LastPass Shouldn't Be Trusted With Your Passwords

Vice

LastPass, the popular password manager, is out of good will. Ever since the company first disclosed a breach in August, it has slowly provided consumers with drips of information, and the new details that do come out increasingly paint a picture of a company that should not be trusted with your passwords.

IMAGE: SOPA IMAGES/CONTRIBUTOR

On Monday, LastPass published a blog post which provided more information on that breach, which it is now calling “Incident 2,” because the hacker leveraged its initial access to then steal data. “Our investigation has revealed that the threat actor pivoted from the first incident, which ended on August 12, 2022, but was actively engaged in a new series of reconnaissance, enumeration, and exfiltration activities,” LastPass wrote.

The hackers managed to access LastPass’ corporate vault by targeting the home computer of one of four engineers who had access to decryption keys needed to access cloud data storage where sensitive information was kept. The hackers did this by exploiting a vulnerability in a third-party media software package, which Ars Technica later reported to be Plex. From here, the hacker installed a keylogger, captured the engineer’s master password, bypassed the company’s multi-factor authentication protections, and accessed the corporate vault. In there, the hacker stole the keys needed to access “LastPass production backups, other cloud-based storage resources, and some related critical database backups,” the blog reads.

The post shows that the hacker against LastPass was resourceful and persistent, but also that LastPass was not treating its own crown jewels with the serious security practices it should have. A LastPass engineer was accessing critical services from their home computer and network. LastPass had difficulty distinguishing between the activity of the worker and that of the hacker. The sensitive information—in this case, customers’ password vaults that need the user’s master password to decrypt but could theoretically be brute forced at some point—were stored less in a bank vault and more in a closet.

Read More

CyberNews

LastPass is a great password manager. It has a simple and secure interface, strong encryption, and a host of useful features like password sharing, two-factor authentication, and digital legacy. However, LastPass is not without its drawbacks. For instance, it has been recently hacked, and encrypted user data was acquired by threat actors. 

Additionally, LastPass does not offer the same level of control over your data as some other password managers, and some users have reported that the service can be slow and unreliable at times. If you’re looking for a more trustworthy provider that has never been breached, then NordPass might be the better choice for you.

A 2022 LastPass incident happened in August 2022. The company's source code was accessed through a compromised developer account. However, no vault data or master passwords were compromised and users weren't asked to take any further action. This can be seen as a positive – despite the scale of the attack, the overall damage was minimal. 

However, not even 5 months later, another LastPass breach occurred. This time, a threat actor used information obtained in the August breach to gain access to internal LastPass systems. User details such as email addresses, telephone numbers, and IP addresses were exposed. LastPass also disclosed that the hacker also was able to obtain a copy of an encrypted backup of the user passwords, website usernames, and form-filling data. 

The passwords remain safe unless the hacker can crack the encryption. However, among the exfiltrated information, were unencrypted URLs, which may or may not include sensitive data such as account tokens and API keys and credentials.

Read More