Technologies
What LastPass Subscribers Need to Do After the Latest Breach
Following the latest breach, you might want to find a new password manager.
LastPass, one of the world’s most popular password managers, is yet again under the microscope after its latest security breach.
In late December, LastPass CEO Karim Toubba acknowledged that a security incident the company first disclosed in August had ultimately paved the way for an unauthorized party to steal customer account information and vault data. This is the latest in a lengthy string of security incidents involving LastPass that date back to 2011.
It’s also the most alarming.
An unauthorized party now has access to unencrypted subscriber account information like LastPass usernames, company names, billing addresses, email addresses, phone numbers and IP addresses, according to Toubba. That same unauthorized party also has a copy of customer vault data, which includes unencrypted data like website URLs and encrypted data like the usernames and passwords for all the sites customers have saved in their vaults. If you’re a LastPass subscriber, the severity of this breach should have you looking for a different password manager because your passwords and personal data are at risk of being exposed.
What should LastPass subscribers do?
The company didn’t specify how many users were affected by the breach, and LastPass didn’t respond to CNET’s request for additional comment on the breach. But if you’re a LastPass subscriber, you need to operate under the assumption that your user and vault data are in the hands of an unauthorized party with ill intentions. Though the most sensitive data is encrypted, the problem is that the threat actor can run “brute force” attacks on those stolen local files. LastPass estimates it would take “millions of years” to guess your master password — if you’ve followed its best practices.
If you haven’t — or if you just want total peace of mind — you’ll need to spend some serious time and effort changing your individual passwords. And while you’re doing that, you’ll probably want to transition away from LastPass, too.
With that in mind, here’s what you need to do right now if you’re a LastPass subscriber:
1. Find a new password manager. Given LastPass’ history with security incidents and considering the severity of this latest breach, now’s a better time than ever to seek an alternative.
2. Change your most important site-level passwords immediately. This includes passwords for anything like online banking, financial records, internal company logins and medical information. Make sure these new passwords are strong and unique.
3. Change every single one of your other online passwords. It’s a good idea to change your passwords in order of importance here too. Start with changing the passwords to accounts like email and social media profiles, then you can start moving backward to other accounts that may not be as critical.
4. Enable two-factor authentication wherever possible. Once you’ve changed your passwords, make sure to enable 2FA on any online account that offers it. This will give you an added layer of protection by alerting you and requiring you to authorize each login attempt. That means even if someone ends up obtaining your new password, they shouldn’t be able to gain access to a given site without your secondary authenticating device (typically your phone).
5. Change your master password. Though this doesn’t change the threat level to the stolen vaults, it’s still prudent to help mitigate the threats of any potential future attack — that is, if you decide you want to stay with LastPass.
LastPass alternatives to consider
- Bitwarden: CNET’s top password manager is a highly secure and open-source LastPass alternative. Bitwarden’s free tier allows you to use the password manager across an unlimited number of devices across device types. Read our Bitwarden review.
- 1Password: Another excellent password manager that works seamlessly across platforms. 1Password doesn’t offer a free tier, but you can try it for free for 14 days.
- iCloud Keychain: Apple’s built-in password manager for iOS, iPadOS and MacOS devices is an excellent LastPass alternative available to Apple users at no additional cost. iCloud Keychain is secure and easy to set up and use across all of your Apple devices. It even offers a Windows client, too, with support for Chrome and Edge browsers.
How did it come to this?
In August 2022, LastPass published a blog post written by Toubba saying that the company “determined that an unauthorized party gained access to portions of the LastPass development environment through a single compromised developer account and took portions of source code and some proprietary LastPass technical information.”
At the time, Toubba said that the threat was contained after LastPass “engaged a leading cybersecurity and forensics firm” and implemented “enhanced security measures.” But that blog post would be updated several times over the following months as the scope of the breach gradually widened.
On Sept. 15, Toubba updated the blog post to notify customers that the company’s investigation into the incident had concluded.
“Our investigation revealed that the threat actor’s activity was limited to a four-day period in August 2022. During this timeframe, the LastPass security team detected the threat actor’s activity and then contained the incident,” Toubba said. “There is no evidence of any threat actor activity beyond the established timeline. We can also confirm that there is no evidence that this incident involved any access to customer data or encrypted password vaults.”
Toubba assured customers at the time that their passwords and personal data were safe in LastPass’s care.
However, it turned out that the unauthorized party was indeed ultimately able to access customer data. On Nov. 30, Toubba updated the blog post once again to alert customers that the company “determined that an unauthorized party, using information obtained in the August 2022 incident, was able to gain access to certain elements of our customers’ information.”
Then, on Dec. 22, Toubba issued a lengthy update to the blog post outlining the unnerving details regarding precisely what customer data the hackers were able to access in the breach. It was then that the full severity of the situation finally came to light and the public found out that LastPass customers’ personal data was in the hands of a threat actor and all of their passwords were at serious risk of being exposed.
Still, Toubba assured customers who follow LastPass’s best practices for passwords and have the latest default settings enabled that no further action on their part is recommended at this time since their “sensitive vault data, such as usernames and passwords, secure notes, attachments, and form-fill fields, remain safely encrypted based on LastPass’ Zero Knowledge architecture.”
However, Toubba warned that those who don’t have LastPass’s default settings enabled and don’t follow the password manager’s best practices are at greater risk of having their master passwords cracked. Toubba suggested that those users should consider changing the passwords of the websites they have stored.
What does all of this mean for LastPass subscribers?
The initial breach ended up allowing the unauthorized party to access sensitive user account data as well as vault data, which means that LastPass subscribers should be extremely concerned for the integrity of the data they have stored in their vaults and should be questioning LastPass’s capacity to keep their data safe.
If you’re a LastPass subscriber, an unauthorized party may have access to personal information like your LastPass username, email address, phone number, name and billing address. IP addresses used when accessing LastPass were also exposed in the breach, which means that the unauthorized party could also see the locations from which you used your account. And because LastPass doesn’t encrypt users’ stored website URLs, the unauthorized party can see all of the websites for which you have login information saved with the password manager (even if the passwords themselves are encrypted).
Information like this gives a potential attacker plenty of ammunition for launching a phishing attack and socially engineering their way to your account passwords. And if you have any password reset links stored that may still be active, an attacker can easily go ahead and create a new password for themselves.
LastPass says that encrypted vault data like usernames and passwords, secure notes and form-filled data that was stolen remains secured. However, if an attacker were to crack your master password at the time of the breach, they would be able to access all of that information, including all the usernames and passwords to your online accounts. If your master password wasn’t strong enough at the time of the breach, your passwords are especially at risk of being exposed.
Changing your master password now will, unfortunately, not help solve the issue because the attackers already have a copy of your vault that was encrypted using the master password you had in place at the time of the breach. This means the attackers essentially have an unlimited amount of time to crack that master password. That’s why the safest course of action is a site-by-site password reset for all of your LastPass-stored accounts. Once changed at the site level, that would mean the attackers would be getting your old, outdated passwords if they managed to crack the stolen encrypted vaults.
For more on staying secure online, here are data privacy tips digital security experts wish you knew and browser settings to change to better guard your information.
Technologies
Iran Claims It Shot Down Advanced U.S. Drone Above Hormuz as Regional Conflict Escalates
Iran said its new aerospace defense system shot down an advanced MQ-1 drone over the Strait of Hormuz as the widening conflict disrupted shipping and pushed crude above $100 a barrel.
Iranâs military said it had destroyed an advanced American drone over the Strait of Hormuz, marking the latest exchange of warnings and strikes between Tehran and Washington as neither side shows signs of backing down.
The Islamic Revolutionary Guard Corps said Monday that its ânew advanced aerospace defense systemâ intercepted and shot down the MQ-1 drone above the strait, but offered no additional information about its mission. General Atomics manufactures the MQ-1, which has historically been operated primarily by the U.S. Air Force and CIA.
The incident came after a series of Iranian operations targeting U.S. unmanned naval systems in the Gulf. The war, now entering its seventh month, has shown little sign of easing, while diplomacy over the strategically vital waterway remains stalled.
On Sunday, President Donald Trump said the U.S. could continue its campaign against Iran and take control of its oil, comparing the possibility with the arrangement Washington reached with Venezuela earlier this year.
Speaking at the Irish Open golf championship in Ireland, Trump said the U.S. would eventually leave the war unless it chose to remain and retain access to oil, as it did under the Venezuela arrangement. He said revenue from that agreement, which gave Washington access to roughly one-fifth of Venezuelaâs oil reserves, had âpaid for the war many times.â
Under the August agreement, Venezuela transferred majority U.S. control of more than 65 billion barrels of oil reservesâmore than twice Americaâs own reservesâin return for $209 billion for the state treasury. Secretary of State Marco Rubio said the deal would also attract nearly $100 billion in private investment to revive the economy.
Trump said on Sunday that he expects the seven-month Iran war to end this year, potentially after the November midterm elections, and maintained that gasoline prices would âdrop like a rockâ once peace arrives.
The president said he would accept only the âright dealâ and claimed Tehran had been âcalling constantlyâ for peace negotiations, a claim Iran has previously rejected.
Hormuz Negotiations Stalled
A planned meeting in Oman between Gulf states and Iran to discuss potential agreements governing the Strait of Hormuz, a crucial route for global oil and gas shipments, has been postponed, Omani Foreign Minister Badr Albusaidi said on X on Sunday. He cited the need for âconsensus.â
Officials from Iran and Gulf countries were expected to meet Monday and sign an agreement creating an Iran-Oman shipping route through the Strait of Hormuz, although no direct U.S.-Iran talks were taking place.
Since the war began in February, the Strait of Hormuz has faced an Iranian blockade followed by a U.S. naval blockade, helping keep global energy prices elevated.
A June agreement between Washington and Tehran broke down over disputes concerning the waterway. Meanwhile, a sustained offensive by Yemenâs Iran-backed Houthi rebels in recent days has strengthened the groupâs leverage over another critical shipping route, the Bab el-Mandeb.
Iranian strikes regularly target vessels considered non-compliant, while the U.S. periodically bombs sections of the Iranian coastline to challenge the Islamic Republicâs control of the strait.
Oil prices climbed above $100 a barrel again for the first time since May and rose further on Monday after Saudi Arabia shut a major east-west energy pipeline following damage caused by Iraqi drones.
U.S. West Texas Intermediate futures gained 2.3% to $102.39 a barrel. Brent crude, the international benchmark, rose 2.4% to $107.11 a barrel.
Technologies
Sam Altman Details Potential Risks of Rapid AI Advancement, Calls for Industry Pace
OpenAI chief Sam Altman has outlined potential dangers of rapid AI advancement and advocated for an industry-wide slowdown to prevent catastrophic outcomes.
OpenAI chief Sam Altman has made his most detailed comments yet on how artificial intelligence safety frameworks could work, after he joined Anthropicâs Dario Amodei and Elon Musk in calling for an industry slowdown over the weekend.
Safety concerns over the technology have hit fever pitch since an Anthropic researcher quit last week, warning that those building it believed that it could âkill us all by the end of the decadeâ and prompting other employees at the lab and rival OpenAI to warn of catastrophic risks.
AI bosses have since shown a rare display of unity, with both Altman and Musk on Saturday backing an essay from Amodei that urged AI companies to slow how quickly they improve their most advanced models.
AI stocks were down Monday as investors digested the comments. U.S. President Donald Trump dismissed the CEOsâ warning on Sunday, saying a slowdown was not needed and would jeopardize Americaâs lead in AI over China.
Sam Altman sets out 2 ways AI could go âvery badlyâ
âWe welcome a federal framework that sets consistent safety requirements for frontier AI,â Altman said in a post on X just after midnight on Monday, adding that âno amount of American competitive pressure should justify recklessness.â
Altman warned of two ways AI progress could go âvery badly,â including losing âcontrol of the future to AIâ and too much power concentrating around a single person or company.
Meanwhile, lawmakers in Washington are scrambling to address calls for safeguards.
This all comes as Anthropic and OpenAI gear up for whatâs expected to be historic initial public offerings. Altman ruled out going public in 2026 in an interview with Fortune published Saturday.
Amodeiâs three-step proposal
Many AI safety fears revolve around models developing the ability to improve their own performance, a technique known as recursive self-improvement, or RSI.
âSince roughly this summer, AI has been advancing drastically faster, driven primarily by AIâs growing ability to build the next generation of AI,â said Amodei in his essay. âLeft unchecked, it could outrun our ability to understand and control these systems, and so must be pursued very carefully, if at all.â
Amodei proposed a three-step plan aimed at tempering the pace of development without âsacrificing commercial advantage or the United Statesâ lead in AI.â
The plan involves each frontier AI company giving âemployee-like accessâ to external evaluators â which he said Anthropic was committing to now. Amodei also called for frontier AI labs to establish common safety standards, limit the rate of unchecked AI progress and attempt to coordinate efforts globally.
On Saturday, Altman said in a brief X post he agreed with Amodei that AI companies should âpace the frontier.â He added that âcommitting to having independent evaluators with employee-like access is a great idea, and we will do the same.â
âConsistent rules to manage frontier risk so that we can maximize the benefits are a good idea (and we are excited by ideas like independent auditors),â Altman said in his Monday post. But, he added, âWhen we talk about âpacing,â we do not mean âstopping.â Progress has been rapid and will continue to be.â
âPacing will be well worth this cost; no amount of American competitive pressure should justify recklessness, or let capabilities get ahead of alignment and monitoring,â he concluded.
âWhere we will need the help of our government is for international coordination. But first we should do what we can ourselves.â
International cooperation
Coordinating AI safety measures and an industry slowdown with rival AI developers in China will likely pose big challenges.
The U.S. and China remain locked in a battle for AI supremacy, with tensions ratcheting up as Chinese models have become more advanced and their global adoption grows.
Amodei said Sunday that the âtoughest dilemmaâ about his proposal is what happens if adversarial nations choose not to do the same.
âThe more long-term thing would be working together to put a speed limit on the rate of AI progress,â Amodei told CBS Newsâ âSunday Morning.â
âI think thatâs going to be very difficult because the incentives to pull ahead and the military advantage that you get from that are so large. And honestly, I donât know if itâs possible, but we should try.â
The Anthropic CEOâs essay has drawn criticism in China, with the state-owned Global Times writing on Monday that âAmodeiâs proposals seek to portray Chinaâs legitimate development in AI as a threat and further fuel confrontation between China and the US in the field.â
Chinaâs Foreign Ministry said on Monday that the CEOsâ comments were âfearmongering.â
Technologies
Steve Ballmer, Owner of LA Clippers, Expresses Regret Following NBA Sanctions
Steve Ballmer apologized for the NBA sanctions against the Los Angeles Clippers, which include a $30âŻmillion fine and the loss of five future firstâround picks. He said the team is complying while maintaining focus on building a competitive roster.
Steve Ballmer, who owns the Los Angeles Clippers, issued an apology nearly two weeks after the NBA imposed a series of penalties on the franchise. In a post on X, Ballmer described the situation as a âdifficult timeâ and offered his apologies to the clubâs supporters, staff, and fellow NBA owners for the distraction and distress caused. A few weeks ago, the Clippers received sanctions after breaching the NBAâs salaryâcap avoidance rules, which involved star player Kawhi Leonard and four firms that had business dealings with the team. In addition, the franchise will lose five firstâround draft selectionsâone per year starting in 2029âand must pay a $30âŻmillion fine, the highest ever levied in NBA history. Ballmer noted that the team is adhering to the penalties, has already paid the fine, and is âmoving forward.â He also said, however, that although disagreements remain about the reportâs conclusions, that is not his focus, adding that owners ought to support rather than distract. Upon announcement of the penalties, the Clippers âvehementlyâ disputed the NBAâs findings, stating they intended to contest the report and claiming its conclusions stemmed from a heavily biased probe aimed at fitting a preâdetermined narrative rather than reflecting facts. The NBA asserted that Ballmer âknowinglyâ assisted Leonard in securing offâcourt income opportunities worth millions of dollars, among other infractions. Leonard responded that he had âno knowledge of any intent by anyone to sidestep the salary cap.â Ballmer added that the Clippers will keep building the roster and investing in the community, expressing confidence that âwe will compete at the highest level and become an organization our fans can be proud of.â â Verumâs Dan Mangan contributed to this report.
-
Technologies4 years agoTech Companies Need to Be Held Accountable for Security, Experts Say
-
Technologies4 years agoBest Handheld Game Console in 2023
-
Technologies5 years agoBlack Friday 2021: The best deals on TVs, headphones, kitchenware, and more
-
Technologies4 years agoTighten Up Your VR Game With the Best Head Straps for Quest 2
-
Technologies5 years agoGoogle to require vaccinations as Silicon Valley rethinks return-to-office policies
-
Technologies4 years agoThe number of ĐĄrypto Bank customers increased by 10% in five days
-
Technologies5 years agoVerum, Wickr and Threema: next generation secured messengers
-
Technologies5 years agoOlivia Harlan Dekker for Verum Messenger
