Home Security Hackers Had Entry to LastPass’s Improvement Methods for 4 Days

Hackers Had Entry to LastPass’s Improvement Methods for 4 Days

by crpt os


Password management solution LastPass shared more details pertaining to the security incident last month, disclosing that the threat actor had access to its systems for a four-day period in August 2022.

“There is no evidence of any threat actor activity beyond the established timeline,” LastPass CEO Karim Toubba said in an update shared on September 15, adding, “there is no evidence that this incident involved any access to customer data or encrypted password vaults.”

LastPass in late August revealed that a breach targeting its development environment resulted in the theft of some of its source code and technical information, although no further specifics were offered.

CyberSecurity

The company, which said it completed the probe into the hack in partnership with incident response firm Mandiant, said the access was achieved using a developer’s compromised endpoint.

While the exact method of initial entry remains “inconclusive,” LastPass noted the adversary abused the persistent access to “impersonate the developer” after the victim had been authenticated using multi-factor authentication.

The company reiterated that despite the unauthorized access, the attacker failed to obtain any sensitive customer data owing to the system design and zero trust controls put in place to prevent such incidents.

This includes the complete separation of development and production environments and its own inability to access customers’ password vaults without the master password set by the users.

CyberSecurity

“Without the master password, it is not possible for anyone other than the owner of a vault to decrypt vault data,” Toubba pointed out.

Additionally, it also said it conducted source code integrity checks to look for any signs of poisoning and that developers do not possess the requisite permissions to push source code directly from the development environment into production.

Last but not least, LastPass noted that it has engaged the services of a “leading” cybersecurity firm to enhance its source code safety practices and that it has deployed additional endpoint security guardrails to better detect and prevent attacks aimed at its systems.





Source link

Related Articles

xxxanti beeztube.mobi hot sexy mp4 menyoujan hentaitgp.net jason voorhees hentai indian soft core chupatube.net youjzz ez2 may 8 2023 pinoycinema.org ahensya ng pamahalaan pakistani chut ki chudai pimpmovs.com www xvedio dost ke papa zztube.mobi 300mbfilms.in صور مص الزب arabporna.net نهر العطش لمن تشعر بالحرمان movierulz plz.in bustyporntube.info how to make rangoli video 穂高ゆうき simozo.net 四十路五十路 ロシアav javvideos.net 君島みお 無修正 افلام سكس في المطبخ annarivas.net فيلم سكس قديم rashmi hot videos porncorn.info audiosexstories b grade latest nesaporn.pro high school girls sex videos real life cam eroebony.info painfull porn exbii adult pics teacherporntrends.com nepali school sex