Hacker News Reader

>I saw a few mentions of uBlock origin in yesterday's thread

Statistically speaking it's probably because everyone has ublock origin installed, rather than it getting hacked. It's used by 5M+ users on firefox and "10,000,000+" on chrome. If ublock was really compromised you'd expect widespread reports of account compromise, rather than for only one password manager.

That's a good point.

I'm happy to delete my message if this way of finding out doesn't make sense.

Because it’s popular makes it an even bigger target.

Yes that is what is so weird about the whole thing.

1. If LastPass has been compromised, the scale of these attack would have been tens of thousands times higher. But it isn't. And I think it is reasonable to trust and assume Lastpass does not hold the masterpassword, as they have stated.

2. If it was browser extension, and clipboard sniffing, the scale would have been higher as well. But it is important to note there are many reports of those password have not been used for 3-4 years. They would have sat on a drove of password and decide today is the day. And yet report of these attacks, while scary, are still very very limited.

3. It is hard make a guess without everyone posting their OS, Computer, Browser, extensions, list of software, and even Router, Location, Network ( MITM ? ) etc.

4. We have tested the theory of Lastpass triggering the wrong email notification even with wrong password. So far doesn't seems to be the case here.

5. Nearly all reported cases are unique passwords. ( A few didn't specify )

6. There was a case where the whole Lastpass App and passcode was stored on an old laptop which hasn't been used for a long long time.

7. And yet there are also cases where account was only created in October / November this year. Meaning this activity is fairly recent. ( Doesn't rule out they could be two independent leaks or attack )

8. I was expecting someone working in InforSec would jump in, but I guess they are all on holiday at the moment.

9. This happened just after LogMeIn announced they will spin off Lastpass. I am thinking of the incident with Ubnt where the actual problem was internal, an employees hacking their own companies for bitcoin or something. Still I dont know how any Lastpass staff, without storing any Masterpassword could have gained access to it.

10. For now this doesn't seem like a coordinated PR attack on LastPass. If it was, seriously guys you need to do a better job with Social Media marketing. :P

Anyway It is an interesting thread to watch.

- Happy to vouch/solemnly declare that I have no financial interests in competing products, am not part of a PR campaign, etc. -- I prefer the title "Security Mensch", i.e. I'm just trying to fix problems when I see them :-) (I know you were saying it in jest! 0 offence taken)

- Thanks a lot for the great summary!

- To me, the hardest to understand is now 3 reports of people changing their passwords, and then receiving a new "Someone just used your master password to try to log in" email. That's mind boggling.

> 1. If LastPass has been compromised, the scale of these attack would have been tens of thousands times higher. But it isn't.

Wait wait, what do we know about the scale of the attack and how?

Even if the attacker had every single LP master password, that says nothing about how much resources they're spending hammering the service.

If the attacker only got a hold of password hashes or something, then it's true that they'll only be crack a limited amount. However, if that were the case you'd expect the people with easy passwords to get hit first, because an attacker would presumably go through the common words in the wordlist before the uncommon words, and finally a brute force search. Doing attacks in this manner would maxitimize the speed at which you gain access to accounts. However, this doesn't seem to be the case? You'd expect all the people with easy passwords "p4ssw0rd" or whatever to fall first, and in great numbers. This doesn't seem to be the case because many people seem to be swearing their passwords were unique/secure.

If the attacker got a hold of the raw passwords, then the speed of compromise could be easily thousands of accounts per hour. Just set up a bunch of TOR clients and bruteforce over that, or pay $10 for a few leaked VPN account credentials.

It's not a given that brute forcing is the strategy the attacker would choose. That might just lead to their Tor & VPN IPs getting quickly blocked, if they aren't already. There are only around 1500 Tor exit nodes and it's trivial to block them. Sometimes trying to stay under the radar might be the smarter choice.

Anyway, we still have no idea what the scale of the attack is or when exactly it started (IIRC someone reported this happening much earlier this month).

Specifically, if uBlock was compromised you'd expect widespread reports of cryptocurrency theft!

Curious to know why you shortened 5M but not 10,000,000

I'm one of the people that replied yesterday.

I haven't used LastPass since, at the latest, 2017. I had actually deleted all my passwords from my LastPass vault, but originally kept the account because of LastPass's password sharing feature, though I stopped using that as well. I believe I had the LastPass extension installed on both Chrome and Firefox, on both Mac and Ubuntu. I primarily used Chrome on Mac. I did have uBlock Origin on those setups as well, but I really doubt that's the vector, it's likely just incredibly popular with all users of Hacker News. My LastPass password was globally unique and between 15 and 20 characters long (with some symbols and digits). This password shows no matches at https://haveibeenpwned.com/Passwords . I considered sharing the password here, but just in case an old version of my vault is out there somewhere somehow I'm not going to. My understanding is that such a password would be so incredibly impractical to brute force that it's not worth considering. Unless I'm outdated/wrong on that, that means the password leaked in clear text (or hashed with a broken hashing method). As I haven't typed that password since at least 2017 and I can't imagine LastPass is storing passwords in clear text, I'm inclined to believe the password was stolen in clear text from client machines (either LastPass extension exploit or malware) in or before 2017. It's weird they were not used earlier, but as LastPass doesn't allow new IPs by default, maybe the attackers knew this and were sitting hoping an additional exploit would allow their user. But now they're just trying in the off chance someone clicks the "That's me" link in the email. This doesn't explain the more recent claims, personally I'm inclined to disregard them as unrelated noise (user confusion, reused password, etc).

Thanks -- my own case is pretty much identical to yours. My LastPass account was from 2017, and haven't used it since. I can also suspect a LastPass extension exploit from 2017 i.e. that's maybe how my password was stolen.

(I actually found an email from LastPass dating back to 2017 where they were confirming that a vulnerability with their extension had been fixed. The subject of that email is "Security Update for LastPass Extensions" and it dates back to March 31st, 2017)

I also agree with you that the attackers may have been hoping this time that some people would click the email link by mistake.

What's most baffling to me are the 3 independent reports of people changing their passwords, and getting the "Someone just used your master password" emails again i.e. the same attackers that attacked you and me somehow also having access to these new passwords. That can be explained in some ways (those 3 people are currently infected with the same malware) but that explanation seems, to me, very unsatisfying.

Almost identical case except I think I last used my account in 2018. No matches in haveibeenpwned. Password not saved anywhere (written only) and hasn't been typed in years.

I’m a LastPass user. I change my master password every 6 months. I received the attempted login from Asia email also. So… it isn’t just some exploit from 2017.

It still seems that the most likely answer might be that lastpass are incorrectly alerting that someone's correct passphrase had been used, and that the email is being triggered by a bug, or something like a login attempt using the wrong password from a suspicious IP.

The fact that lastpass support says that it means that the correct password was used doesn't mean it's true, the support staff might just be mistaken.

I agree that's a possibility i.e. false positive emails.

Counterpoints:

- LastPass officially responded to this story by saying that all of our passwords were compromised elsewhere and then someone attempted to login with those i.e credentials stuffing.

If it was a false positive email, it would have been easier to say that and a lesser reputation hit on them. Right now, they're saying "oh yeah those passwords were valid -- it's just that the attacker got them somewhere else, we weren't breached."

- The (now 3!) twitter reports mentioned in https://news.ycombinator.com/item?id=29719033 point out that someone attempted to login again after they changed their password. They received the "Someone just used your master password" email a 2nd time.

If those emails are not false positives (per LastPass), how could that have happened?

Agree here.

That's what I was hoping, but I tested it.

Used a VPN endpoint in a country that would surely get blocked. Attempted to login with wrong password, did not receive email. Logged in with correct passphrase, received email. Both scenarios looked the same on the login screen, so there wasn't any indication that I logged in with the correct password if I were the attacker

edit: last night they released something that says they sent some of those emails in error. I hope that is the case, but it's still not very re-assuring. I went through and changed all of my financial/critical accounts yesterday in precaution, today my bank account was locked out from brute force. Could be a coincidence, but that is the first time it's ever happened with that account

Seems like this was infact the case: "Our investigation has since found that some of these security alerts, which were sent to a limited subset of LastPass users, were likely triggered in error. As a result, we have adjusted our security alert systems and this issue has since been resolved."

I'd be pretty surprised if uBlock Origin had been exfiltrating data since 2017 without being caught, and (as the sibling comment points out) I'd expect a lot more than LastPass to be compromised.

I think it exists at an intersection of (relatively) trustworthy and necessary that makes it extremely popular among the kinds of people participating in these discussions.

My money is on compromised hardware, someone has bought the stealer logs and tried to scrape the whole lot at once.

If you got it, assume you have malware and all your passwords you have entered have been captured.

I agree that active malware is still a possibility. However:

I was in touch with a security researcher on Twitter who has access to the RedLine Stealer stolen credentials.

Neither my email nor LastPass password (the one that was compromised) were in there. The researcher looked for another email/password (of someone else affected who reported it here on HN and contacted me via email) and no result as well.

Best way to confirm this?

10's of GB of credential data is being harvested daily, and personally I think these stealer logs are the greatest security threat at the moment <insert usual lecture about 2fa / unique passwords here>.

To confirm, you would have to basically get access to all the stuff that has been sold, as the malware is pretty widely sold and distributed it is effectively ad infinite data set, and constantly growing.

A previous responder checked with a security researcher who has a Redline Dataset and was not in there. Some of the annecdotes suggest it is from an old breech likely before 2020. Given the age and how these things get bought / sold / compiled into bigger datasets, there is a fair chance that researchers have the data and hopefully lastpass can dig into it to find the source.

I haven't used uBlock and also got the LastPass email where someone had my password that wasn't stored or used anywhere else. I also haven't used my account in a few years.

Given these experiences, especially the same message after changing the password, makes me think that LastPass’ message is wrong - that it claims someone used your password, but the attacker is not actually doing so.

This would explain all the data I’ve seen so far, including LastPass’ reaction.

Speculation: LastPass might use this message even if someone tries an old password? Does that fit the data so far?

That's an interesting new avenue -- that older passwords are/were recognized too.

I just tried my old password and the error message only says to check the password -- there are no emails sent saying that someone attempted to log into my account with my password.

LastPass did change their systems, supposedly correcting for the issue that we all saw. So the test I just did also isn't really indicative of how their systems were working 2 days ago.

There are still remaining questions:

- the use of "some" and "likely" in LastPass' new announcement -- https://www.bleepingcomputer.com/news/security/lastpass-user...

- an explanation on how the false positives happened. What made the system think those attempts were using the correct master passwords?

- an assurance that no correct master passwords were used during the attack -- that they were all false positives (i.e. this attack was strictly credentials stuffing i.e. someone tried a bunch of passwords they obtained from other sources)

- finally, an explanation for the 3 independent cases where people changed their passwords and then received an email again saying someone had attempted to login using their passwords. Those emails may have been false positives as well, but we would have to know.

Great point that we have no idea how to verify anything now since they changed their systems.

I switched to using icloud keychain a while back, after a breach LastPass had a few years ago.

I've been using LastPass for work since mid-2018 as well as uBlock origin for Chrome; no blocked login notification so far.

+1 on uBlock Origin, but I think that's just a too common of an extension rather than the cause.

Agreed that it's quite common. Also, at least 2 users who were compromised (or at least, received the email from LastPass) have confirmed not using it. So it's a wrong trail.