LastPass hacked and source code stolen

To quell panic (if there is any), this wasn't a breach of their production environment/storage. This was a breach of their source control via a compromised developer's account. Basically, Lastpass is now open source!
In terms of password storage, Lastpass and 1password are very similar in their storage/encryption practices.

Out of interest, I'd like to know how the developers account was compromised. Typically source control access requires MFA so even if the dev had been careless with their credentials, there should have been another line of defense.
 
Nothing to really worry about - you should have 2FA already enabled and there is no way to decrypt your database even if they managed to get hold of it.
 
Sinbad said:
User, password, 2fa and an email confirmation with action required if you try to access it from an unfamiliar location.
Click to expand...
And you can increase the security on your encryption hashing, etc in settings - which I what I did years ago when I started with LastPass. Perhaps it's time to finally find another service. Am paying for family at the moment.

Edit: I think it was this setting (password iterations)

1661496985327.png
 
From their blog post about it:

"
o All LastPass Customers,

I want to inform you of a development that we feel is important for us to share with our LastPass business and consumer community.

Two weeks ago, we detected some unusual activity within portions of the LastPass development environment. After initiating an immediate investigation, we have seen no evidence that this incident involved any access to customer data or encrypted password vaults.

We have determined that an unauthorized party gained access to portions of the LastPass development environment through a single compromised developer account and took portions of source code and some proprietary LastPass technical information. Our products and services are operating normally.

In response to the incident, we have deployed containment and mitigation measures, and engaged a leading cybersecurity and forensics firm. While our investigation is ongoing, we have achieved a state of containment, implemented additional enhanced security measures, and see no further evidence of unauthorized activity.

Based on what we have learned and implemented, we are evaluating further mitigation techniques to strengthen our environment. We have included a brief FAQ below of what we anticipate will be the most pressing initial questions and concerns from you. We will continue to update you with the transparency you deserve.

Thank you for your patience, understanding and support.

Karim Toubba

CEO LastPass

FAQs

1. Has my Master password or the Master Password of my users been compromised?

No. This incident did not compromise your Master Password. We never store or have knowledge of your Master Password. We utilize an industry standard Zero Knowledge architecture that ensures LastPass can never know or gain access to our customers’ Master Password. You can read about the technical implementation of Zero Knowledge here.

2. Has any data within my vault or my users’ vaults been compromised?

No. This incident occurred in our development environment. Our investigation has shown no evidence of any unauthorized access to encrypted vault data. Our zero knowledge model ensures that only the customer has access to decrypt vault data.

3. Has any of my personal information or the personal information of my users been compromised?

No. Our investigation has shown no evidence of any unauthorized access to customer data in our production environment.

4. What should I do to protect myself and my vault data?

At this time, we don’t recommend any action on behalf of our users or administrators. As always, we recommend that you follow our best practices around setup and configuration of LastPass which can be found here.

5. How can I get more information?

We will continue to update our customers with the transparency they deserve. "
 
Muttley said:
From their blog post about it:

"
o All LastPass Customers,

I want to inform you of a development that we feel is important for us to share with our LastPass business and consumer community.

Two weeks ago, we detected some unusual activity within portions of the LastPass development environment. After initiating an immediate investigation, we have seen no evidence that this incident involved any access to customer data or encrypted password vaults.

We have determined that an unauthorized party gained access to portions of the LastPass development environment through a single compromised developer account and took portions of source code and some proprietary LastPass technical information. Our products and services are operating normally.

In response to the incident, we have deployed containment and mitigation measures, and engaged a leading cybersecurity and forensics firm. While our investigation is ongoing, we have achieved a state of containment, implemented additional enhanced security measures, and see no further evidence of unauthorized activity.

Based on what we have learned and implemented, we are evaluating further mitigation techniques to strengthen our environment. We have included a brief FAQ below of what we anticipate will be the most pressing initial questions and concerns from you. We will continue to update you with the transparency you deserve.

Thank you for your patience, understanding and support.

Karim Toubba

CEO LastPass

FAQs

1. Has my Master password or the Master Password of my users been compromised?

No. This incident did not compromise your Master Password. We never store or have knowledge of your Master Password. We utilize an industry standard Zero Knowledge architecture that ensures LastPass can never know or gain access to our customers’ Master Password. You can read about the technical implementation of Zero Knowledge here.

2. Has any data within my vault or my users’ vaults been compromised?

No. This incident occurred in our development environment. Our investigation has shown no evidence of any unauthorized access to encrypted vault data. Our zero knowledge model ensures that only the customer has access to decrypt vault data.

3. Has any of my personal information or the personal information of my users been compromised?

No. Our investigation has shown no evidence of any unauthorized access to customer data in our production environment.

4. What should I do to protect myself and my vault data?

At this time, we don’t recommend any action on behalf of our users or administrators. As always, we recommend that you follow our best practices around setup and configuration of LastPass which can be found here.

5. How can I get more information?

We will continue to update our customers with the transparency they deserve. "
Click to expand...
Yeah, that is linked in the OP. At least they give some feedback. Unlike Capitec who went offline for days and no proper report (unless I missed it.).
 
noxibox said:
Have they fixed the problem they had with modifying data while offline?


They do store passwords in the online database, but they're only ever decrypted on your hardware, so an attacker would only get a chunk of encrypted data by breaking into 1Password's servers.
Click to expand...
Thank you for correcting me.
 
The day LastPass announced that they would be crippling their free tier even more, I switched over to Bitwarden and haven't looked back. Gone are those ugly, misaligned icons that cluttered up input fields. For me, Bitwarden is actually better than LastPass.
 
homeless_sapien said:
Yeah, that is linked in the OP. At least they give some feedback. Unlike Capitec who went offline for days and no proper report (unless I missed it.).
Click to expand...
You missed it...
mybroadband.co.za

Capitec is finally back online

Capitec spokesperson Francois Viviers has confirmed that all of the bank’s digital channels are online again, and any delayed payments should now have been processed.
mybroadband.co.za mybroadband.co.za
This follows a period of approximately 40 hours where Capitec’s digital channels were unavailable to the bank’s customers.

The bank explained that this was “to ensure a sustainable recovery after one of its banking system databases slowed down sporadically.”
Click to expand...
 
Muttley said:
From their blog post about it:

"
o All LastPass Customers,

I want to inform you of a development that we feel is important for us to share with our LastPass business and consumer community.

Two weeks ago, we detected some unusual activity within portions of the LastPass development environment. After initiating an immediate investigation, we have seen no evidence that this incident involved any access to customer data or encrypted password vaults.

We have determined that an unauthorized party gained access to portions of the LastPass development environment through a single compromised developer account and took portions of source code and some proprietary LastPass technical information. Our products and services are operating normally.

In response to the incident, we have deployed containment and mitigation measures, and engaged a leading cybersecurity and forensics firm. While our investigation is ongoing, we have achieved a state of containment, implemented additional enhanced security measures, and see no further evidence of unauthorized activity.

Based on what we have learned and implemented, we are evaluating further mitigation techniques to strengthen our environment. We have included a brief FAQ below of what we anticipate will be the most pressing initial questions and concerns from you. We will continue to update you with the transparency you deserve.

Thank you for your patience, understanding and support.

Karim Toubba

CEO LastPass

FAQs

1. Has my Master password or the Master Password of my users been compromised?

No. This incident did not compromise your Master Password. We never store or have knowledge of your Master Password. We utilize an industry standard Zero Knowledge architecture that ensures LastPass can never know or gain access to our customers’ Master Password. You can read about the technical implementation of Zero Knowledge here.

2. Has any data within my vault or my users’ vaults been compromised?

No. This incident occurred in our development environment. Our investigation has shown no evidence of any unauthorized access to encrypted vault data. Our zero knowledge model ensures that only the customer has access to decrypt vault data.

3. Has any of my personal information or the personal information of my users been compromised?

No. Our investigation has shown no evidence of any unauthorized access to customer data in our production environment.

4. What should I do to protect myself and my vault data?

At this time, we don’t recommend any action on behalf of our users or administrators. As always, we recommend that you follow our best practices around setup and configuration of LastPass which can be found here.

5. How can I get more information?

We will continue to update our customers with the transparency they deserve. "
Click to expand...
Not a fan of LastPass but appreciate and applaud their transparency.
 
backstreetboy said:
You missed it...
mybroadband.co.za

Capitec is finally back online

Capitec spokesperson Francois Viviers has confirmed that all of the bank’s digital channels are online again, and any delayed payments should now have been processed.
mybroadband.co.za mybroadband.co.za
Click to expand...
My friend, that is not a report on the issue form Capitec. That is purely a brief article form the Media, and a brief statement from Capitec. No report.

An example of a report would be the discussion I quoted above.
 
backstreetboy said:
Well Capitec wasn't hacked. Lastpass is just trying to save face by having this report.
Click to expand...
No they didn't. Their communication is piss poor though.

Lastpass is doing what every company should do when the service has been negatively hit by an important event.

Whether it is a week of downtime (look at you Sage) or data compromised.

In Africa "We are sorry for the inconvenience".
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X