LastPass Suffers Data Breach, Source Code Stolen
Researchers warned that cyberattackers will be probing the code for weaknesses to exploit later.
August 26, 2022
Cyberattackers have compromised the internal systems of LastPass, making off with source code and intellectual property.
The password management company said it detected anomalous activity in its development environment two weeks ago. After digging into the forensic data, investigators determined that someone (or someones) compromised a developer account to gain access to the network, taking "portions of source code and some proprietary LastPass technical information," according to an announcement posted this week.
Crucially, the adversaries weren't able to access customer data or encrypted password vaults.
"We utilize an industry-standard 'zero-knowledge' architecture that ensures LastPass can never know or gain access to our customers' Master Password [and it] ensures that only the customer has access to decrypt vault data," according to LastPass.
That said, Ajay Arora, co-founder and president at BluBracket, noted that attackers will be looking hard for potential weaknesses to exploit in the LastPass source code, potentially leading to follow-on attacks.
"An additional consequence that can occur from stolen or leaked source code is that this code can disclose secrets about an application's architecture," he said via an emailed statement. "This may reveal information about where certain data is stored and what other resources an organization may use. These factors could then equip bad actors to inflict additional harm on an organization after the fact."
Tom Kellermann, senior vice president of cyber strategy at Contrast Security, also said in a statement that the attackers could have been probing around to see if they could find an avenue into LastPass partner or supplier networks.
“Cybersecurity companies are being targeted to facilitate island hopping," he said. "After the FireEye breach, the industry should have woken up. In 2022, cybersecurity companies must practice what they preach. Many still underinvest in their own cybersecurity. Expect to be hit and prepare to respond.”
About the Author
You May Also Like
A Cyber Pros' Guide to Navigating Emerging Privacy Regulation
Dec 10, 2024Identifying the Cybersecurity Metrics that Actually Matter
Dec 11, 2024The Current State of AI Adoption in Cybersecurity, Including its Opportunities
Dec 12, 2024Cybersecurity Day: How to Automate Security Analytics with AI and ML
Dec 17, 2024The Dirt on ROT Data
Dec 18, 2024