As remote work becomes increasingly popular, companies and employees face new cybersecurity challenges. For example, last year, LastPass, a password manager application, experienced a severe security breach that exposed the security risks of remote work. In this article, we will explore the details of the incident and its implications for remote work and discuss potential solutions to prevent similar attacks in the future.
LastPass's security breach
LastPass is a popular password manager application that stores user passwords in a secure vault. However, in August 2022, LastPass experienced a severe security breach that exposed the security risks of remote work. According to LastPass, attackers gained access to the system through a lead DevOps engineer's machine.
Attackers' method of attack
As reported by DevClass, the attackers infiltrated LastPass's system in two waves. In the first wave, they attacked a compromised developer account in early August 2022. Then, the attackers used the data from the first attack to compromise the DevOps engineer's machine in the second wave, which started on August 12, 2022.
How the attackers accessed LastPass's system
The attackers targeted the engineer's home computer, exploiting a vulnerability in third-party media software, allowing remote code execution. Additionally, they installed a keylogger on the computer, enabling them to obtain the engineer's master password and easily access the LastPass corporate vault.
DevOps engineer's role in the breach
The target was one of four DevOps engineers with access to the decoding keys needed to enter a security-critical cloud-based storage service. Unfortunately, this led to data leakages, such as access and decryption keys for LastPass AWS S3 stored live backups.
Data leaked from the breach.
The attackers stole valid authentication data from the lead DevOps engineer, which provided access to a shared cloud environment. This resulted in data leakage, such as access and decryption keys for LastPass AWS S3 stored live backups.
Timing of the attacks
Interestingly, and likely coincidentally, at least 15 million users' data was stolen from Plex servers 12 days after the start of the second attack on August 12.
Personal and work boundaries are blurred at the application level.
The attackers targeted the engineer's home computer, which raises serious concerns about blurring personal and work boundaries at the application level. In addition, the engineer's personal computer was vulnerable because of the use of vulnerable consumer media software that allowed remote access, which was being used for security-critical functions such as protecting millions of customer authentication data. This highlights the need for stricter boundaries between personal and work-related activities, particularly regarding sensitive data.
Exploiting a vulnerability in third-party media software
The attackers exploited a vulnerability in third-party media software on the DevOps engineer's computer. This vulnerability allowed them to execute code remotely on the computer and install a keylogger.
Installation of keylogger
Installing the keylogger enabled the attackers to record keystrokes on the DevOps engineer's computer, including the master password for the LastPass corporate vault.
Obtaining the master password
Once the attackers had obtained the master password, they had full access to the LastPass corporate vault, which contained sensitive authentication data for millions of users.
Access to the LastPass corporate vault
With access to the LastPass corporate vault, the attackers could steal valid authentication data and obtain access to a shared cloud environment. This ultimately led to the leakage of critical data such as access and decryption keys for LastPass AWS S3 stored live backups.
What does DevOps have to do with this?
The hackers entered the LastPass system through a compromised developer account in both attacks. But why did this happen? The question can actually be answered with another question. Why was vulnerable consumer media software that allowed remote access on a home computer used for security-critical functions (namely, the protection of millions of customer authentication data)?
Compromised developer account
The attackers could enter the LastPass system through a compromised developer account. This highlights the importance of secure developer accounts and the need to monitor developer activity closely.
Vulnerability of consumer media software
Using vulnerable consumer media software on a home computer for security-critical functions demonstrates the risks of personal and work-related activities blurring at the application level.
Importance of network design
Daniel Cuthbert, co-author of the OWASP Application Security Verification Standard and a member of the British government's cybersecurity advisory body, tweeted that the incident raises many questions about working from home and even network design. The LastPass incident highlights the importance of network design, particularly regarding remote work.
Implications for remote work
Remote work is becoming increasingly popular, especially among developers. However, the LastPass incident raises severe doubts about whether remote work is sustainable in specific job roles.
Gaps in policy and implementation
The LastPass incident demonstrates the potential for gaps in policy and its practical implementation in remote work. Companies must ensure that their remote work policies are clear and compelling in practice, with measures in place to prevent security breaches.
Importance of automated management channels
Clemens Vasters, the lead architect responsible for event management at Microsoft, believes that such cases can only be prevented through automated management channels, that only the system knows the critical secrets, and no person can access them in any way. This highlights the importance of automated management channels for critical data, particularly in remote work.
Strictly separating development and production environments.
DevClass also emphasizes the importance of strictly separating development and production environments and obliging developers to work only on secure networks. This highlights the need for clear boundaries between personal and work-related activities, particularly regarding sensitive data.
Potential solutions to prevent similar attacks
To prevent similar attacks in the future, companies can take the following measures:
- Use secure developer accounts and monitor developer activity closely.
- Implement a network design that takes into account the risks of remote work.
- Use automated management channels for critical data.
- Strictly separate development and production environments
- Oblige developers to work only on secure networks.
Conclusion
The LastPass incident exposed the security risks of remote work, particularly in the context of personal and work-related activities blurring at the application level. The incident highlights the need for stricter boundaries between private and work-related activities and the importance of network design, secure developer accounts, and automated management channels for critical data. In addition, companies need to ensure that their remote work policies are clear and effective in practice, with measures in place to prevent security breaches.
