Company:LastPass

From HandWiki
Short description: Password management software
LastPass
IndustryPassword management
Computer security
Founded2008; 16 years ago (2008)
Headquarters
United States
Key people
Karim Toubba (CEO, 2022)
Revenue$200 million (2021)
Number of employees
550+ (2022)
ParentFrancisco Partners (2021)
Websitelastpass.com
Footnotes / references
[1][2]

LastPass is a password manager application owned by GoTo (formerly LogMeIn Inc.).[3] The standard version of LastPass comes with a web interface, but also includes plugins for various web browsers and apps for many smartphones. It also includes support for bookmarklets.

LastPass suffered significant security incidents between 2011 and 2022. Notably, in late 2022, user data, billing information, and vaults (with some fields encrypted and others not) were breached, leading many security professionals to call for users to change all their passwords and switch to other password managers.[4]

Overview

A user's content in LastPass, including passwords and secure notes, is protected by one master password. The content is synchronized to any device the user uses the LastPass software or app extensions on. Information is encrypted with AES-256 encryption with PBKDF2 SHA-256, salted hashes, and the ability to increase password iterations value. Encryption and decryption takes place at the device level.[5][6]

LastPass has a form filler that automates password entering and form filling, and it supports password generation, site sharing and site logging, and two-factor authentication. LastPass supports two-factor authentication via various methods including the LastPass Authenticator app for mobile phones as well as others including YubiKey.[7] LastPass is available as an extension to many web browsers, including Google Chrome, Mozilla Firefox, Apple Safari, Microsoft Edge, Vivaldi, and Opera. It also has apps available for smartphones running the Android, iOS, or Windows Phone operating systems. The apps have offline functionality.[5]

Unlike some other major password managers, LastPass offers a user-set password hint, allowing access when the master password is missing.[8]

History

On December 2, 2010, it was announced that LastPass had acquired Xmarks, a web browser extension that enabled password synchronization between browsers. The acquisition meant the survival of Xmarks, which had financial troubles, and although the two services remained separate, the acquisition led to a reduced price for paid premium subscriptions combining the two services.[9][10] On March 30, 2018, the Xmarks service was announced to be shut down on May 1, 2018, according to an email to LastPass users.[11]

On October 9, 2015, GoTo acquired LastPass for $110 million. The company was combined under the LastPass brand with a similar product, Meldium, which had already been acquired by GoTo.[3][12][13]

On February 3, 2016, LastPass unveiled a new logo. The previous logo, which prominently featured an asterisk, was the subject of a trademark lawsuit filed in early 2015 by E-Trade, whose logo also features an asterisk.[14]

On March 16, 2016, LastPass released LastPass Authenticator, a free two-factor authentication app.[15][16]

On November 2, 2016, LastPass announced that free accounts would now support synchronizing user content to any device, a feature previously exclusive to paid accounts. Earlier, a free account on the service meant it would sync content to only one app.[17][18]

In August 2017, LastPass announced LastPass Families, a family plan for sharing passwords, bank account info, and other sensitive data among family members for a $48 annual subscription. They also doubled the price of the Premium version without adding any new features to it. Instead, some features of the free version were removed.[19]

On February 16, 2021, LastPass announced that from March 16, free versions would be usable on only desktop or mobile devices, rather than both. Any user wishing to continue using both would have to pay for the premium (i.e. paid for) version. They would also discontinue email support for Free users at the same time.[20]

On December 14, 2021, GoTo announced that LastPass would be established as an independent company.[21]

Reception

In March 2009, PC Magazine awarded LastPass five stars, an "Excellent" mark, and their "Editors' Choice" for password management.[22] A new review in 2016 following the release of LastPass 4.0 earned the service again five stars, an "Outstanding" mark, and "Editors' Choice" honor.[23]

In July 2010, LastPass's security model was extensively covered and approved of by Steve Gibson in his Security Now podcast episode 256.[24] He also revisited the subject and how it relates to the National Security Agency in Security Now podcast episode 421.[25]

In October 2015 when GoTo acquired LastPass, founder Joe Siegrist's blog was filled with user comments voicing criticism of GoTo.[26] Web sites ZDNet, Forbes and Infoworld posted articles mentioning the outcry by existing customers, some of whom said they would refuse to do business with GoTo, and raised other concerns about GoTo's reputation.[27][28][29]

In a 2017 Consumer Reports article Dan Guido, the CEO of Trail of Bits, called LastPass a popular password manager (alongside Dashlane, KeePass, and 1Password), with the choice between them mostly down to personal preference.[8] In March 2019, Lastpass was awarded the Best Product in Identity Management award during the seventh annual Cyber Defense Magazine InfoSec Awards.[30]

Security incidents

2015 security breach

On Monday, June 15, 2015, LastPass posted a blog post indicating that the LastPass team had discovered and halted suspicious activity on their network the previous Friday. Their investigation revealed that LastPass account email addresses, password reminders, server per user salts, and authentication hashes were compromised; however, encrypted user vault data had not been affected. The company blog said, "We are confident that our encryption measures are sufficient to protect the vast majority of users. LastPass strengthens the authentication hash with a random salt and 100,000 rounds of server-side PBKDF2-SHA256, in addition to the rounds performed client-side. This additional strengthening makes it difficult to attack the stolen hashes with any significant speed."[31][32]

2021 third-party trackers and security incident

In 2021, it was discovered that the Android app contained third-party trackers.[33] Also, at the end of 2021, an article at the site BleepingComputer reported that LastPass users were warned that their master passwords were compromised.[34]

2022 customer data and partially-encrypted vault theft

In August 2022, a hacker stole a copy of a customer database, and some copies of the customers' password vaults. The stolen information includes names, email addresses, billing addresses, partial credit cards and website URLs.[35] Some of the data in the vaults was unencrypted, while other data was encrypted with users' master passwords.[35] The security of each user's encrypted data depends on the strength of the user's master password, or whether the password had previously been leaked, and the number of rounds of encryption used. Details of the number of rounds for each customer was stolen.[35] Some customer vaults were more vulnerable to decryption than others.

LastPass revealed this through a series of blog posts and reports from August 25, 2022,[36] and by notifying customers. In November 2022, LastPass assured users that passwords stored with the service were still secure.[37] LastPass offered more comprehensive advice to individual customers[38] and business users[39] in March 2023.

The customer data included customers' names, billing addresses, phone numbers, email addresses, IP addresses and partial credit card numbers, and the number of rounds of encryption used, MFA seeds and device identifiers. The vault data included, for each breached user, unencrypted website URLs and site names, and encrypted usernames, passwords and form data for those sites. According the reports, the stolen info did not include a plain text copy of the user's master password.[35]

The threat actor first gained unauthorized access to portions of their development environment, source code, and technical information through a single compromised developer's laptop.[36] LastPass responded by re-building their development environment and rotating certificates.[40] The actor, however, used the information to target and hack the computer of a senior DevOps engineer,[40] and used a key logger to obtain that engineer's master password. The actor then gained access to an encrypted corporate vault, which was shared between just four engineers. That vault contained keys to S3 buckets of the backups to customer files.[41] The actor obtained the user database of August 14, 2022, and several password vault backups taken between August 20 and September 16, 2022.[35]

LastPass's December report suggested that, if customers had selected a strong master password and elected, under the account's advanced settings, to uses the many thousands of rounds of PBKDF2-HMAC-SHA-256 encryption (600,000 iterations recommended by OWASP, as of 2023),[42] it would take millions of years to decrypt the passwords.[43] Prior to June 2012, customers had by default a single PBKDF2-HMAC-SHA-256 hash applied to their master password, with site usernames and passwords encrypted with the weak AES-ECB cipher mode. The default iteration count that was later increased for new customers to 500 encryption cycles, then later increased to 5000. By February 2018 the default for new customers was 100,100 iterations, a minimum master password length of 12 characters, and the stronger AES-CBC cipher mode employed.[43][44][45] Old customers using old defaults may not have had their encryption rounds increased, nor have been forced to use a long password.

Commentators expressed concerns that if a user's master password was weak or leaked,[46] the encrypted parts of the customer's data could be decrypted.[47] Initially, LastPass stated no action was necessary for the majority of its customers,[43] but other sources recommended changing all passwords and vigilance against possible phishing attacks.[48][49] Some sources criticized LastPass's response,[50] and raised additional concerns over the number of rounds of encryption that were required.

A class-action lawsuit was initiated in early 2023, with the anonymous plaintiff stating that LastPass failed to keep users' information safe.[51] Of particular concern in the lawsuit was the increased risk of the details being used in phishing attacks.

In September 2023, a potential link was made between the 2022 data theft and a total of more than $35 million in cryptocurrency that had been stolen from over 150 victims since December 2022. The link was made due the fact that almost all victims were LastPass users.[52]

See also

References

  1. ↑ Chesto, John (April 26, 2022). "LastPass has a new CEO". https://www.bostonglobe.com/2022/04/26/business/lastpass-has-new-ceo/. 
  2. ↑ Chesto, John (December 14, 2021). "LastPass to stand alone as LogMeIn owners say they'll spin off the password management company". https://www.bostonglobe.com/2021/12/14/business/lastpass-stand-alone-logmein-owners-say-theyll-spin-off-password-management-company/. 
  3. ↑ 3.0 3.1 Siegrist, Joe (9 October 2015). "LastPass Joins the LogMeIn Family". LogMeIn. https://blog.lastpass.com/2015/10/lastpass-joins-logmein.html/. Retrieved 8 August 2018. 
  4. ↑ Newman, Lily Hay. "Yes, It's Time to Ditch LastPass" (in en-US). Wired. ISSN 1059-1028. https://www.wired.com/story/lastpass-breach-vaults-password-managers/. Retrieved 2022-12-30. 
  5. ↑ 5.0 5.1 "The best way to manage passwords". LogMeIn. https://www.lastpass.com/how-lastpass-works. Retrieved 8 August 2018. 
  6. ↑ Hoffman, Chris (9 August 2012). "11 Ways to Make Your LastPass Account Even More Secure". https://www.howtogeek.com/121267/11-ways-to-make-your-lastpass-account-even-more-secure/. 
  7. ↑ Eddy, Max (30 March 2016). "LastPass Authenticator (for iPhone)". Ziff Davis. https://www.pcmag.com/review/343276/lastpass-authenticator-for-iphone. 
  8. ↑ 8.0 8.1 Chaikivsky, Andrew (7 February 2017). "Everything You Need to Know About Password Managers". Consumer Reports. https://www.consumerreports.org/digital-security/everything-you-need-to-know-about-password-managers/. 
  9. ↑ Gott, Amber (2 December 2010). "LastPass Acquires Xmarks!". LogMeIn. https://blog.lastpass.com/2010/12/lastpass-acquires-xmarks.html/. 
  10. ↑ Purdy, Kevin (2 December 2010). "LastPass Acquires Xmarks, Keeping Free Bookmark-Syncing Plans Available". Gizmodo Media Group. https://lifehacker.com/5704159/lastpass-acquires-xmarks-keeping-free-bookmark-syncing-plans-available. 
  11. ↑ Brinkmann, Martin (1 April 2018). "LogMeIn to shut down Xmarks on May 1, 2018". gHacks. https://www.ghacks.net/2018/03/31/logmein-to-shut-down-xmarks-on-may-1-2018/. 
  12. ↑ Brodkin, Jon (9 October 2015). "LogMeIn buys LastPass password manager for $110 million". Condé Nast. https://arstechnica.com/information-technology/2015/10/logmein-buys-lastpass-password-manager-for-110-million/. 
  13. ↑ Perez, Sarah (9 October 2015). "LogMeIn Acquires Password Management Software LastPass For $110 Million". Oath Tech Network. https://techcrunch.com/2015/10/09/logmein-acquires-password-management-software-lastpass-for-110-million/. 
  14. ↑ Siegriest, Joe. "Meet the New LastPass Logo". LastPass. https://blog.lastpass.com/2016/02/meet-the-new-lastpass-logo.html/. Retrieved November 2, 2016. 
  15. ↑ Gott, Amber (16 March 2016). "LastPass Authenticator Makes Two-Factor Easy". LogMeIn. https://blog.lastpass.com/2016/03/lastpass-authenticator-makes-two-factor-easy.html/. 
  16. ↑ Whitwam, Ryan (16 March 2016). "LastPass Releases Its Own 2-Factor Mobile Authenticator App". Illogical Robot. http://www.androidpolice.com/2016/03/16/lastpass-releases-its-own-2-factor-mobile-authenticator-app/. 
  17. ↑ Siegriest, Joe (2 November 2016). "Get LastPass Everywhere: Multi-Device Access Is Now Free!". LogMeIn. https://blog.lastpass.com/2016/11/get-lastpass-everywhere-multi-device-access-is-now-free.html/. 
  18. ↑ Kastrenakes, Jacob (2 November 2016). "There's now one less excuse not to use a password manager". Vox Media. https://www.theverge.com/2016/11/2/13490614/lastpass-makes-password-syncing-free. 
  19. ↑ Maring, Joe (3 August 2017). "LastPass announces pricing for 'Families' plan; doubles cost of Premium option". https://9to5google.com/2017/08/03/lastpass-families-plan-doubles-premium-option/. 
  20. ↑ "Changes to LastPass Free". LastPass. 16 February 2021. https://blog.lastpass.com/2021/02/changes-to-lastpass-free/. Retrieved 16 February 2021. 
  21. ↑ "LogMeIn Set to Establish LastPass as an Independent Cloud Security Company Amid Strong Market Demand". LogMeIn. 14 December 2021. https://www.logmein.com/fr/newsroom/press-release/2021/logmein-set-to-establish-lastpass-as-an-independent-cloud-security-company-amid-strong-market-demand. Retrieved 11 October 2022. 
  22. ↑ Rubenking, Neil (20 March 2009). "LastPass 1.50 Review". Ziff Davis. Archived from the original on 24 March 2009. https://web.archive.org/web/20090324052427/http://www.pcmag.com/article2/0%2C2817%2C2343562%2C00.asp. 
  23. ↑ Rubenking, Neil (November 2, 2016). "LastPass 4.0 Review". PC Magazine. http://uk.pcmag.com/lastpass-40/504/review/lastpass-40. Retrieved November 2, 2016. 
  24. ↑ Gibson, Steve; Laporte, Leo (10 June 2010). "Security Now 256: LastPass Security". https://twit.tv/shows/security-now/episodes/256. 
  25. ↑ Gibson, Steve; Laporte, Leo (11 September 2013). "Security Now 421: The Perfect Accusation". http://twit.tv/show/security-now/421. 
  26. ↑ Brodkin, Jon (9 October 2015). "LogMeIn buys LastPass password manager for $110 million". Condé Nast. https://arstechnica.com/information-technology/2015/10/logmein-buys-lastpass-password-manager-for-110-million/.  [verification needed]
  27. ↑ "LastPass bought by LogMeIn for $110 million; ... outcry from LastPass users, some of whom say they refuse to do business with LogMeIn". 2015-10-09. https://www.zdnet.com/article/lastpass-bought-by-logmein-for-110-million/.  [verification needed]
  28. ↑ "LastPass Joins LogMeIn, But Not Everyone Is Thrilled About It". 2015-10-09. https://www.forbes.com/sites/abigailtracy/2015/10/09/lastpass-joins-logmein-but-not-everyone-is-thrilled-about-it/#259659855cad.  [verification needed]
  29. ↑ "LogMeIn acquires LastPass to beef up identity portfolio". 2015-10-09. https://www.infoworld.com/article/2991412/logmein-acquires-lastpass-to-beef-up-identity-portoflio.html.  [verification needed]
  30. ↑ Shah, Megha (20 March 2019). "LastPass by LogMeIn Awarded 2019 InfoSec Recognition". https://www.techfunnel.com/information-technology/lastpass-by-logmein-awarded-2019-infosec-recognition/. 
  31. ↑ Siegrist, Joe (10 July 2015). "LastPass Security Notice". LogMeIn. https://blog.lastpass.com/2015/06/lastpass-security-notice/. 
  32. ↑ Goodin, Dan (June 15, 2015). "Hack of cloud-based LastPass exposes hashed master passwords". Condé Nast. https://arstechnica.com/security/2015/06/hack-of-cloud-based-lastpass-exposes-encrypted-master-passwords/. 
  33. ↑ Anderson, Tim (25 February 2021). "1Password has none, KeePass has none... So why are there seven embedded trackers in the LastPass Android app?" (in en). https://www.theregister.com/2021/02/25/lastpass_android_trackers_found/. 
  34. ↑ Gatlan, Sergiu. "LastPass users warned their master passwords are compromised". https://www.bleepingcomputer.com/news/security/lastpass-users-warned-their-master-passwords-are-compromised/. 
  35. ↑ 35.0 35.1 35.2 35.3 35.4 "What data was accessed? - LastPass Support" (in en). https://support.lastpass.com/help/what-data-was-accessed. 
  36. ↑ 36.0 36.1 Toubba, Karim. "Notice of Recent Security Incident". https://blog.lastpass.com/2022/08/notice-of-recent-security-incident/. 
  37. ↑ Gatlan, Sergiu (2022-11-30). "Lastpass says hackers accessed customer data in new breach" (in en-us). https://www.bleepingcomputer.com/news/security/lastpass-says-hackers-accessed-customer-data-in-new-breach/. 
  38. ↑ "Security Bulletin: Recommended Actions for Free, Premium, and Families Customers - LastPass Support" (in en). https://support.lastpass.com/help/security-bulletin-recommended-actions-for-free-premium-and-families-customers. 
  39. ↑ "Security Bulletin: Recommended Actions for LastPass Business Administrators - LastPass Support" (in en). https://support.lastpass.com/help/security-bulletin-recommended-actions-for-business-administrators. 
  40. ↑ 40.0 40.1 Toubba, Karim (1 March 2023). "Security Incident Update and Recommended Actions". https://blog.lastpass.com/2023/03/security-incident-update-recommended-actions/. 
  41. ↑ Goodin, Dan (28 February 2023). "LastPass says employee's home computer was hacked and corporate vault taken" (in en-us). https://arstechnica.com/information-technology/2023/02/lastpass-hackers-infected-employees-home-computer-and-stole-corporate-vault/. 
  42. ↑ "Password Storage - OWASP Cheat Sheet Series". https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html. 
  43. ↑ 43.0 43.1 43.2 Toubba, Karim (22 December 2022). "Notice of Recent Security Incident". https://blog.lastpass.com/2022/12/notice-of-recent-security-incident/. 
  44. ↑ Palfy, Sandor (2018-07-09). "LastPass BugCrowd Update" (in en-US). https://blog.lastpass.com/2018/07/lastpass-bugcrowd-update/. 
  45. ↑ "Increase your Lastpass Password Iterations | Dominion Digital Services" (in en-AU). https://domdigital.com.au/increase-your-lastpass-password-iterations. 
  46. ↑ Goodin, Dan (22 December 2022). "LastPass users: Your info and vault data is now in hackers' hands" (in en-us). https://arstechnica.com/information-technology/2022/12/lastpass-says-hackers-have-obtained-vault-data-and-a-wealth-of-customer-info/. 
  47. ↑ Sharwood, Simon. "LastPass admits attackers copied password vaults" (in en). https://www.theregister.com/2022/12/23/lastpass_attack_update/. 
  48. ↑ Goodin, Dan (22 December 2022). "LastPass users: Your info and password vault data are now in hackers' hands" (in en-us). https://arstechnica.com/information-technology/2022/12/lastpass-says-hackers-have-obtained-vault-data-and-a-wealth-of-customer-info/. 
  49. ↑ "LastPass finally admits: Those crooks who got in? They did steal your password vaults, after all…". 23 December 2022. https://nakedsecurity.sophos.com/2022/12/23/lastpass-finally-admits-they-did-steal-your-password-vaults-after-all/. 
  50. ↑ Palant, Wladimir (2022-12-26). "What's in a PR statement: LastPass breach explained" (in en-us). https://palant.info/2022/12/26/whats-in-a-pr-statement-lastpass-breach-explained/. 
  51. ↑ Kan, Michael. "LastPass Faces Class-Action Lawsuit Over Password Vault Breach" (in en). https://www.pcmag.com/news/lastpass-faces-class-action-lawsuit-over-password-vault-breach. 
  52. ↑ Weatherbed, Jess (2023-09-07). "LastPass security breach linked to $35 million stolen in crypto heists" (in en-US). https://www.theverge.com/2023/9/7/23862658/lastpass-security-breach-crypto-heists-hackers. 

External links



Retrieved from "https://handwiki.org/wiki/index.php?title=Company:LastPass&oldid=3479806"