#WAS ANYONE AFFECTED BY LASTPASS BREACH UPDATE#
#WAS ANYONE AFFECTED BY LASTPASS BREACH FULL#
#WAS ANYONE AFFECTED BY LASTPASS BREACH SOFTWARE#

#WAS ANYONE AFFECTED BY LASTPASS BREACH SOFTWARE#

' This was accomplished by targeting the DevOps engineer’s home computer and exploiting a vulnerable third-party media software package, which enabled remote code execution capability and allowed the threat actor to implant keylogger malware.

#WAS ANYONE AFFECTED BY LASTPASS BREACH FULL#

I will quote the paragraph that broke this security camel's back in full as it relates to how the attacker got access to the decryption keys for the cloud storage service:

LastPass confirms senior developer using home computer was hacked LastPassĮven now, in the same statement that assured customers that LastPass had listened to concerns about communicating more comprehensively, the bombshell disclosure was contained in a separate 'additional details' document. The security incidents were not, the statement read, 'caused by any LastPass product defect.' Maybe not, but corporate security processes and controls appear to have fallen even shorter than corporate comms. However, the red flags started waving for me when the statement confirmed that a threat actor had 'targeted a senior DevOps engineer by exploiting vulnerable third-party software.' Wait, what?īy doing so, we were informed that the attacker delivered malware that could bypass security controls and gain access to those cloud backups. That's fair enough file under lessons learned. This confirmed that LastPass needed to catch up regarding communication regarding the security incidents being comprehensive and frequent enough.

#WAS ANYONE AFFECTED BY LASTPASS BREACH UPDATE#

'Trust is paramount in the world of password management,' I concluded, 'and there can be little doubt that trust is being tested hard right now.' MORE FROM FORBES LastPass Password Vaults Stolen By Hackers-Change Your Master Password Now By Davey Winder The final LastPass hack attack bombshell dropsĪnd then, on March 1, yet another update to the December 22 incident disclosure dropped. This gave the attacker a head start on any attempts to decrypt vaults, as users had been advised that no further action was required up until this point. This wouldn't help anyone with a weak master password in terms of the stolen vaults, of course, so those customers were advised to change all their passwords as soon as possible.Īt this point, I stated that if I were a LastPass user, I'd be looking for alternatives given the drip feed of breach information, especially since it took so long to determine that customer vaults had been stolen. At this point, I recommended that users change their master password, which would also re-encrypt their password vault, based on better safe than sorry. With local access to the encrypted databases, this becomes a lot easier to pull off but is still dependent on the user either having a weakly constructed master password or one reused across services, including one that has been compromised. Unless, of course, they used brute-force methods to try known passwords from other breaches. This meant the attacker now had customer password vaults but not the means to open them.

LastPass attacker stole customer password vaults

Was anyone affected by lastpass breach