In November 2022, the password manager service LastPass disclosed a breach in which hackers stole password vaults containing both encrypted and plaintext data for more than 25 million users. Since then, a steady trickle of six-figure cryptocurrency heists targeting security-conscious people throughout the tech industry has led some security experts to conclude that crooks likely have succeeded at cracking open some of the stolen LastPass vaults.
Taylor Monahan is lead product manager of MetaMask, a popular software cryptocurrency wallet used to interact with the Ethereum blockchain. Since late December 2022, Monahan and other researchers have identified a highly reliable set of clues that they say connect recent thefts targeting more than 150 people. Collectively, these individuals have been robbed of more than $35 million worth of crypto.
Monahan said virtually all of the victims she has assisted were longtime cryptocurrency investors, and security-minded individuals. Importantly, none appeared to have suffered the sorts of attacks that typically preface a high-dollar crypto heist, such as the compromise of one’s email and/or mobile phone accounts.
“The victim profile remains the most striking thing,” Monahan wrote. “They truly all are reasonably secure. They are also deeply integrated into this ecosystem, [including] employees of reputable crypto orgs, VCs [venture capitalists], people who built DeFi protocols, deploy contracts, run full nodes.”
Monahan has been documenting the crypto thefts via Twitter/X since March 2023, frequently expressing frustration in the search for a common cause among the victims. Then on Aug. 28, Monahan said she’d concluded that the common thread among nearly every victim was that they’d previously used LastPass to store their “seed phrase,” the private key needed to unlock access to their cryptocurrency investments.
MetaMask owner Taylor Monahan on Twitter. Image: twitter.com/tayvano_
Armed with your secret seed phrase, anyone can instantly access all of the cryptocurrency holdings tied to that cryptographic key, and move the funds to anywhere they like.
Which is why the best practice for many cybersecurity enthusiasts has long been to store their seed phrases either in some type of encrypted container — such as a password manager — or else inside an offline, special-purpose hardware encryption device, such as a Trezor or Ledger wallet.
“The seed phrase is literally the money,” said Nick Bax, director of analytics at Unciphered, a cryptocurrency wallet recovery company. “If you have my seed phrase, you can copy and paste that into your wallet, and then you can see all my accounts. And you can transfer my funds.”
Bax said he closely reviewed the massive trove of cryptocurrency theft data that Taylor Monahan and others have collected and linked together.
“It’s one of the broadest and most complex cryptocurrency investigations I’ve ever seen,” Bax said. “I ran my own analysis on top of their data and reached the same conclusion that Taylor reported. The threat actor moved stolen funds from multiple victims to the same blockchain addresses, making it possible to strongly link those victims.”
Bax, Monahan and others interviewed for this story say they’ve identified a unique signature that links the theft of more than $35 million in crypto from more than 150 confirmed victims, with roughly two to five high-dollar heists happening each month since December 2022.
KrebsOnSecurity has reviewed this signature but is not publishing it at the request of Monahan and other researchers, who say doing so could cause the attackers to alter their operations in ways that make their criminal activity more difficult to track.
But the researchers have published findings about the dramatic similarities in the ways that victim funds were stolen and laundered through specific cryptocurrency exchanges. They also learned the attackers frequently grouped together victims by sending their cryptocurrencies to the same destination crypto wallet.
A graphic published by @tayvano_ on Twitter depicting the movement of stolen cryptocurrencies from victims who used LastPass to store their crypto seed phrases.
By identifying points of overlap in these destination addresses, the researchers were then able to track down and interview new victims. For example, the researchers said their methodology identified a recent multi-million dollar crypto heist victim as an employee at Chainalysis, a blockchain analysis firm that works closely with law enforcement agencies to help track down cybercriminals and money launderers.
Chainalysis confirmed that the employee had suffered a high-dollar cryptocurrency heist late last month, but otherwise declined to comment for this story.
Bax said the only obvious commonality between the victims who agreed to be interviewed was that they had stored the seed phrases for their cryptocurrency wallets in LastPass.
“On top of the overlapping indicators of compromise, there are more circumstantial behavioral patterns and tradecraft which are also consistent between different thefts and support the conclusion,” Bax told KrebsOnSecuirty. “I’m confident enough that this is a real problem that I’ve been urging my friends and family who use LastPass to change all of their passwords and migrate any crypto that may have been exposed, despite knowing full well how tedious that is.”
LastPass declined to answer questions about the research highlighted in this story, citing an ongoing law enforcement investigation and pending litigation against the company in response to its 2022 data breach.
“Last year’s incident remains the subject of an ongoing investigation by law enforcement and is also the subject of pending litigation,” LastPass said in a written statement provided to KrebsOnSecurity. “Since last year’s attack on LastPass, we have remained in contact with law enforcement and continue to do so.”
Their statement continues:
“We have shared various technical information, Indicators of Compromise (IOCs), and threat actor tactics, techniques, and procedures (TTPs) with our law enforcement contacts as well as our internal and external threat intelligence and forensic partners in an effort to try and help identify the parties responsible. In the meantime, we encourage any security researchers to share any useful information they believe they may have with our Threat Intelligence team by contacting securitydisclosure@lastpass.com.”
THE LASTPASS BREACH(ES)
On August 25, 2022, LastPass CEO Karim Toubba wrote to users that the company had detected unusual activity in its software development environment, and that the intruders stole some source code and proprietary LastPass technical information. On Sept. 15, 2022, LastPass said an investigation into the August breach determined the attacker did not access any customer data or password vaults.
But on Nov. 30, 2022, LastPass notified customers about another, far more serious security incident that the company said leveraged data stolen in the August breach. LastPass disclosed that criminal hackers had compromised encrypted copies of some password vaults, as well as other personal information.
In February 2023, LastPass disclosed that the intrusion involved a highly complex, targeted attack against a DevOps engineer who was one of only four LastPass employees with access to the corporate vault.
“This was accomplished by targeting the DevOps engineer’s home computer and exploiting a vulnerable third-party media software package, which enabled remote code execution capability and allowed the threat actor to implant keylogger malware,” LastPass officials wrote. “The threat actor was able to capture the employee’s master password as it was entered, after the employee authenticated with MFA, and gain access to the DevOps engineer’s LastPass corporate vault.”
Dan Goodin at Ars Technica reported and then confirmed that the attackers exploited a known vulnerability in a Plex media server that the employee was running on his home network, and succeeded in installing malicious software that stole passwords and other authentication credentials. The vulnerability exploited by the intruders was patched back in 2020, but the employee never updated his Plex software.
As it happens, Plex announced its own data breach one day before LastPass disclosed its initial August intrusion. On August 24, 2022, Plex’s security team urged users to reset their passwords, saying an intruder had accessed customer emails, usernames and encrypted passwords.
OFFLINE ATTACKS
A basic functionality of LastPass is that it will pick and remember lengthy, complex passwords for each of your websites or online services. To automatically populate the appropriate credentials at any website going forward, you simply authenticate to LastPass using your master password.
LastPass has always emphasized that if you lose this master password, that’s too bad because they don’t store it and their encryption is so strong that even they can’t help you recover it.
But experts say all bets are off when cybercrooks can get their hands on the encrypted vault data itself — as opposed to having to interact with LastPass via its website. These so-called “offline” attacks allow the bad guys to conduct unlimited and unfettered “brute force” password cracking attempts against the encrypted data using powerful computers that can each try millions of password guesses per second.
“It does leave things vulnerable to brute force when the vaults are stolen en masse, especially if info about the vault HOLDER is available,” said Nicholas Weaver, a researcher at University of California, Berkeley’s International Computer Science Institute (ICSI) and lecturer at UC Davis. “So you just crunch and crunch and crunch with GPUs, with a priority list of vaults you target.”
How hard would it be for well-resourced criminals to crack the master passwords securing LastPass user vaults? Perhaps the best answer to this question comes from Wladimir Palant, a security researcher and the original developer behind the Adblock Plus browser plugin.
In a December 2022 blog post, Palant explained that the crackability of a LastPass master password depends largely on two things: The complexity of the master password, and the default settings for LastPass users, which appear to have varied quite a bit based on when those users began patronizing the service.
LastPass says that since 2018 it has required a twelve-character minimum for master passwords, which the company said “greatly minimizes the ability for successful brute force password guessing.”
But Palant said while LastPass indeed improved its master password defaults in 2018, it did not force all existing customers who had master passwords of lesser lengths to pick new credentials that would satisfy the 12-character minimum.
“If you are a LastPass customer, chances are that you are completely unaware of this requirement,” Palant wrote. “That’s because LastPass didn’t ask existing customers to change their master password. I had my test account since 2018, and even today I can log in with my eight-character password without any warnings or prompts to change it.”
Palant believes LastPass also failed to upgrade many older, original customers to more secure encryption protections that were offered to newer customers over the years. One important setting in LastPass is the number of “iterations,” or how many times your master password is run through the company’s encryption routines. The more iterations, the longer it takes an offline attacker to crack your master password.
Palant noted last year that for many older LastPass users, the initial default setting for iterations was anywhere from “1” to “500.” By 2013, new LastPass customers were given 5,000 iterations by default. In February 2018, LastPass changed the default to 100,100 iterations. And very recently, it upped that again to 600,000.
Palant said the 2018 change was in response to a security bug report he filed about some users having dangerously low iterations in their LastPass settings.
“Worse yet, for reasons that are beyond me, LastPass didn’t complete this migration,” Palant wrote. “My test account is still at 5,000 iterations, as are the accounts of many other users who checked their LastPass settings. LastPass would know how many users are affected, but they aren’t telling that. In fact, it’s painfully obvious that LastPass never bothered updating users’ security settings. Not when they changed the default from 1 to 500 iterations. Not when they changed it from 500 to 5,000. Only my persistence made them consider it for their latest change. And they still failed implementing it consistently.”
A chart on Palant’s blog post offers an idea of how increasing password iterations dramatically increases the costs and time needed by the attackers to crack someone’s master password. Palant said it would take a single GPU about a year to crack a password of average complexity with 500 iterations, and about 10 years to crack the same password run through 5,000 iterations.
Image: palant.info
However, these numbers radically come down when a determined adversary also has other large-scale computational assets at their disposal, such as a bitcoin mining operation that can coordinate the password-cracking activity across multiple powerful systems simultaneously.
Weaver said a password or passphrase with average complexity — such as “Correct Horse Battery Staple” is only secure against online attacks, and that its roughly 40 bits of randomness or “entropy” means a graphics card can blow through it in no time.
“An Nvidia 3090 can do roughly 4 million [password guesses] per second with 1000 iterations, but that would go down to 8 thousand per second with 500,000 iterations, which is why iteration count matters so much,” Weaver said. “So a combination of ‘not THAT strong of a password’ and ‘old vault’ and ‘low iteration count’ would make it theoretically crackable but real work, but the work is worth it given the targets.”
Reached by KrebsOnSecurity, Palant said he never received a response from LastPass about why the company apparently failed to migrate some number of customers to more secure account settings.
“I know exactly as much as everyone else,” Palant wrote in reply. “LastPass published some additional information in March. This finally answered the questions about the timeline of their breach – meaning which users are affected. It also made obvious that business customers are very much at risk here, Federated Login Services being highly compromised in this breach (LastPass downplaying as usual of course).”
Palant said upon logging into his LastPass account a few days ago, he found his master password was still set at 5,000 iterations.
INTERVIEW WITH A VICTIM
KrebsOnSecurity interviewed one of the victims tracked down by Monahan, a software engineer and startup founder who recently was robbed of approximately $3.4 million worth of different cryptocurrencies. The victim agreed to tell his story in exchange for anonymity because he is still trying to claw back his losses. We’ll refer to him here as “Connor” (not his real name).
Connor said he began using LastPass roughly a decade ago, and that he also stored the seed phrase for his primary cryptocurrency wallet inside of LastPass. Connor chose to protect his LastPass password vault with an eight character master password that included numbers and symbols (~50 bits of entropy).
“I thought at the time that the bigger risk was losing a piece of paper with my seed phrase on it,” Connor said. “I had it in a bank security deposit box before that, but then I started thinking, ‘Hey, the bank might close or burn down and I could lose my seed phrase.'”
Those seed phrases sat in his LastPass vault for years. Then, early on the morning of Sunday, Aug. 27, 2023, Connor was awoken by a service he’d set up to monitor his cryptocurrency addresses for any unusual activity: Someone was draining funds from his accounts, and fast.
Like other victims interviewed for this story, Connor didn’t suffer the usual indignities that typically presage a cryptocurrency robbery, such as account takeovers of his email inbox or mobile phone number.
Connor said he doesn’t know the number of iterations his master password was given originally, or what it was set at when the LastPass user vault data was stolen last year. But he said he recently logged into his LastPass account and the system forced him to upgrade to the new 600,000 iterations setting.
“Because I set up my LastPass account so early, I’m pretty sure I had whatever weak settings or iterations it originally had,” he said.
Connor said he’s kicking himself because he recently started the process of migrating his cryptocurrency to a new wallet protected by a new seed phrase. But he never finished that migration process. And then he got hacked.
“I’d set up a brand new wallet with new keys,” he said. “I had that ready to go two months ago, but have been procrastinating moving things to the new wallet.”
Connor has been exceedingly lucky in regaining access to some of his stolen millions in cryptocurrency. The Internet is swimming with con artists masquerading as legitimate cryptocurrency recovery experts. To make matters worse, because time is so critical in these crypto heists, many victims turn to the first quasi-believable expert who offers help.
Instead, several friends steered Connor to Flashbots.net, a cryptocurrency recovery firm that employs several custom techniques to help clients claw back stolen funds — particularly those on the Ethereum blockchain.
According to Connor, Flashbots helped rescue approximately $1.5 million worth of the $3.4 million in cryptocurrency value that was suddenly swept out of his account roughly a week ago. Lucky for him, Connor had some of his assets tied up in a type of digital loan that allowed him to borrow against his various cryptocurrency assets.
Without giving away too many details about how they clawed back the funds, here’s a high level summary: When the crooks who stole Connor’s seed phrase sought to extract value from these loans, they were borrowing the maximum amount of credit that he hadn’t already used. But Connor said that left open an avenue for some of that value to be recaptured, basically by repaying the loan in many small, rapid chunks.
WHAT SHOULD LASTPASS USERS DO?
According to MetaMask’s Monahan, users who stored any important passwords with LastPass — particularly those related to cryptocurrency accounts — should change those credentials immediately, and migrate any crypto holdings to new offline hardware wallets.
“Really the ONLY thing you need to read is this,” Monahan pleaded to her 70,000 followers on Twitter/X: “PLEASE DON’T KEEP ALL YOUR ASSETS IN A SINGLE KEY OR SECRET PHRASE FOR YEARS. THE END. Split up your assets. Get a hw [hardware] wallet. Migrate. Now.”
If you also had passwords tied to banking or retirement accounts, or even just important email accounts — now would be a good time to change those credentials as well.
I’ve never been comfortable recommending password managers, because I’ve never seriously used them myself. Something about putting all your eggs in one basket. Heck, I’m so old-fashioned that most of my important passwords are written down and tucked away in safe places.
But I recognize this antiquated approach to password management is not for everyone. Connor says he now uses 1Password, a competing password manager that recently earned the best overall marks from Wired and The New York Times.
1Password says that three things are needed to decrypt your information: The encrypted data itself, your account password, and your Secret Key. Only you know your account password, and your Secret Key is generated locally during setup.
“The two are combined on-device to encrypt your vault data and are never sent to 1Password,” explains a 1Password blog post ‘What If 1Password Gets Hacked?‘ “Only the encrypted vault data lives on our servers, so neither 1Password nor an attacker who somehow manages to guess or steal your account password would be able to access your vaults – or what’s inside them.
Weaver said that Secret Key adds an extra level of randomness to all user master passwords that LastPass didn’t have.
“With LastPass, the idea is the user’s password vault is encrypted with a cryptographic hash (H) of the user’s passphrase,” Weaver said. “The problem is a hash of the user’s passphrase is remarkably weak on older LastPass vaults with master passwords that do not have many iterations. 1Password uses H(random-key||password) to generate the password, and it is why you have the QR code business when adding a new device.”
Weaver said LastPass deserves blame for not having upgraded iteration counts for all users a long time ago, and called the latest forced upgrades “a stunning indictment of the negligence on the part of LastPass.”
“That they never even notified all those with iteration counts of less than 100,000 — who are really vulnerable to brute force even with 8-character random passwords or ‘correct horse battery staple’ type passphrases — is outright negligence,” Weaver said. “I would personally advocate that nobody ever uses LastPass again: Not because they were hacked. Not because they had an architecture (unlike 1Password) that makes such hacking a problem. But because of their consistent refusal to address how they screwed up and take proactive efforts to protect their customers.”
Bax and Monahan both acknowledged that their research alone can probably never conclusively tie dozens of high-dollar crypto heists over the past year to the LastPass breach. But Bax says at this point he doesn’t see any other possible explanation.
“Some might say it’s dangerous to assert a strong connection here, but I’d say it’s dangerous to assert there isn’t one,” he said. “I was arguing with my fiance about this last night. She’s waiting for LastPass to tell her to change everything. Meanwhile, I’m telling her to do it now.”
First, nobody’s vault has been breached, unless their password was on a rainbow list or somebody just randomly guessed it. It is a literal physical impossibility to crack the encryption with any known technology on planet Earth. There is no technology we could invent that would break the encryption, not even quantum computers. This whole nonsense is getting old. The math has been done, and even if every particle in the known universe was dedicated to cracking the encryption, it would still take a million years to crack it. This fear mongering is quite tiresome.
” or somebody just randomly guessed it. ” – So you maybe understand brute forcing, slightly?
wikipedia.org/wiki/Brute-force_attack (You may benefit from a basic primer on the subject.)
Do you really believe there’s no such thing as a weak password or a flawed encryption regime?
If anyone is “mongering” anything here it’s a total misunderstanding of theoretical crypto as
it’s actually applied in the real world with a few “old and tiresome” adages thrown in for fluff.
Weaker passwords (or reused ones) can be discovered quickly on consumer grade h/w. Yep.
No fantasy space magic or higher math required.
“It is a literal physical impossibility to crack the encryption with any known technology on planet Earth”
Maybe keep the pontificating in Church where it belongs. Your religion is missing crucial details here.
There’s growing evidence that a subset of these vaults are compromised, your opines nonwithstanding.
(I’ll grant reading seems old and tiresome to someone who thinks they know everything already, though.)
“An underlying assumption of a brute-force attack is that the complete key space was used to generate keys, something that relies on an effective random number generator, and that there are no defects in the algorithm or its implementation. For example, a number of systems that were originally thought to be impossible to crack by brute force have nevertheless been cracked because the key space to search through was found to be much smaller than originally thought, because of a lack of entropy in their pseudorandom number generators. These include Netscape’s implementation of Secure Sockets Layer (SSL) (cracked by Ian Goldberg and David Wagner in 1995) and a Debian/Ubuntu edition of OpenSSL discovered in 2008 to be flawed.[12][13] A similar lack of implemented entropy led to the breaking of Enigma’s code.”
-They must have used every particle in the known universe. It’s the only possible way.
What “fear mongering”?
“These so-called “offline” attacks allow the bad guys to conduct unlimited and unfettered “brute force” password cracking attempts against the encrypted data using powerful computers that can each try millions of password guesses per second.”
It’s password cracking, not encryption cracking.
That is factually incorrect and simply not true.
Your reply was much nicer than mine.
Ok please explain.
“Explain why an extremely obtuse statement is extremely obtuse.”
Lest we find ourselves trying to disprove all false understandings,
the correct answer is “No, you continue with your beliefs, it’s ok”
and you continue walking. Do not break stride, no eye contact.
If people decide to be extremely wrong, that’s defacto their right.
Troden wasn’t replying to you, if that’s the misunderstanding.
“The math has been done”
Yes, the math has been done, unfortunately that is the only part of your entire comment in regards to this article that is actually correct.
Cryptology has been around for thousands of years so it’s not new. In simple terms, the strength/resilience of modern cryptography generally relies on the degrees of randomness (entropy) ie; the greater the entropy the safer you should be, which is achieved by determining the password length and iterations of the hashing algorithm.
If you read the article you would note that Brian pointed this out with examples, citing the fact that a new LP account user today is forced to have a 12 character minimum password and 600,000 iteration set as default, which with today’s hardware is generally deemed secure. This however was not always the case. Prior to 2018 and right back to LP’s inception, these standards were not enforced, leaving early adopters and older accounts at risk as LP made no effort to enforce new standards on longtime users.
A malicious actor/s with the resources to breach and exfiltrate data on a grand scale, in such a sophisticated manner, I can guarantee you, has access to the resources to fill a warehouse with GPU’s and go the grind. A 6 character/5000 iteration vault would not last long and even if it did, they are in it for the long game and have all the time in the world. Remember, there were 25.6 million vaults stolen, so chances some vaults have less the minimum security is pretty high.
The fear mongering is warranted and you are full of sh&t!
Your reply is mostly on point, and the OP is making BS assertions, however there is one place where I will challenge you.
“they are in it for the long game and have all the time in the world”
The value of the credentials is going down every day. Services shut down or get merged. More services add 2FA. People close/drain accounts. Crypto wallets get drained (legitimately by the owner). People change passwords, even if just due to being forced by a “system upgrade” by the provider. Payment methods attached to accounts expire.
Just think for yourself how the news of your passwords from 1 year ago being compromised would feel, vs the news of your passwords from 10 years ago being compromised.
I know from personal experience that if this news came 5-10 years later like it should have if Lastpass had properly upgraded old accounts, then my exposure would be much lower.
“The value of the credentials is going down every day. Services shut down or get merged …”
Point taken. I will grant you LP credential/password risk related to this breach reduce by the day as more users become aware and proactively harden their online security, however I had I other issues in my head when I made the comment and should clarify where I was coming from.
I wasn’t alluding to just passwords and saved credentials because it is far broader than that. LP markets itself as more than just a Password Manager. It has a Sharing Centre and sells family/shared accounts that can link/synchronise to multiple individual accounts; are they at risk? The Document Vault is pushed as a secure environment for storing effects, such as seed phrases, crypto wallets and other unique urls; are they at risk? The article points out that they most possibly are. How about wills, stock and property portfolios, personal contacts, sensitive medical, legal or other financial documentation? A seemingly endless list of extortion material.
Yes, users should have properly encrypted such documents prior to uploading them to the vault, but I’m sure a significant number haven’t and these items won’t devalue over time. For these reasons I don’t believe bad actors will give up brute forcing any time soon, because they will see it as a digital lucky dip/gold mine. They will only give up once they decide it’s no longer worth their time/effort, in which case they’ll just dump it all on the dark web for the bottom feeders to pick at. The risk will never end however small it becomes.
I agree wholeheartedly with ChipBoundary. It is tiresome, it would take a long time to crack the encryption, and the whole nonsense is getting old!!!
So it’s about time that LastPass started acting responsibly so these kinds of articles can be made a thing of the past. It’s about time that they, and really any security company, acted responsibly so that the poor schmoes who ended up losing 35million dollars in aggregate won’t have to go through that pain ever again.
Another frigging breach from another company making claims about how secure they are, and then covering up their tracks when things go awry. It’s about time the security industry stood up and acted responsibly, so I wouldn’t be so tired! Dammit!!!
they’re not cracking the encryption per say… they’re cracking the key to the encryption which is effectively a hash of the master password.
Though I’m not sure they’re doing that either… with lastPass you can recover/change your master password, so that implies that they can decrypt/re-encrypt the stored passwords without the master password. (though I’m pretty sure that’s only with older accounts…)
What. No. Any short password can be broken. By brute force. It’s just a matter of time. At least 12 char password to be safe.
And even if they updated the password and the iterations there’s no telling if the last pass guys were keeping old copies of the encrypted password vaults!
I haven’t used lastpass for… almost a decade, but if migration still required an export-import system that isn’t done server side, wouldn’t that theoretically create an additional attack surface?
You can encrypt your data all you want, but I remember when I moved, I got a bunch of unencrypted csv files to import into the new service (my current setup is is 1pass for non-crypto, keepassxc on a NAS for anything crypto related, entirely self-custodied and I run my own nodes). It feels like this is a vector that doesn’t get mentioned but people are terrible with data hygiene and I think that it’s entirely possible (theoretically) that an opportunistic stealer attack can achieve something akin to this without needing to rent 40 RTX 4090s from vast.ai or something, in which case you can just run a regex search in grep (GNU flavor) and voila.
Just speculating of course, I have no evidence in support of my theory here except historical practices, but it feels like a possibility, just saying.
That’s a whole heap of word salad to basically say “if people are careless with their passwords, people might steal them”. You export to a plaintext CSV, import passwords into a new system, and delete the CSV. For extra paranoia points, download the CSV to a RAMdisk so it never touches permanent storage. If people are sloppy and keep the plaintext csv around, then that’s on them, just like if they keep their passwords in an unencrypted browser password manager or worse.
Only 4 with keys to the kingdom, check. Being allowed to use it outside of a particular office suite, fail, but if you must, not off campus, but if you must, most definitely not on a domestic setup. Price of a second internet connection, router & dedicated devices, a few $/£/€, watching the business lose all credibility, priceless.
Whilst the technical astute youngsters may giggle at the exploits portrayed by Hollywood, perhaps they should all be made to watch The Net, Hackers, Firewall, Swordfish and War Games*. Plus Eraser & M:I for in-person breaches. And then have to explain what they’ve learnt and how they won’t be caught out.
* Full admission, all my test passwords are “Pencil”
LastPass are holding a webinar about how organizations can protect against breached credentials. Its all over their homepage and even their Chief Revenue Officer is joining. Their CEO is probably hiding.
Just mentioning the unique signature is enough.
Non-techie here. Should I change my LastPass master password?
You should, and you should also go into your LastPass settings, and click the button at the bottom to show the “advanced settings”, and make sure that your iteration count is set appropriately high enough. Or… You could just migrate to 1Password, since they’d require both your password and your secret key. I use KeePass2 with plugins to enable multi-factor auth, and store my vault in an encrypted cloud storage account which automatically syncs to all my devices. Thus, achieving much the same functionality as LastPass or 1Password, but better in some ways. For one thing, every piece of data in the vault is fully encrypted, and not just the passwords. With LastPass, the website URLs are plaintext, and so LastPass knows which websites you visit. That is a privacy violation and deal-breaker to many. Realize that this is due to technical imperatives, which is why none of these cloud solutions are appropriate IMHO. Also, KeePass users can access their vaults offline, and even transfer it to an air-gapped system. Users are also able to create a fake vault which links to dummy accounts which they’re able to hand over in case of force, and achieve some plausible deniability, all while keeping the real password vault hidden and secret. As the old saying goes, why would they bother cracking your password when they can just beat it out of you? No cloud provider is going to protect you if they are coerced. So, you should consider your individual threat model, and take necessary precautions.
Well, yes, but also all the passwords in lastpass too. Since hackers already have the vault, you changing the master password does not affect the files they have. But if you had a really strong master password at the time of the hack and the account was set to 100,000 iterations, you should be safe.
One salient fact this article fails to provide is whether or not these indivduals were, in fact, using weak passwords and low iteration factors. If that’s the case, then the onus is on them. We may indeed argue that LastPass were derelect in their duty, as well. However, if these victims were actually using reasonably strong passwords and iteration factors, then this points to there being a MUCH worse problem. Ideally, that’s the big question which is critical that we find out about, because the implications are quite dire.
Really? Did you read the part of the story about an interview with a victim who lost $3M+ because he used an 8-character master password?
Also, researchers quoted in the story said LastPass likely did not force people who had picked shorter passwords to migrate to the new stronger requirements. Nor did they move some amount of users to the higher number of iterations.
I used LastPass years ago, before their price increase. I used a free feature to check my password strength. It identified my weakest and duplicate passwords and I strengthened them until I had a rank in the top 1% of all LastPass users.
My master password was long and strong with 30 characters, using no personal or dictionary words or Diceware.
I used a YubiKey for 2FA. As I recall, they moved YubiKey 2FA and the password strength checker from the free plan to their premium plan.
My critical accounts are also protected with 2FA. I am not a crypto investor, but I do not keep my 2FA seed or recovery codes in my password vault. They are rarely needed and kept in a separate air-gapped vault in a fireproof safe.
I would also caution businesses that accept crypto payments that they may be targeted by hackers, and should use strong website, email, and crypto account security.
I ended up defining and assigning 4 security levels for my accounts : low, medium, high, and very high security, with 80, 100, 120, and 140 bits of minimum entropy, respectively. [Choose your own values.] No duplicate passwords.
I am now watching for password managers to begin implementing Post Quantum Cryptography (PQC).
are you looking for help to recover your lost Bitcoin? CyberTrace can help you contatct them and be happy again.
Email: cybertraceservice AT hotmail Dot com
Hotmail – because not only are you secure, you’re legit.
Remember. Online password managers have multifactor “authentication” which doesn’t apply to breached or leaked data. Hackers don’t need MFA in this case. It leads to a false sense of security and many users choose weak master passwords because they think they’re protected by MFA. So they wind up being decrypted early.
For me, offline password managers with multifactor encryption (all factors needed to decrypt) are superior. Users like me can handle backups and syncing ourselves.