LastPass (2022): Two Linked Intrusions and a Developer Home Machine

Summary

LastPass disclosed a series of connected security incidents through 2022. An initial intrusion in August 2022 compromised a developer account and source code. Information taken in that first incident was then used to conduct a second intrusion later in the year, which resulted in attackers obtaining backups of customer vault data.

Technical Root Cause

In the second intrusion, attackers targeted a senior DevOps engineer, one of a very small number of employees holding decryption keys for cloud storage backups. According to LastPass's own disclosure, the attackers exploited a vulnerability in a third-party media software package installed on that engineer's personal home computer, installed keylogging malware, and captured the master password as it was entered. That gave access to the engineer's corporate vault and, from there, the backup decryption keys.

The vault backups obtained contained both encrypted fields (such as stored passwords) and unencrypted metadata, notably website URLs.

Why It Mattered

The path ran through an employee's personal device and a piece of consumer software entirely unrelated to the company's own product or infrastructure. Standard scope definitions for a security programme, covering corporate endpoints and production systems, would not obviously include it, yet it was sufficient because of what that one individual could decrypt.

The unencrypted metadata in the stolen backups also mattered independently of the encryption: knowing which sites a user held credentials for is useful to an attacker even when the credentials themselves remain encrypted.

OWASP / CWE Mapping

• CWE-522: Insufficiently Protected Credentials
• OWASP A02:2021: Cryptographic Failures (regarding what was left unencrypted in backups)
• OWASP A01:2021: Broken Access Control (concentration of decryption capability in few individuals)

Lasting Impact

The incident is widely used to argue three points: that key-holding personnel need protection proportionate to what they can unlock rather than to their job title, that "encrypted at rest" is an incomplete statement unless it specifies which fields, and that a first breach should be treated as an input to the next, since data from one intrusion enabled the second here.

How Safeguard Helps

The relevant general principle for software supply chains is the same concentration question: identifying where a single credential, key, or account can unlock disproportionate access is an inventory and access-review exercise, and it is worth running specifically against the people and systems that can decrypt or publish, not only against production infrastructure.

References

• LastPass incident disclosures: https://blog.lastpass.com/posts/notice-of-recent-security-incident
• CWE-522: https://cwe.mitre.org/data/definitions/522.html