they don't understand how to secure remote computers I tend to disagree. The potential for any single employee to do substantial harm to any business is incredible and designing a system to make that not possible is nigh impossible. It's neither the humans nor the institutions fault. It's just that systems involving humans are incredibly hard stuff. You are constantly weighing rigidity of the system with the potential to do harm within the system. How much way can it give to make it possible for humans to do their job in a complicated world? If you go down the path of "we need a process for everything" you are going to end up with a lot of processes. The inherent problem with that approach is that (for most businesses that are not exactly amazon) a lot of processes can not not feasibly be systematically enforced and rely on being honoured by a human a juncture points, to an extent that makes you very uncomfortable when you consider what mechanisms you system has, for when they just don't. As of now, most system simply rely on humans to do the right thing at the right time, for no other reason than it being the right thing and they also knowing that, for the whole world to not go up in flames.
  • Chyzwar 4y ago
    Last pass have different threat model than most of companies. They should have higher standard than everyone else. Employee privete PC should not have access to production data. They should you vpn and multi factory auth and everyone should be trained in company.
  • oxfordmale 4y ago
    If a password was captured by a key logger, rather than a session token being stolen, they didn't implement 2FA for this login. They are also talking about a home computer. In my company, VPN access is limited to trusted devices; therefore, sensitive systems can only be accessed from a corporate machine. Security at LastPass seems substandard for a company storing security credentials. Unfortunately, from my experience, this is relatively common, and regulators need to start issuing significant fines or prison sentences for this to improve. Unfortunately, it is too easy for CTO/CISO to find a scapegoat and avoid scrutiny.
    • 4y ago
• Cthulhu_ 4y ago
  To me it says their security is not up to par, and that employees were allowed to take secrets home. Which is fine to a point, but it has to be a company managed, remote-wipable and locked down system if it's people that hold the literal keys to the secure castle. Same with the Canadian ban on Tik Tok, why are they even allowed to have phones where they can install any software on? BYOD and personalization is fine to a point, but only if you don't have high level access.