Case study — LastPass 2022 (developer workstation → encrypted vault exfil)

Case study — LastPass 2022 (developer workstation → encrypted vault exfil)

TL;DR: LastPass disclosed two related 2022 incidents. The August 2022 source-code theft enabled the November 2022 incident: attackers used the stolen knowledge to compromise a senior DevOps engineer’s home Plex Media Server (via an unpatched CVE), pivoted to the engineer’s laptop, captured master password / vault credentials via keylogger, and accessed LastPass’s encrypted vault backups in AWS S3 — including customer vaults. The “encrypted vault” defence held only as well as customers’ master passwords. Companion to case-study-okta-2023-support-system and case-study-snowflake-2024.

Why this matters

  • Encrypted vault data was exfiltrated — secret-store vendors’ worst-case scenario.
  • The attack vector was a senior engineer’s home PC, not LastPass corporate infrastructure directly.
  • The defence depended entirely on customer master password strength — most users had weak masters.
  • Disclosure was iterative and revised multiple times, mirroring the Okta pattern of initial under-statement.
  • LastPass eventually lost a large fraction of its user base.

The chain

August 2022 incident

  1. Attackers compromised a single LastPass developer environment.
  2. Stole source code and proprietary technical information.
  3. Did not access customer data at this stage.
  4. LastPass disclosed in late August, emphasised customer data was untouched.

November 2022 incident

  1. Attackers used details from the August theft to identify specific employees with high-value access.
  2. One targeted DevOps engineer ran Plex Media Server at home with unpatched CVE-2020-5741.
  3. Attackers exploited Plex remotely, gained code execution on home server.
  4. Pivoted to engineer’s corporate laptop (in same home network).
  5. Installed keylogger; captured master password as engineer used LastPass for work.
  6. Used credentials to authenticate to LastPass cloud storage (AWS S3) backups.
  7. Exfiltrated production-database backups + customer vault backups.

What was exfiltrated

  • Encrypted customer vaults — passwords, notes, etc. AES-256 with key derived from customer master password.
  • Unencrypted vault metadata — URLs of sites the user had entries for, last-used dates.
  • Customer email addresses.
  • Hashed master password verifier — for offline cracking.
  • Multi-factor settings.

Why “encrypted vault” wasn’t enough

The vault was encrypted, but:

  • Master password strength varied — LastPass historically allowed short passwords.
  • PBKDF2 iteration count was low for older accounts — 5,000 (early) up to 100,100 (newer default). Bcrypt / Argon2 would have been more attack-resistant.
  • With weak masters and low iteration counts, offline brute force is tractable.
  • Attackers obtained the hashed verifier; they could attempt offline crack at speed.
  • Metadata (site URLs) gave attackers a prioritised target list — try the highest-value sites first.

Users with master passwords like Password123 or short phrases were effectively compromised.

Detection failures

  • The August incident’s full scope wasn’t initially understood; the November incident leveraged knowledge.
  • The home-network → corporate-laptop pivot wasn’t detected before exfil began.
  • The S3 access patterns weren’t anomalous enough to trigger alerts; the engineer had legitimate AWS access.
  • Logs of the access were preserved, but post-hoc analysis was the only path.

What this teaches

  • Senior engineers’ home environments matter — particularly during pandemic-era remote work.
  • Personal-device CVEs (Plex Media Server, home routers, IoT) are part of the corporate attack surface.
  • Defence in depth on production data access — MFA on production AWS even for senior engineers; just-in-time elevation; dual-control on backup access.
  • Encryption is good but not magic — depends on user-controlled key strength; default to maximum-strength KDF.
  • Iterative disclosure damages trust — under-stated initial breach updates erode customer confidence.
  • Threat-actor patience — they spent months between August and November preparing the second incident.

Defensive baseline informed by LastPass

For password-vendor-like products:

  • Argon2id KDF with high cost.
  • Mandatory strong master passwords — minimum length 14, complexity scoring.
  • Per-user encrypted-at-rest for all metadata, not just vault entries.
  • Hardware-bound MFA for vault unlock, not just account login.
  • Zero-knowledge enforced.
  • Backup data isolation from production access patterns.

For enterprise customers using SaaS password managers:

  • Force strong master passwords organisationally.
  • Hardware MFA for vault unlock.
  • Inventory of high-value entries; rotate any vault entries reachable from compromise window.
  • Notice obligations to your own users / regulators.

IR posture for vault-vendor compromise

If your password manager is breached:

  1. Rotate every credential in the vault. This is the only certain mitigation.
  2. Prioritise by value: financial accounts, email, identity systems first.
  3. Enable hardware MFA on rotated accounts where possible.
  4. Audit recent activity on accounts that were in the vault.
  5. Move to a different vault if defence is no longer trusted.

Many LastPass users moved to 1Password, Bitwarden, or Apple Keychain after 2022-2023 disclosures.

Engineer hygiene lessons

For practitioners:

  • Separate work and personal devices strictly.
  • Patch home infrastructure — router, NAS, smart-home hubs, gaming devices.
  • Don’t run media servers that expose to internet without strict ACLs.
  • Use a hardware MFA key for work credentials.
  • Treat home network as untrusted when working remotely.
  • Don’t store production secrets in browser auto-fill / password managers if you can use hardware-backed alternatives.

These are obvious in retrospect; pre-2022 they weren’t universally practiced.

References