LastPass, disclosed a severe data breach that allowed threat actors to access encrypted password vaults. It occurred as a result of the same adversary launching a second attack on its systems.
According to the company, one of its DevOps engineers had their personal home computer hacked and infected with a keylogger as part of a sustained cyber-attack that exfiltrated sensitive data from its Amazon AWS cloud storage servers.
The threat actor leveraged information stolen during the first incident, information available from a third-party data breach, and a vulnerability in a third-party media software package to launch a coordinated second attack.
The original incident ended on August 12, 2022 whereas this intrusion targeted the company’s infrastructure, resources, and the aforementioned employee from August 12, 2022, to October 26, 2022.
In December 2022, LastPass revealed that the threat actor leveraged the stolen information from a senior DevOps engineer to access a cloud-based storage environment. This allowed the malicious actor to obtain access to the AWS S3 buckets that housed backups of LastPass customer and encrypted vault data.
The employee’s passwords are said to have been siphoned by targeting the individual’s home computer and leveraging a “vulnerable third-party media software package” to achieve remote code execution and plant a keylogger software.
LastPass did not reveal the name of the third-party media software used, but indications are that it could be Plex based on the fact that it suffered a breach of its own in late August 2022.
LastPass has now upgraded its security posture by rotating critical and high privilege credentials and reissuing certificates obtained by the threat actor, and it applied extra S3 hardening measures to put in place logging and alerting mechanisms.
LastPass users are highly recommended to change their master passwords and all the passwords stored in their vaults to mitigate potential risks.
Comments