{"id":25702,"date":"2022-12-23T21:30:22","date_gmt":"2022-12-23T21:30:22","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/12\/23\/lastpass-vault-backups-get-stolen\/"},"modified":"2022-12-23T21:30:22","modified_gmt":"2022-12-23T21:30:22","slug":"lastpass-vault-backups-get-stolen","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/12\/23\/lastpass-vault-backups-get-stolen\/","title":{"rendered":"LastPass Vault Backups Get Stolen"},"content":{"rendered":"

<\/a>\n
<\/p>\n

\n

Heads up, LastPass<\/strong><\/a> account holders. Detailed in a blog post this week, new information is being released that is tied to a hack that took place earlier this year. At that time, the hack wasn\u2019t exactly newsworthy for us (we\u2019re just an Android blog), as LastPass said that a hacker merely gained access to a developer test environment and some source code. However, due to that hack, a subsequent event recently took place in which the hacker was able to compromise a LassPass employee\u2019s account and gain access to much, much more.<\/p>\n

As detailed by LastPass, someone has been able to gain access to encrypted backup copies of customer vault data. That vault data is what contains everything a user might store with the service. We\u2019re talking account usernames, passwords, banking information, and everything else. For a hacker, it could be the mother lode.<\/p>\n

According to LastPass, these vaults are encrypted with some serious security, meaning nothing should be able to access this stolen data with exception to a user\u2019s master password. Thankfully, those master password\u2019s are not stored by LastPass, so as long as the hacker is unable to brute force into the vault (guessing a correct password), most sensitive user data should remain safe.<\/p>\n

I\u2019m not a security expert so I\u2019ll let LastPass better explain what\u2019s happening.<\/p>\n

\n

To date, we have determined that once the cloud storage access key and dual storage container decryption keys were obtained, the threat actor copied information from backup that contained basic customer account information and related metadata including company names, end-user names, billing addresses, email addresses, telephone numbers, and the IP addresses from which customers were accessing the LastPass service.\u00a0<\/span>\u00a0<\/span><\/p>\n

The threat actor was also able to copy a backup of customer vault data from the encrypted storage container which is stored in a proprietary binary format that contains both unencrypted data, such as website URLs, as well as fully-encrypted sensitive fields such as website usernames and passwords, secure notes, and form-filled data.\u00a0<\/span>These encrypted fields remain secured with 256-bit AES encryption and can only be decrypted with a unique encryption key derived from each user\u2019s master password using our Zero Knowledge architecture. As a reminder, the master password is never known to LastPass and is not stored or maintained by LastPass. The encryption and decryption of data is performed only on the local LastPass client.\u00a0<\/span><\/p>\n

There is no evidence that any unencrypted credit card data was accessed. LastPass does not store complete credit card numbers and credit card information is not archived in this cloud storage environment.<\/span>\u00a0<\/span><\/p>\n<\/blockquote>\n

What Should You Do<\/h3>\n

So long as a LastPass user used the company\u2019s best practices in selecting a master password, the company says that it would, \u201ctake millions of years to guess your master password using generally-available password-cracking technology.\u201d That\u2019s reassuring. However, if you\u2019re a little worried about your information, you may want to start changing your passwords. That\u2019s if you want to be overly safe.<\/p>\n

For more information on what happened and what LastPass is doing about it, follow the link below.<\/p>\n

\/\/ LastPass<\/a><\/p>\n<\/p><\/div>\n