The password manager LastPass was hacked.
Again.
The consequences of this breach are far worse than most experts want to admit.
The fallout from this affects much more than just LastPass users and
I am going to tell you the actions that YOU need to take... RIGHT NOW.
Please make sure your seatbelts are securely fastened and all your carryon
items are properly stowed as The Redacted Hacker episode 000 is about to begin.
The [REDACTED] Hacker Intro
I'm
Brenton House and you are watching the Redacted Hacker.
Data breaches happen every day so why is this latest from LastPass so bad?
Like many organizations, LastPass has had their fair share of hacks and breaches.
This one is very different than the previous ones and might affect you
or your organization EVEN IF you are not a LastPass user.
Here's are the highlights of the recent breach.
In August of 2022, LastPass reported that they detected
"some unusual activity within portions of the LastPass Development environment".
They assured everyone that this incident did
not involve any access to customer data or encrypted password vaults.
What was accessed was portions of their source code and some
proprietary LastPass technical information.
If you are in the development world at all, you know this is pretty bad.
Getting access to the source code means that sooner or later,
they will probably use this to launch an attack.
Sure enough, a few months later in November of 2022, LogMeIn,
the parent company of LastPass, announced that they detected "unusual activity
within a third-party cloud storage service used by LastPass and GoTo".
Let's go deeper now to better understand the severity of these incidents.
First, I'll give you a quick look at the history of LastPass and
security issues and then I walk you through steps you need to take today.
LastPass was founded in 2008 as a password management company.
In 2010, LastPass acquired Xmarks,
which gave LastPass the ability to synchronize passwords between browsers
In 2015 LastPass was acquired by LogMeIn, which is known for their products like GoTo Meeting.
In 2017, LastPass doubled the price of their premium version while also removing features
In 2021, LastPass shook the user community by announcing that they
were getting rid of their free tier of accounts.
LastPass announced the free LastPass product will no longer function on both Desktop and Mobile,
thus removing this product as a viable tool for most users and
creating a lot of animosity with the LastPass community.
Also in 2021, LogMeIn announced that LastPass would be established as an independent company,
however, I have not seen anything official to confirm that this actually happened.
LastPass has suffered many security incidents over the years. There were incidents in:
- 2011 - 2015
- 2016 - 2017
- 2019 - 2020
- 2021 - and of course, 2022.
In their 14 year run, LastPass went from being one of the most popular password
managers ever to a company that has left its user community feeling abandoned and vulnerable.
Let's jump right to the security incidents in 2022
as that is where our story takes a turn for the worse.
There were four security incidents that were disclosed by LastPass in 2022.
On August 25, 2022, LastPass revealed that an unauthorized party gained access to parts of
the developer environment at LastPass through an individual compromised developer account.
According to LastPass, the unauthorized party took some
source code and proprietary technical information.
On September 15, 2022, They disclosed that
the unauthorized party was in the developer environment for four days.
At the time, LastPass claimed the incident did
not involve any access to customer data or encrypted password vaults.
On November 30, 2022, LastPass revealed that "unusual activity" within a third-party cloud
storage service was detected. Previously gained knowledge facilitated this incident.
The unauthorized party gained access to certain elements of customer information
on storage service used by both LastPass and GoTo.
On December 22, 2022, LastPass disclosed that the threat actor obtained customer account information
such as names, billing addresses, email addresses, telephone numbers, and their encrypted vaults.
LastPass claimed the encrypted data is strongly encrypted and requires that
a customer’s master password be decrypted first.
Along with the password vaults, some unencrypted data was also stolen and included:
- Company names - End user names
- Billing addresses - Email addresses
- Telephone numbers - and IP addresses
that customers used to access LastPass
Another fact security researchers discovered is
that not all the information in a customer's password vault is actually encrypted.
Some information was never encrypted such as website urls, which often contain other
personal information due to the way that LastPass captures and stores the url upon adding a site.
Due to the severity of this breach, the case has gotten a lot of attention and has
revealed even more facts about the case. - One item noticed was that new password
requirements implemented by LastPass back in 2018
were never retroactively applied to older accounts, thus leaving
many accounts potentially vulnerable. - Also this breach occurred on a server
shared by both LastPass and GoTo which lends itself to the assumption that the two companies
might not be a separate as reported. - Many users are reporting that their
password iterations settings were never updated to the default 100,100 iterations.
(which by the way is far lower than the default should have been set to by LastPass).
In fact, the encryption iteration count for some users was set to very low numbers.
Some people are reporting that their iteration count was set to 1.
That's right 1. Incredibly, that was actually the default setting for years at LastPass.
Now, here is the really bad news that few want to talk about.
Every site and password that you stored in LastPass will eventually be
available to every hacker, threat actor, researcher, or stalker via the Darknet.
For most, it is a matter of when, and not if.
The reason for this is, they now have a copy of your actual password vault.
They can work on cracking it offline and on their own timeline.
Although it is encrypted, technology is always progressing exponentially.
Based on the default encryption iterations used by LastPass,
a targeted attack on your vault will lead to your passwords eventually being revealed.
If fact, the unencrypted data that was stolen such as customer names,
addresses, ip addresses, and the URL for EVERY SINGLE site that you stored a password for,
will probably be surfacing very soon as this data does not even require decrypting.
The ramifications from this are far reaching. Let's look at why this is true.
A LastPass master password, or the password that is used to secure your vault, is,
due to the nature of the requirement, a password that you can remember.
While the passwords stored INSIDE the LastPass vault can be autogenerated, random passwords,
the master password must be typed in by LastPass users every time their vault needs to be unlocked.
This means that for most users, their LastPass master password will not be super secure.
Unfortunately, password reuse can also affect LastPass master passwords.
For some users, their LastPass master password might be a password they have
used before and exists on the Darknet as part of an unrelated data breach.
For others, their LastPass master password might be a variation of
a previously used password which makes them almost as vulnerable.
There is a another group of people that are affected by
this security incident and it is not LastPass users.
It's every organization that has resources that are secured without Multi-Factor Authentication.
You see, once these password vaults start being decrypted, there is going to be
password information that could possibly have dangerous implications for YOUR organization.
Say there is a LastPass user - we'll call him Bob.
Bob had a LOT of passwords stored in his password vault.
One of those passwords was a password to YOUR site. Not only that,
but Bob just happened to be an administrator on your site.
Are you starting to see the bigger picture now?
Not only do you have to worry about people like Bob here but you have
potential employees, partners, clients, suppliers, affiliates,
and more that could have passwords or API Keys stored in LastPass.
Organizations that publish APIs could be impacted by this LastPass breach as
APIs accounts are often not secured using multi-factor authentication.
If your APIs are not securely managed by a solid API Gateway, make this a priority TODAY.
You may think that you are safe because your LastPass account was secured with one
of the 2 Factor Authentication (2FA) methods available to LastPass users.
You would be wrong.
It turns out that 2FA doesn't do anything to protect your
LastPass passwords or vault in this case.
LastPass did not use 2FA as part of the encryption of customers data or their password vaults.
LastPass simply uses 2FA to protect access to the live vault in the cloud but because
the threat actors gained access to the customer vaults directly,
2FA did absolutely nothing to protect user's data.
As you can see, the fallout from this affects a much broader group than just
LastPass users and EVERYONE needs to be vigilant to take necessary actions.
If you look, you will find multiple articles going back many years,
where people warned LastPass that their practices of storing unsecured
data and that their weak password and encryption policies were dangerous.
These were mostly unheeded by LastPass and now, the unthinkable has unfortunately happened.
I can guarantee that there will be many updates as this story unfolds but in my opinion,
this is the beginning of the end for LastPass. It's not that a data
breach is the end for an organization. Organizations can survive a data breach.
It happens.
But to quote Uncle Ben, with great power comes great responsibility. If you are the
guardian of secrets for millions, you can't afford to disregard best
practices and to put people at risk of potentially devastating financial
losses and the possibility of exposing them to the threat of physical harm.
We haven't even touched on special groups like victims or witnesses who
might be living in hiding due to a threat of violence. The fact that
LastPass did not encrypt all it's data is truly shocking.
As of this episode, the lawsuits have just begun and I imagine they
will grow once the true nature of the damage is fully understood.
If you are a LastPass customer or were a LastPass customer in 2022,
here is what you need to do right now:
First, change your master password.
This won't help secure your 2022 passwords but
should help with regards to online access to your LIVE password vault.
As difficult and time consuming as what I am about to say sounds,
You probably need to change the passwords for EVERY
account that was stored in your LastPass vault.
I know for a lot of people, this is hundreds or thousands of passwords.
I really can't say how much time you have to do this,
as that depends on your master password and the amount of effort spent trying to get your data.
There are two groups of people that are going to be hit first.
The first is, if you are a highly desired target for hackers.
People in this group might be celebrities, executives,
or even developers. Remember... LastPass was hacked by using a developer's account.
Also in this group are those who have passwords that are stored for crypto wallets,
banks without 2FA, APIs, or organizations that have something valuable for hackers.
REMEMBER: Because LastPass did not encrypt the urls, hackers already
know what accounts you have and what you might have that could be of value to them.
The second group that will be hit in the first wave will be the low-hanging
fruit. That is those whose encryption iteration count was set very low.
I'm sorry to say this.. but.. if you are in this group,
your passwords will be decrypted very soon, if they are not decrypted already.
If you are going to start changing all your passwords, start with your financial
institutions and any cryptocurrency accounts, as access to these accounts can do a lot of damage.
Oddly enough, from what I've seen,
financial institutions have some of the WORST password policies
and almost none of them use true multi-factor authentication to protect customers accounts.
Next, focus on those accounts that you might have clicked "save my credit card info" with.
Even if these sites followed best practices and did not store your actual credit card number,
a threat actor could still use access to these accounts this to
make unwanted purchases on your account.
Next scan through your accounts and start to loosely group them based on the risk
associated with someone getting access to the data in this account. Those accounts
in the list that are secured with multi-factor authentication will probably be a lower risk.
(unless of course, the LastPass breach also included access to the data
from your LastPass Authentication account that stores your 2FA info)
If you have a LastPass account, I also recommend doing the following:
If you are technically inclined,
go get your password vault using the method I describe in the show notes.
Next, decode the urls to examine what will soon
be visible to everyone and see if there are any security risks in these fields.
As crazy as it sounds, decoding a LastPass vault is very simple.
While I could have written the code to do this very easily, I simply to ask ChatGPT
to generate an application to decode the urls in the LastPass vault and it did so FLAWLESSLY.
Now, no matter if you are a technical user or not,
if you have a LastPass account, you should log into your account
and change the encryption iteration count to some value that is higher than 500,000.
And Last, but not least, you may want to follow the many
other people who are leaving LastPass forever.
You can go into your LastPass vault and export your passwords
as a CSV file and can then import them into a more secure password manager.
Personally, I recommend Bitwarden.
I am not paid anything to say that so this only comes from my experience as
a customer and the research I have done into the company.
If you are not familiar with Bitwarden, it is an open-source
password manager that has many of the same features as LastPass, BUT for free.
They also have a paid version for a ridiculously
low price of $10 per year (not month, but per year).
I HIGHLY recommend doing this as it allows you to use a hardware-based
token multi-factor authentication device, such as YubiKey, to secure your account.
I wish this story had a happier ending.
I know this news is not what most people wanted to hear but everyone,
including myself, can grow from this experience and the lessons learned.
Take a look at the show notes for more info, code, and links to this
developing story along with the resources you can use to make yourself more secure.
Subscribe to The Redacted Hacker to learn more about
the cybersecurity stories behind today's headlines.
My name is Brenton House.
I was never here and we never had this conversation.