We need to talk about some serious issues with LastPass that it seems
like no one is talking about and no, I’m not just talking about the hack,
but it does have to do with that so let’s get into it. Way back in August, LastPass
posted a breach notification blog post saying someone accessed their development environment
through a compromised dev account and took some source code and proprietary technical info. They
said quote “we have seen no evidence that this incident involved any access to customer data or
encrypted password vaults”. They kinda repeated this sentiment in an update on September 15.
Back on November 30, LastPass confirmed a data breach of LastPass’s third party cloud storage
service, which is shared by both LastPass and their parent company GoTo. They told
us at the time that this hack happened due to the information stolen in August 2022,
and listed this as an update to the previous post,
but passwords were and I quote “safely encrypted due to LastPass’s Zero Knowledge architecture”.
So at this point in time a lot of people were like “everything is fine,
your vault is safe, you don’t need to switch your password manager!” But in this video,
you’ll learn why you may want to switch and do a serious security audit due to what was stolen.
One way to get ahead on your very own 2023 security checkup is by checking out DeleteMe,
my sponsor for this episode (I have a coupon code, listen up!).
DeleteMe helps you remove personal information from the internet, and it’s my #1 choice when
it comes to saving me time and energy so that I can focus on all the important things in my
day to day life. **No one wants to spend hours devoted to sending removal requests every month
to get data like your home address, phone number, email address and more off those annoying data
broker sites. So I’ve been a paying customer of DeleteMe for years to do it for me. You sign up,
input data you want them to remove and their experts find and remove your personal
information on a re-occurring basis. You can even add family members to your account so
if you’re worried about your kids or your spouse’s information being used to steal
their identity or cause financial issues, you can add them so their data will be protected too.**
I’ve checked data broker sites for my info and they do indeed delete it and they send you
quarterly reviews so you can also see how many sites are out there scraping your information.
DeleteMe has saved me so much time, and if you value privacy, give their service a try.
I have an exclusive coupon code now, just for my viewers! Use the code SNUBS at checkout - that’s
S N U B S - for 20% off any of the consumer plans. That’s SNUBS for 20% off and see how
DeleteMe can help you take your online privacy to the next level. **Click the link below or hit up
[joindeleteme.com](http://joindeleteme.com) to sign up today!**
**Huge thank you to DeleteMe for sponsoring this episode.**
Now let’s get to the big LastPass update.
After the original news we got an update on December 22 which went into a lot more detail.
At this point, LastPass stated that credentials and keys used to access and decrypt some
storage volumes for their cloud based storage service were obtained. They stated that the
attacker copied info from backups including customer account info like end user names,
billing and email addresses, telephone numbers, and IP addresses from which
customers were accessing LastPass’s service. Unencrypted credit card data wasn’t accessed.
Now here’s the fun part:
The attacker also copied a backup of customer vault data which is “stored in a proprietary
binary format that contains both unencrypted data, such as website URLs, as well as fully-encrypted
sensitive fields such as website usernames and passwords, secure notes, and form-filled data.”
They also noted that “**These encrypted fields remain secured with 256-bit AES
encryption and can only be decrypted with a unique encryption key derived from each
user’s master password using our Zero Knowledge architecture. As a reminder,
the master password is never known to LastPass and is not stored or maintained by LastPass.**
The encryption and decryption of data is performed only on the local LastPass client.”
So in December, LastPass gave some tips to keep your account secure. They said an attacker might
try to brute force guess your master password and try to decrypt the vault data with the key
they took. Or you might see phishing attacks, credential stuffing, and social engineering.
LastPass made mention that as an extra precaution, you might wanna
minimize risk by changing passwords of website you have stored in LastPass,
especially if you used a weak master password for your vault.
This is something I recommend too: if you wanna learn more about hacks happening every week,
check out my Patreon link below, where I post a weekly show about
security and privacy. Join folks like Peter, Scott, Stephen, Chibbsx,
and Tu who just became Patrons and join me in my Discord where we geek out about security stuff.
Ok, so it sounds like everything is still safe as long as your master
password is really good and you don’t reuse it anywhere, because an attacker wouldn’t
be able to unencrypt your sensitive data, even if they have that backup.
Given that all this info was dumped on news websites right before the Christmas holiday,
a lot of people just didn’t pay attention to
it or didn’t have time to audit their password manager security.
A month passes by, and now LastPass’s parent company GoTo has a new blog post on their website,
not an update to the LastPass blog post, saying that this hack also affected other products…
AND the affected info may include account usernames, salted and hashed passwords,
a portion of multi factor authentication settings and well as some product settings and licensing
information. GoTo says the attackers stole customer encrypted backups as well. Big yikes.
And worse… The attacker also stole the encryption key for some of the products under the GoTo
umbrella. GoTo stated they’re resetting passwords on the products that are affected, MFA will need
to be reauthorized, and they’re moving to a more robust option for identity management.
So with this newest update, we have all the information that’s been publicized so far.
But there’s a big CRUCIAL problem that it seems like no one is discussing. Let’s go
back to that line from the December update where LastPass said that attackers stole
“customer backups that included unencrypted data, such as website URLs.” Everything else
is encrypted but the website URLs are not. Also they said Such As..
what does that mean? Is there other unencrypted data we should know about? I am sus, y’all.
This has two problems. The first one is pretty obvious:
An attacker could see what websites you visit, and as such use that information,
plus the telephone numbers and email addresses which we also know were stolen to: try to
social engineer you, try to get you to click on links sent to your email address aka phishing,
or even send sms phishing texts to your phone number… They could even use that URL
detail to try and brute force your accounts - because now they know where you have accounts.
But to make matters worse, those URLs could give them direct access to your accounts or give them
sensitive information about you depending on how websites log you in. Let me explain:
Sometimes when you log in to a website, the site will store information for that logged in session
on your browser on your computer or smartphone and it will have a very specific line of data
that allows you to stay logged in while browsing around their website. This is called a session
and it remembers you, so you don’t have to enter your username and password every time you click
on a webpage for that website. So if you’re on facebook, for example, you stay logged in whether
you go to your moms profile or you click on your direct messages or you go to your homepage. That
session keeps you logged in. We like sessions because they make browsing convenient and fast.
But some websites store session information in the URL.
And that could include a very specific line of numbers and letters that are tied to your session,
or they could even include data like your username or email address,
etc. Sometimes LastPass (and other password managers) will prompt you to save a password
after this new URL is loaded when you log in, so when you go to save your new username and password
in your password manager, it defaults to that URL that includes your logged in session information.
So if that data is not encrypted and someone steals it, like we have here,
and that website is not taking steps to make sure sessions aren’t valid on new devices,
the attacker could use that URL to “inherit” your session even though they’re on a totally
different computer. This is called session hijacking, and it’s a common technique to
steal someones account without knowing their password. That’s a big problem.
Also, if you’ve saved a local IP address (say,
for a server or a remote login or something) as a URL parameter on LastPass,
that means that local IP address could now be impacted in this data breach as well.
The only URL that should be saved in the password manager should be the login page
or the main .com domain for whatever websites you’re visiting. And it should be encrypted.
So, we know that all of this data was siphoned off LastPass’s
servers by an attacker, what can you do about it?
If you haven’t already, now is the time to seriously consider switching off of LastPass,
in my opinion. I have accounts on all the popular password managers because I reviewed
them all last year, so this affects me too. But switching to a new manager,
deleting your data from your LastPass vault (after checking it over twice
to make sure everything was exported and imported to your new one correctly) and
removing your account from LastPass is a great first step to minimizing your risk.
Once everything is moved, go through your logins and change passwords,
add two factor authentication on any sites that have it available, and check the URLs that were
saved for any weird strings of characters that could be a signifier for your session. Hopefully
any sites that have a session ID in the URL are changing that ID every time you log out and log
back in or regenerating it after you successfully log in, so it changes every time. If not,
it could be used by an attacker to log into your accounts from their devices. A password
reset or logging out of all the known devices on your accounts should scrub these session IDs
from being usable, so if any of them were stolen, then they’d no longer be valid.
Hopefully whichever sites you’ve saved don’t store Session IDs in URLs but if they do,
hopefully they aren’t static for each login.
The hard part of using a cloud service like LastPass is there is some inherent trust
you’re giving to that company to protect your data. There are crucial accounts that I don’t
store the credentials for anywhere, and I use hardware keys for multi factor authentication
whenever I can. Anytime I do hear about a hack, I start taking actions that I can take as a user,
I don’t wait for them to tell me it was worse than they thought months later.
I do still use cloud password managers (not lastpass), but there are local options as well,
and I’d love to give you some updated recommendations for 2023 if you’re interested.
Watch this video to learn about Yubikeys and how I set them up on websites,
or check out this video Youtube thinks you’ll enjoy!
Thanks for watching, bye yall!