LastPass Breach: Unraveling the Crypto Theft Web
Posted: 2023-09-11
By: dwirch
Viewed: 60
No attachments for this post
In 2022, LastPass, a password management service, revealed a security breach. Password vaults, holding both encrypted and plain data for over 25 million users, were compromised. Post this incident, multiple cryptocurrency thefts targeted tech insiders, hinting at potential access to the stolen LastPass vaults.
Taylor Monahan, the lead product manager at MetaMask, a software cryptocurrency wallet, reported an evident pattern in these thefts since December 2022. Over $35 million in crypto was stolen from more than 150 people. Interestingly, these victims weren’t amateurs but seasoned, security-savvy crypto investors. No signs of typical preliminary attacks, like email or phone compromises, were evident. Most victims, Monahan found, had used LastPass to store their critical "seed phrase", essential for cryptocurrency access.
A seed phrase is so crucial that losing it means granting anyone instantaneous access to all associated crypto funds. Hence, the practice of storing them in encrypted containers or offline encryption devices like Trezor or Ledger wallets.
Nick Bax from Unciphered noted that if someone has your seed phrase, they have your funds. Bax and Monahan’s research suggests these thefts are connected and are the result of the LastPass breach.
Further, despite LastPass's initial statements downplaying the breaches in 2022, it was later revealed that the attacks were sophisticated, targeting specific employees and exploiting vulnerabilities in third-party software. A highlight was the vulnerability in Plex media software, which hadn't been updated by a LastPass employee since a patch in 2020.
Wladimir Palant, a security expert, pointed out potential weaknesses in LastPass’s password policies, especially concerning how many times a master password is encrypted. Palant noted that LastPass didn’t necessarily upgrade older users to more secure settings, making their accounts more vulnerable.
For those who have stored significant passwords in LastPass, especially related to cryptocurrency, the immediate advice is to change them and move any crypto to new offline wallets.
Although many are wary of password managers, some, like 1Password, seem to have better security protocols in place. They combine a user's account password with a locally generated Secret Key, ensuring more protection against breaches.
In conclusion, the LastPass breach showcases the critical importance of proactive security measures, especially for platforms trusted with safeguarding sensitive data. While the connection between the breach and the subsequent crypto thefts isn't definitive, the correlations are hard to ignore.
Comments on this post
No comments have been added for this post.
You must be logged in to make a comment.