Our Zero Knowledge encryption architecture is designed to protect customers’ sensitive information to defend against attempts to brute force encrypted data. "The threat actor may attempt to brute force and decrypt the copies of the vault data they took. LastPass notes what the threat actor could do with the obtained data and information:
Group names, encrypted sharing keys, encrypted super admin sharing key.Secure notes name, folder, attachment file name, attachment, encrypted attachment encryption key, note content.Site name, site folder, site username and history, site password and history, site note content, encrypted TOTP secret, custom fillable form-field, custom fillable form-field content.These are not "representative of the complete assembled 'vaults' that are rendered as human-readable form within each customer's LastPass client".īLOBs contain encrypted and decrypted data according to LastPass. The data is stored in aggregated format, BLOBs, which consist "of collections of binary strings separated into designated sections". LastPass deployed additional security technologies and controls in response to the incident, removed the development environment and created it from scratch anew, and "rotated all relevant cleartext secrets" and exposed certificates". Customer data or vault data was not obtained during the first hack. They managed to copy source code data, technical information and "certain LastPass internal system secrets". According to LastPass, the corporate laptop of a software engineer was compromised this allowed the threat actor to gain access to a cloud-based development environment. The summary of the first incident provides details on what happened. The threat actor used a vulnerability to gain access to non-production development and backup storage environments. LastPass reiterates that the two hacks were not "caused by any LastPass product defect or unauthorized access to - or abuse of - production systems".
The information is available here, but there is no blog post or official announcement about it yet on the site. LastPass confirms now that it has completed the investigation of the 2022 hack of its infrastructure.
0 kommentar(er)
