As a password manager, security is our top priority. Even if the accessed data had included encrypted password vaults, 'the thief would have no way to get in without the password. Explore how LastPass keeps you safe during a security event or potential hack. While they may be hard to memorize, a. Rubenking, PCMag's Lead Analyst for Security, received the email from LastPass but says he's not worried. By contrast, strong passwords can take years (if not longer) to crack using even the most advanced brute-force attacks. LastPass plans on updating customers about the investigation as it proceeds. But for extra protection, consider activating the multi-factor authentication on your account. To login to LastPass, this hash is hashed once more to create a login password hash, which is sent to LastPass along with the user’s email address. “At this time, we don’t recommend any action on behalf of our users or administrators,” the company’s FAQ adds. To create the password used to encrypt the LastPass database, the master password is hashed with PBKDF2-HMAC-SHA256 with thousands of iterations (the default is 100.100 iterations). Instead, the company relies on a “zero knowledge” encryption model to unlock access to a user’s account. This involves storing the Master Password on the customer's device only. But a major concern is whether the stolen proprietary data will pave the way for cybercriminals to uncover vulnerabilities in the company’s password management products.įor now, the company’s FAQ notes LastPass doesn’t store information on the “Master Password” customers use to access their accounts over the password management service. LastPass hasn’t provided other details as the vendor embarks on the forensics investigation. The company has also posted an FAQ that notes all LastPass products and services have been operating normally, despite the breach. In response, the company has deployed “containment and mitigation measures,” and hired a leading cybersecurity firm to investigate the intrusion. “We have no evidence that this incident involved any access to customer data or encrypted password vaults,” the message added.
#LASTPASS PASSWORD MANAGER ATTACK CODE#
“We have determined that an unauthorized party gained access to portions of the LastPass development environment through a single compromised developer account and took portions of source code and some proprietary LastPass technical information,” the company said.
#LASTPASS PASSWORD MANAGER ATTACK SOFTWARE#
]]>
