Slashdot Mirror
LastPass Password Service Hacked
Trailrunner7 writes "LastPass, a popular Web based password management firm, advised its customers to change the password they use to access the service following what the company said are signs that its network may have been compromised."
KeePass is really the best tool for handling passwords. Open source, crypted database, easy to use (CTRL+B for username to clipboard, CTRL+C for password), contains grouping and generates safe different passwords for every site. It's actually a great example of a well done open source project.
Using an online service for something like your passwords is just incredibly stupid. It's a really well known place to hack for someone who wants lots of passwords. Backup your encrypted password container to your own place, but never something like this.
LastPass is using the same security group as Sony....
It doesn't say that they were hacked for sure. Why the title proclaiming that it has?
Was the administrator password for LastPass "password"?
I'm getting tired of getting letters from companies I do business with informing me that my data may have been compromised.
Do sysadmins do their jobs anymore? Do companies conduct internal penetration testing anymore? Do they do internal audits anymore? I doubt it. They are too concerned with the monetary systems that take our money. Properly configured firewalls, IDP, and router systems be damned.
get off the internet. For crying out loud.
Note: This is taken from http://blog.lastpass.com/2011/05/lastpass-security-notification.html
***f****f****f******f******f**f**f*f*******f******f*f**f******f******f********
We noticed an issue yesterday and wanted to alert you to it. As a precaution, we're also forcing you to change your master password.
We take a close look at our logs and try to explain every anomaly we see. Tuesday morning we saw a network traffic anomaly for a few minutes from one of our non-critical machines. These happen occasionally, and we typically identify them as an employee or an automated script.
In this case, we couldn't find that root cause. After delving into the anomaly we found a similar but smaller matching traffic anomaly from one of our databases in the opposite direction (more traffic was sent from the database compared to what was received on the server). Because we can't account for this anomaly either, we're going to be paranoid and assume the worst: that the data we stored in the database was somehow accessed. We know roughly the amount of data transfered and that it's big enough to have transfered people's email addresses, the server salt and their salted password hashes from the database. We also know that the amount of data taken isn't remotely enough to have pulled many users encrypted data blobs.
If you have a strong, non-dictionary based password or pass phrase, this shouldn't impact you - the potential threat here is brute forcing your master password using dictionary words, then going to LastPass with that password to get your data. Unfortunately not everyone picks a master password that's immune to brute forcing.
To counter that potential threat, we're going to force everyone to change their master passwords. Additionally, we're going to want an indication that you're you, by either ensuring that you're coming from an IP block you've used before or by validating your email address. The reason is that if an attacker had your master password through a brute force method, LastPass still wouldn't give access to this theoretical attacker because they wouldn't have access to your email account or your IP.
We realize this may be an overreaction and we apologize for the disruption this will cause, but we'd rather be paranoid and slightly inconvenience you than to be even more sorry later.
We're also taking this as an opportunity to roll out something we've been planning for a while: PBKDF2 using SHA-256 on the server with a 256-bit salt utilizing 100,000 rounds. We'll be rolling out a second implementation of it with the client too. In more basic terms, this further mitigates the risk if we ever see something suspicious like this in the future. As we continue to grow we'll continue to find ways to reduce how large a target we are.
For those of you who are curious: we don't have very much data indicating what potentially happened and what attack vector could have been used and are continuing to investigate it. We had our asterisk phone server more open to UDP than it needed to be which was an issue our auditing found but we couldn't find any indications on the box itself of tampering, the database didn't show any changes escalating anyone to premium or administrators, and none of the log files give us much to go on.
We don't have a lot that indicates an issue occurred but it's prudent to assume where there's smoke there could be fire. We're rebuilding the boxes in question and have shut down and moved services from them in the meantime. The source code running the website and plugins has been verified against our source code repositories, and we have further determined from offline snapshots and cryptographic hashes in the repository that there was no tampering with the repository itself.
Again, we apologize for the inconvenience caused and will continue to take every precaution in protecting user data.
The LastPass Team.
UPDATE 1: We're overloaded handling support and
Karnal
I use this thing called my brain to store passwords. Sometimes I lose one, but it never gets hacked.
Apparently the hackers got only paswords, and not passwords. No big deal then.
"...advised its customers to change the password they use to access the service..."
Wow, I only have to change one password? Whew, that's a relief! For a minute there, I thought I had to change them all. (/sarcasm)
Consolidated password management works, as long as YOU maintain 100% control. Use Truecrypt locally for securing your password file. Sync the encrypted file to the cloud of you want an "online" backup.
Lastpass released this information yesterday and they did not state that they were hacked as the submitter does nor do they state that they were probably hacked as the article does. They stated that there was a mismatch in the amount of traffic between some of the servers and that whenever this occurs, they do an investigation, which usually turns out to be nothing. They felt it was probably nothing, but since they were unable to (so far) determine exactly what accounted for the difference in data transfers, they wanted to take the safe road and enforce a password change on all accounts.
ORIGINAL LASTPASS STATEMENT FROM MAY 4TH
(source: http://blog.lastpass.com/2011/05/lastpass-security-notification.html)
We noticed an issue yesterday and wanted to alert you to it. As a precaution, we're also forcing you to change your master password.
We take a close look at our logs and try to explain every anomaly we see. Tuesday morning we saw a network traffic anomaly for a few minutes from one of our non-critical machines. These happen occasionally, and we typically identify them as an employee or an automated script.
In this case, we couldn't find that root cause. After delving into the anomaly we found a similar but smaller matching traffic anomaly from one of our databases in the opposite direction (more traffic was sent from the database compared to what was received on the server). Because we can't account for this anomaly either, we're going to be paranoid and assume the worst: that the data we stored in the database was somehow accessed. We know roughly the amount of data transfered and that it's big enough to have transfered people's email addresses, the server salt and their salted password hashes from the database. We also know that the amount of data taken isn't remotely enough to have pulled many users encrypted data blobs.
If you have a strong, non-dictionary based password or pass phrase, this shouldn't impact you - the potential threat here is brute forcing your master password using dictionary words, then going to LastPass with that password to get your data. Unfortunately not everyone picks a master password that's immune to brute forcing.
To counter that potential threat, we're going to force everyone to change their master passwords. Additionally, we're going to want an indication that you're you, by either ensuring that you're coming from an IP block you've used before or by validating your email address. The reason is that if an attacker had your master password through a brute force method, LastPass still wouldn't give access to this theoretical attacker because they wouldn't have access to your email account or your IP.
We realize this may be an overreaction and we apologize for the disruption this will cause, but we'd rather be paranoid and slightly inconvenience you than to be even more sorry later.
We're also taking this as an opportunity to roll out something we've been planning for a while: PBKDF2 using SHA-256 on the server with a 256-bit salt utilizing 100,000 rounds. We'll be rolling out a second implementation of it with the client too. In more basic terms, this further mitigates the risk if we ever see something suspicious like this in the future. As we continue to grow we'll continue to find ways to reduce how large a target we are.
For those of you who are curious: we don't have very much data indicating what potentially happened and what attack vector could have been used and are continuing to investigate it. We had our asterisk phone server more open to UDP than it needed to be which was an issue our auditing found but we couldn't find any indications on the box itself of tampering, the database didn't show any changes escalating anyone to premium or administrators, and none of the log files give us much to go on.
We don't have a lot that indicates an i
A company like Sony could conceivably recover from a breach like this, but LastPass is a service explicitly targeted toward people who want their shit to be super-duper-secure. It's over.
'For we walk by faith, not by sight.' II Corinthians 5:7
sad to see so many organizations facing attacks from hackers! pity!
as "The Last Password You'll Have to Hack".
Seriously. I can't stand the thought of someone else having every password I use for everything. I use a system to generate passwords in a semi-hard-to-predict fashion for services I don't really care about, and have a number of 'strong' passwords for things that are important. Those passwords (and the information on where to use them) gets stored in a TrueCrypt container that I periodically update and sync with my VPS and my Dropbox. The TrueCrypt volume key isn't recorded anywhere - it's in my head, which is the safest place for it (because, seriously, if someone is actually going to go to the effort of torturing me to get my passwords, they're going to be in for a big let down).
LastPass Pasword Service may have been Hacked.
This is a good story, but the story isn't that they were definitely hacked. It's entirely possible that the anomalous data transfers they mentioned were caused by internal testing and not properly documented, based on the limited information we have available.
Here is a transcript wherein Steve Gibson talks at length about why LastPass is secure.
Let's play video games with mailmanZERO
I'm a LastPass user and last night I was forced to change my master password. Initially I was a bit suspicious about the request, so I took all the measures to make sure it was a genuine request from LastPass.com. When I was sure it was a safe request, I changed my master password to something even stronger than it was. I'm a paying user for their premium services, and in my opinion I must admit that their reaction to that casualty and possible data breach has been very open and reasonable. I would be very angry if instead they had an attitude like PSN. At least they took proactive countermeasures and are being honest to their customers, that attitude really deserves some kudos.
INCEPTION!
-Clio
Karma: Bad (mostly from not giving a fuck)
Blog: http://clintjcl.wordpress.com
http://www.twitlonger.com/show/a9bdm4
... does anyone believe storing sensitive informaiton in the "cloud" or the Internet?
Is not a good place to store sensitive information. Fly by night startup website operators are especially suspect. Better to write it down than trust them.
Oh for the love of god, this is way out of hand.
They weren't "hacked", they saw a tiny anomaly in their network traffic (which honestly, most companies wouldn't even have noticed), and decided to notify you about it and handle it in the most paranoid way possible. It's such a small thing that I wouldn't have expected most companies to even tell anyone it happened.
But somehow them behaving in a very commendable way for a security company has blown up into an absolute PR nightmare for them, with sites like BusinessWeek posting articles with the title "LastPass Loses Passwords for 1.25 Million Customers", which aren't even remotely correct. This is why companies don't disclose security breaches, because people are too dumb to understand the details, it gets sensationalized for no reason, and comes back to bite them hard.
Their implementation of this was pretty poor (trying to force almost everyone to change their password, when their server can't handle password changes at that rate), but their overall intentions were extremely good, and only make me even more confident in their service.
Sturgeon was an optimist.
They just got slasdotted, efuct, dugg, and twitter bombed all at once. Read more.
I8-D
I prefer KeePass + Wuala for even more security. I set up the KeePass file in a synced folder so I can use KeePass to login to Wuala.
http://www.gadberry.com/aaron/2011/04/29/wuala-for-dropbox-users/
They must have been using playstations at work...
LastPass: the one stop hack for all your identity stealing needs.
Maybe you store your passwords in your huge brain, but if you're using something like KeePass or 1Password on your computer, you're still storing your passwords on the internet. Granted, they're not in an amalgamated "hack me" target like LastPass, but it's not like they're securely offline, taped to your monitor.
www.clarke.ca
"LastPass Password Service Hacked." Did the creator of this title actually read the LastPass blog post? This is sort of like hearing someone cough and concluding they have lung cancer. Calm down people. No one's in any danger, thanks to LastPass not being Sony.
(shameless plug)
Password Grid for iPhone helps you generate a random grid of characters, based on a key you choose.
With the grid, you can visually convert an easy to remember passcode (like "secret") to something safer (like "8A2sN34v2s5T").
-You can have your converted passphrase copied to your clipboard or emailed to you for quick access.
-You can customize the grid generation complexity, with uppercase letters, numbers and symbols, which makes your encrypted passwords much more secure.
http://passwordgrid.com/
"LastPass, a popular Web based password management firm, advised its customers to change the password
They need to change the name of the company to "Second to LastPass"?
ping blog.lastpass.com
PING ghs.l.google.com (74.125.93.121) 56(84) bytes of data
ping lastpass.com
PING lastpass.com (96.255.24.82) 56(84) bytes of data.
Not very ironic when you know how DNS works.
I8-D
Here's some good material for you: http://goatse.cx/
If you were using a Yubikey with your account there is no risk with this kind of hack at all. :) makes a $25 usb key a great investment.
I use Password Gorilla. Written in Tcl/Tk, has Linux, Mac OS X and Windows standalone versions ready to go.
Description from the wiki:
Password Gorilla is a Tcl/Tk application which can run on Linux, Windows and Mac OS X. The source files written are supposed to be compatible between platforms. They are tested to run on Linux kernel (less than or = to) 2.6.30.5, Windows XP, Windows 7 and Mac OS X 10.6. So it is possible to work with this password manager in heterogenous environments. The Password Gorilla generated database is besides compatible to actual Password Safe 3.2 databases. The password is SHA256 protected and the database contents are encrypted with Bruce Schneier’s Twofish algorithm. Brute force attacks are prevented by key stretching.
I use Password Gorilla. Written in Tcl/Tk, has standalone downloads for Linux, Mac OS X, Windows. Been using it for the last few years, works well for me.
From the wiki:
Password Gorilla is a Tcl/Tk application which can run on Linux, Windows and Mac OS X. The source files written are supposed to be compatible between platforms. They are tested to run on Linux kernel (less than or = to) 2.6.30.5, Windows XP, Windows 7 and Mac OS X 10.6. So it is possible to work with this password manager in heterogenous environments. The Password Gorilla generated database is besides compatible to actual Password Safe 3.2 databases. The password is SHA256 protected and the database contents are encrypted with Bruce Schneier’s Twofish algorithm. Brute force attacks are prevented by key stretching.
Fuck the PSN hack, who gives a shit about that, 99.9999999% of the time banks will allow me to simlply refute credit card fraudulent purchases. It costs me NOTHING but inconvienience.
I was a loyal foxmarks user, then xmarks, then they told me I had to use lastpass.
Well look how this has worked fucking out then, I am PISSED - jesus fuck is there some important passwords in my account.
For fucks sake.
LastPass acquired Xmarks (browser plug-in for bookmark syncing) last year no mention of that database of more than 4.5 million users being breached.
- http://blog.xmarks.com/?p=2033
Stop spewing crap when you know nothing of the case!
"Using an online service for something like your passwords is just incredibly stupid. It's a really well known place to hack for someone who wants lots of passwords. Backup your encrypted password container to your own place, but never something like this."
Hey, retardo, don't you think the people who made it know this? All of your password are stored on their system ENCRYPTED. They are encrypted on YOUR computer, with a password only YOU (not them) before being stored in the cloud. When you retrieve the password you get the encrypted blob, and it is decoded on your system.
*IF* and I stress *IF* the last pass servers were hacked (and nobody knows if they were, so the slashdot headline is pure tabloid) then all they got was encrypted blobs of material for a very small number of users.
IF something was actually taken, and your master password was "ignorant" then you might be bruteforced in short time, if you picked something long and non dictionary then not this decade.
The lastpass people run a very tight ship and because they noticed a slightly anomaly on their network they couldn't immediately explain they warned everybody within 24 hours! (as opposed to some sites who waits weeks)
You wanna know how Lastpass works? Listen to this review from Leo Laports 'twit' network:
http://twit.tv/sn256
If Google really cared they would fix Android Chrome to reflow text, instead of discriminating
It's called, my memory.
It's so secure, I might not even know the password i use. I like it better that way, don't have any written down passwords, don't have any "cloud" storage of a password vault, don't have an encrypted file/database of passwords i use.
Sure, on the occasion I have to retype in passwords till I get the right one, but not that often.
Using a program for passwords, reminds me of this little true story:
My buddy kept all his phone numbers on his Atari 130XE, which I said, "What if you don't have any power?" His reply was, "That never happens."
Of course, a bit later, he blew a fuse, that put the apartment without power, and guess where his landlords phone number was? Yes, on the computer.
Anyways, i prefer the mental exercise of remembering, good practice.
Be seeing you...
This one is relevant to our [strike]interests[/strike] conversation http://xkcd.com/792/
But... the future refused to change.
-Something unexpected surprise-- Hello. My friend === http://www.happyshopping100.com/ ==== Dedi cated servi ce, the new style, so you feel like a warm spring!!! WE ACCEPT PYAP AL PAYMENT YOU MUST NOT MISS IT!!! thank you!!! Believe you will love it. **
Here's a few lines about sony vs. password storage: http://blog.mostof.it/secure-password-storage-a-myth/
You are living under a rock, no?
goatse.cx is down since the dawn of time.
Rather go to goatse.ru you insensitive clod.
Indeed. It is all over the world. To bad that honest comendable behaviour does not pay out in the end.