LastPass breach could've been stopped with a 3-year-old Plex update

The sole responsibility for this issue starts and ends with LastPass.

For a security focused company, there is no excuse for a threat model to not include insider threats, vulnerable software inside an employees network, and potential phishing of employee credentials.

If it wasn't going to happen through Plex, it would have happened through something else.

Them pivoting like this is such a bad faith attempt at pinning the blame on a company that did everything right with regards to security. They should own up, and not try and throw another company under the bus. Even naming Plex as part of the attack chain seems disingenuous at best.

> a malicious party installed a keylogger onto a senior engineer's home computer through an exploit in Plex, the personal cloud service for movie storage and streaming, and was able to break into corporate-level caches as a result

> "For reference, the version that addressed this exploit was roughly 75 versions ago," a LastPass spokesperson said.

Irrelevant, what's relevant is how come LastPass employees can access sensitive customer information on their production from a personal laptop

Beyond that, it would have been avoided if LastPass implemented strict policies about accessing corporate systems using a personal computer. You can't control a 100% what happens on a corporate system, but allowing a personal device, which introduces a larger attack surface with all these softwares present, to access that kind of sensitive data with all the potential is highly irresponsible.

Sure, Plex had a security flaw, and the system owner didn't update its software in a timely manner, but ultimately the responsibility falls upon LastPass who allowed this system to access their network in the first place.

For a business that focuses and sells a product based upon good security practices, the optics are quite damaging for their reputation.

> But it turns out that the engineer had a big part to play in this major failure as well.

> "For reference, the version that addressed this exploit was roughly 75 versions ago," a LastPass spokesperson said.

Quite the game of blame deflection going on.

Whether or not the employee was running an outdated version of Plex or every bit of malware known to man on their personal computer has no bearing on the company's security breach. How was the attacker able to cross the corporate security boundary? Did the employee have access to company/customer data from their personal computer? Was this in breach of company policy, or is this generally allowed? If the former, why was this access not monitored and flagged? Answers to all of these are conveniently skipped in favor of "see it was an old version of Plex, case closed".

Right. We're going to blame the engineer for not updating every piece of software on earth they have installed when updates break stuff every other time, and when managing updates takes a full time job these days?

Give the man a break. The blame simply is on not practicing proper isolation and keeping work to a secure and controlled environment.

Part of the problem here is that Plex is included in so many different VMs, NAS images, SaaS offerings, etc. That it can be incredibly difficult and/or obscure to update it. I know I personally ran into issues with FreeNAS where once it was running I had no incentive to update. That shouldn't be how these offerings work. They should be encouraging updates.

How does one figure out if any of their home systems is affected? I have 5 Linux installations(dev machines, router, nas, rpi, etc), multiple docker instances, a couple of windows machines and half a dozen phones at tablets at home.

What’s the best tool to find out if any of them is hacked?

My question is: are these recent hacks purely the result of incompetence, or is it also because LastPass is targeted more often by hackers due its popularity?

It looks pretty stupid but I’m afraid a lot of companies are vulnerable to exactly the same problem.

Laaaaaazy!