LastPass customer password vaults stolen, targeted phishing attacks likely

Getty Visuals

LastPass prospects have been warned to continue to be vigilant to a wave of phishing attacks just after it was disclosed that cyber criminals stole customers’ encrypted password vaults for the duration of a breach previously this calendar year.  

In a weblog submit, the password manager mentioned that hackers extracted a copy of backup client vault info adhering to the August attack by applying cloud storage keys stolen from a LastPass personnel.  

LastPass revealed that this repository of shopper passwords is saved in a “binary format” and consists of the two unencrypted info, this sort of as site URLs, as well as encrypted data which include web page usernames and passwords, secure notes, and variety-filled data.  

The business explained that cyber criminals also stole a substantial volume of purchaser data, including names, email addresses, phone figures, and some billing info. 

“Once the cloud storage access vital and twin storage container decryption keys ended up received, the danger actor copied information and facts from backup that contained standard shopper account information and relevant metadata together with firm names, stop-person names, billing addresses, email addresses, phone numbers, and the IP addresses from which shoppers had been accessing the LastPass provider,” the organization stated in a assertion. 

CEO Karim Toubba insisted that only customers have the capability to decrypt protected passwords.  

“These encrypted fields continue to be secured with 256-bit AES encryption and can only be decrypted with a exclusive encryption essential derived from each user’s grasp password,” he said. 

Toubba also sought to quell ongoing fears that economical payment facts was stolen in the attack.  

“There is no proof that any unencrypted credit rating card information was accessed,” he claimed in a statement. “LastPass does not retail store full credit score card quantities and credit score card information is not archived in this could storage environment” 

Phishing fears 

This newest update from LastPass has raised significant concerns that stolen information and facts could be leveraged by threat actors to goal end users en masse. 

LastPass warned that hackers may perhaps try to use brute force attacks to guess learn passwords, but famous that owing to hashing and encryption methods utilized by the assistance, it would be “extremely difficult”.  

A essential problem highlighted by both equally LastPass and security specialists, however, is the prospective for people to be qualified by advanced phishing campaigns in the wake of this information.  

John Scott-Railton, senior security researcher at the College of Toronto’s Citizen Lab, warned that the threat actor(s) driving the breach is “clearly properly-resourced, able, and strategic”.  

“Latest LastPass breach might be worse than you imagine,” he mentioned in a Twitter thread. “Attacker failed to just get encrypted passwords. They acquired unencrypted URLs.” 

“I’m specifically worried about higher-value users and entities. Critical national security implications that almost certainly have to have mitigating.” 

Most recent #LastPass breach may perhaps be even worse than you imagine.Attacker did not just get encrypted passwords.They acquired unencrypted URLs.Assume: URLs with account tokens, API keys & qualifications, and so on… 1/https://t.co/rahrJDk0gf pic.twitter.com/wiuNXJEFiO

— John Scott-Railton (@jsrailton) December 23, 2022

Scott-Railton cited a independent thread on the incident which warned that while encrypted information was stolen in this incident, the internet websites that consumers visited were being not, that means that customers “really should anticipate to get phishing emails” in the coming days and months.  

It is thought that hackers will possible use this breach as a signifies to goal users and encourage them to adjust passwords and click on destructive hyperlinks.  

“Be Very watchful about password reset alerts in these future couple of months,” the information read through.  

LastPass issued a identical warning for customers, noting that it expects customers to be qualified by phishing attacks, credential stuffing, and other brute drive attacks “against on line accounts connected with your LastPass vault”.  

“In order to defend yourself from social engineering or phishing attacks, it is vital to know that LastPass will under no circumstances call, email, or text you and talk to you to click on on a connection to validate your individual facts,” the company claimed.  

Domino effect 

The LastPass revelations seem to have sparked a domino outcome between people of similar password administration products and services. Some took to social media to ponder the possible publicity of rival password managers, that also use cloud storage, to identical attacks.

Responding to worries relating to its very own solution on social media, 1Password confirmed that “all 1Password vault knowledge is stop-to-stop encrypted” on consumer gadgets, distancing alone from the notion that it could also experience a very similar attack.

The agency extra that “this indicates that even if our servers had been breached, all the attackers would have is encrypted gibberish that is worthless and unreadable”. 

“An attacker would require the two your 1Password account password and top secret important to decrypt the information in just it,” the organization stated. 

Some areas of this posting are sourced from:
www.itpro.co.uk