#LASTPASS NEWS UPDATE#
#LASTPASS NEWS CODE#
#LASTPASS NEWS PASSWORD#

As this explainer from the 3blue1brown YouTube channel shows, it would take hackers with today’s technology an impossibly long time to brute force a key of that size.

#LASTPASS NEWS PASSWORD#

Toubba said that LastPass's encryption and hashing methods would make it 'extremely difficult' for the threat actor to 'brute force' guess master passwords - referring to the practice of guessing a password by using a computer to generate every possible key (aaaaa, aaaab, aaaac, etc.) until one of them works.ĪES-256 has a large number of possible keys 2 to the power of 256. The threat actor also accessed “fully-encrypted sensitive fields such as website usernames and passwords, secure notes, and form-filled data.” In bold text, its blog post said that these encrypted fields are 'secured with 256-bit AES encryption and can only be decrypted with a unique encryption key derived from each user's master password.” This is what has caused the most concern among onlookers as it enabled the attackers to copy the backups which LastPass keeps of its customers’ unencrypted account information “including company names, end-user names, billing addresses, email address, telephone numbers, and the IP addresses from which customers were accessing the LastPass service.” The threat actor - as the data stolen in the first attack was used to support the second attack, this suggests it is the same individual or group behind both - was then able to access the decryption keys for LastPass' cloud storage and dual storage containers.

#LASTPASS NEWS UPDATE#

In an update to its existing post, rather than a new one, Toubba, said that the data gained during the August breach was “used to target another employee, obtaining credentials and keys which were used to access and decrypt some storage volumes within the cloud-based storage service.”

#LASTPASS NEWS CODE#

The announcement follows the company disclosing an incident from August in which “some source code and technical information were stolen from our development environment” - details that were subsequently used in the most recent attack. 'If you reuse your master password and that password was ever compromised, a threat actor may use dumps of compromised credentials that are already available on the Internet to attempt to access your account,' LastPass CEO Karim Toubba explained, describing so-called credential stuffing attacks. People who use LastPass and have a weak master password, or one which may be associated with their email address or telephone number on another service, may need to consider that all of their passwords have been compromised and need to be changed, the company said. Password manager LastPass announced on Thursday that hackers had accessed and copied a backup of data including customers’ passwords in an encrypted format. LastPass: Hackers accessed and copied customers’ password vaults

Lastpass news