LastPass Devs Were Phished for Credentials
LastPass has followed news of last month’s breach with details on a second attack in which developers were phished for their credentials.
In the January incident, the password manager’s parent, GoTo, said that in addition to stealing encrypted backups containing customer data, hackers nicked an encryption key last November.
“An unauthorized party gained access to a third-party cloud-based storage service, which LastPass uses to store archived backups of our production data,” said an alert at that time, which provided additional information on a breach discovered the previous August.
“Based on our investigation to date, we have learned that an unknown threat actor accessed a cloud-based storage environment leveraging information obtained from the [August] incident,” the alert noted. “Some source code and technical information were stolen from our development environment and used to target another employee, obtaining credentials and keys which were used to access and decrypt some storage volumes within the cloud-based storage service.”
The latest alert from LastPass said the same threat actor responsible for the previous breach executed a second attack that swiped data from the company’s AWS cloud storage servers. The miscreants could breach the company’s servers after tapping a DevOps engineer’s home computer, then infecting it with a keylogger.
“Due to the security controls protecting and securing the on-premises data center installations of LastPass production, the threat actor instead targeted one of the four DevOps engineers who had access to the decryption keys needed to access the cloud storage service,” LastPass said in the latest incident alert.
“The threat actor leveraged information stolen during the first incident, information available from a third-party data breach and a vulnerability in a third-party media software package to launch a coordinated second attack,” the alert noted. “The second incident saw the threat actor quickly make use of information exfiltrated during the first incident, prior to the reset completed by our teams, to enumerate and ultimately exfiltrate data from the cloud storage resources.”
“The anomalous behavior did not reveal itself immediately but became clear in retrospect during the investigation,” the password management service said.
Investigators were initially unable to distinguish “between threat actor activity and ongoing legitimate activity,” since the threat actor leveraged “valid credentials stolen from [the] senior DevOps engineer” to gain access to the shared cloud-storage environment.
“Given the number of people who rely on LastPass, it’s easy to pass quick judgment on back-to-back incidents. However, what this really shows is the difficulty of detecting attacks that use seemingly legitimate, yet stolen, credentials,” said Sharon Nachshony, security researcher, Silverfort. “By obtaining these credentials, the threat actor was able to masquerade as a highly trusted user, giving them the freedom to pivot into the cloud storage environment.”
As a result, “the corporate vaults holding privileged credentials often become a single point of failure,” Nachshony said. “Given enough reconnaissance time, a motivated attacker will try to understand how to compromise such vaults because, once they have such credentials, it’s like having a VIP pass to corporate resources. In the case of this attack, an additional layer of MFA to authenticate into the cloud storage environment may have provided additional protection.”
The latest LastPass incident highlights “an emerging vector of sophisticated cyberattacks: Targeting victim’s employees who have privileged access to internal systems, instead of attacking the victims directly,” said Ilia Kolochenko, founder of ImmuniWeb and a member of Europol Data Protection Experts Network.
“Following a series of devastating supply-chain attacks in the last three years, most organizations now take their third-party security extremely seriously and significantly limit data sharing with their external suppliers or vendors,” Kolochenko explained. “Creative cybercriminals have, however, discovered another low-haging-fruit attack vector—a grim derivate of the pandemic and working-from-home trend—victim’s employees.”
Because some tech employees at some multinational organizations and government agencies still work from home and use personal devices that are not monitored and protected by their employer, the risk of these types of attacks is rising. “Moreover, when working-from-home employees are using employer’s equipment, many foundational security tasks, such as timely installation of patches or restrictions to use unvetted software, may become less efficient and flawed,” said Kolochenko. “Eventually, instead of running frontal attacks against a well-protected corporation, cybercriminal gangs stealthily steal the ‘keys to the kingdom’ from a breached employee’s machine. Worst, such intrusions are hardly detectable by various anomaly detection systems and thus oftentimes remain unnoticed.”
In the year to come, companies should “expect a surge of sophisticated attacks on privileged tech employees aimed at stealing their access credentials and getting access to the ‘crown jewels,’” he said, advising that organizations “urgently consider reviewing their internal access permissions and implement additional patterns to be monitored as anomalies, such as excessive access by a trusted employee or unusual access during non-business hours.”
