DBSA:2015-0006
Disclaimer: as technology changes, advisories may become out of date or may no longer be relevant, please refer to the "Date" section of the header to be sure the advisory is recent as pertains to your situation.
Contents
Digibase Security Advisory - Lastpass Compromise
Keywords: Lastpass, compromise, passwords, database
DBSA ID: 2015-0006
Regarding: Lastpass Compromise
Writeup: Kradorex Xeron (talk) 17:00, 15 June 2015 (EDT)
Date: 2015 06 15
Last Modified: 20150615160030 by Kradorex Xeron
Who should take note: All Current and potential Lastpass users
Classification
Priority: HIGH
Rationale: Passwords may become compromised through credential leaks.
Severity: HIGH
Rationale: The service is used by people for the storage of highly sensitive information that may compromise up to and including financial information.
Spread of Issue: MULTI-PLATFORM MODERATE
Rationale: The service is fairly widely used on many different classes of devices
Description
Lastpass is a service that permits people to store sensitive information, including keys and passwords in a central database that is unlocked with one master password for convenience. The contained information can be used for various services such as forums, blogs, website administrator logins, banking websites, purchasing/shopping sites, system administrative control interfaces and the like.
Recently there was a compromise that ocurred on Lastpass's network that permitted attackers to harvest the user database including email addresses, password hashes and salts (that enhance the password hash strength) among other information. The fact the salts and password hashes were compromised means a chance for the user passwords could be recovered through attack techniques.
Lastpass claims that the "Vault" data was not compromised.
Mitigation/Solution
While it is strongly advised to at minimum rekey all stored private keys and change related passwords, it is also advised to reconsider usage of services such as Lastpass as authentication credentials are at the mercy of a third party's security practices that the users do not have exclusive control as to fully audit or otherwise restrict the service.
Given Lastpass's claims about "Vault" data not being compromised, it is still advised to consider that data stored could be at least partially compromised and act accordingly.
