LastPass Breach

EXECUTIVE SUMMARY

On August 25th, 2022 LastPass CEO Karim Toubba confirmed that they suffered a breach in their developer environment which allowed attackers to steal source code and propriety information. LastPass is among the most widely used password managers in the world and is in use by over 33 million individuals and 100,000 businesses. As of the time of writing they have confirmed that there is no evidence that any encrypted password vaults or other customer data were impacted by the breach.

IMPACT

LastPass has confirmed via multiple sources that their investigations have shown no evidence of unauthorized access to any customer’s encrypted vault data. Additionally, they discuss their “zero knowledge” model in their recent security bulletin, which ensures that only the end user has access to decrypt their data vault.

DETAILED ANALYSIS

Two weeks ago, some “unusual activity” was discovered on portions of the LastPass development environment. They determined that an attacker gained access to the environment through a single compromised developer account. Once the account was compromised, the attacker was then able to exfiltrate portions of source code and other proprietary technical information.

LastPass has confirmed that the incident has been contained and they have “implemented additional enhanced security measures.”

MITIGATION STEPS

Although LastPass has confirmed that no customer’s master passwords or encrypted password vaults were affected, it is always important to ensure we are implementing good cyber hygiene when it comes to our own account security. Below are some of the recommended best practices for password security according to NIST (the full list of NIST recommendations can be found https://www.netsec.news/summary-of-the-nist-password-recommendations-for-2021/).

• Implement 2-factor authentication
• Password length is more important than password complexity
• Screen all new passwords against lists of commonly used and compromised passwords (i.e. Summer2022! is not a secure password since it is easily guessable)

SOURCES

• https://www.bleepingcomputer.com/news/security/lastpass-developer-systems-hacked-to-steal-source-code/
• https://www.digitaltrends.com/computing/lastpass-confirms-breach-customer-data-not-stolen/
• https://blog.lastpass.com/2022/08/notice-of-recent-security-incident/
• https://www.netsec.news/summary-of-the-nist-password-recommendations-for-2021/

CONTRIBUTING AUTHORS

• Daniel Mervis, Cybersecurity Analyst
• Stephen Jones, Vice President Cybersecurity

View all Dataprise Defense Digests here.