LastPass says employee’s home computer was hacked and corporate vault taken | Ars Technica

This LastPass breach was widely published a couple of months ago, and now we are getting more details on what actually happened. The vector that the attackers use to get in was only possible with four people? Emphasis mine.

“This was accomplished by targeting the DevOps engineer’s home computer and exploiting a vulnerable third-party media software package, which enabled remote code execution capability and allowed the threat actor to implant keylogger malware,” LastPass officials wrote. “The threat actor was able to capture the employee’s master password as it was entered, after the employee authenticated with MFA, and gain access to the DevOps engineer’s LastPass corporate vault.”

The hacked DevOps engineer was one of <mark>only four LastPass employees</mark> with access to the corporate vault. Once in possession of the decrypted vault, the threat actor exported the entries, including the “decryption keys needed to access the AWS S3 LastPass production backups, other cloud-based storage resources, and some related critical database backups.”

Keeping secrets secure is hard, and even harder when those secrets end up on unmanaged equipment. Painful. See the LastPass announcement for full writeup.