To be fair, many or most of the services you use, probably including your own employer, generally do something similar. We’re guessing that’s because LastPass, in common with most companies and online services, doesn’t literally require 2FA for every connection where authentication is needed, but only for what you might call primary authentication.
Unfortunately, as you can read above, two-factor authentication (2FA) didn’t help in this particular attack. There’s not an awful lot left in this paragraph if you drain out the jargon, but the key phrases seem to be “compromised endpoint” (in plain English, this probably means: malware-infected computer), and “persistent access” (meaning: the crooks could get back in later on at their leisure). While the method used for the initial endpoint compromise is inconclusive, the threat actor utilized their persistent access to impersonate the developer once the developer had successfully authenticated using multi-factor authentication. He threat actor gained access to the Development environment using a developer’s compromised endpoint. N unauthorized party gained access to portions of the LastPass development environment through a single compromised developer account.Ī follow-up announcement about a month later was similarly inconclusive: Taking advantage of your password manager’s vault is more convenient.Popular password management company LastPass has been under the pump this year, following a network intrusion back in August 2022.ĭetails of how the attackers first got in are still scarce, with LastPass’s first official comment cautiously stating that:
To store files like these securely, you might find yourself creating encrypted archive files and uploading them to a cloud storage service. You can even add file attachments to your vault, which makes it a great place to store tax documents, scanned copies of your passport and driver’s license, and other sensitive information. For example, you can create secure notes containing text like building entry codes and Wi-Fi passphrases. Password managers let you store more than just passwords. RELATED: The Best Way to Tackle the LastPass Security Challenge Storing More Than Passwords Google also offers the Password Checkup extension for Chrome, which it’s building into the browser, but this isn’t as powerful as the similar features built into password managers. Web browsers are slowly getting features like these, too-Google has a password-checker in its password manager.
There’s no need for a separate service to check whether your password has been stolen. This helps you stay up-to-date on protecting your digital accounts. They’ll point out weak and reused passwords to you and even tell you when a password you use has appeared in a leaked password database. Password managers have built-in warnings like LastPass’s Security Challenge and 1Password’s WatchTower.
0 kommentar(er)
