"I use the password manager LastPass. I’m confused and concerned. I read where LastPass got hacked. Some articles say I should cancel my subscription and enroll with another brand of password manager. Do I need to do that?”

​

Some experts, including Forbes and CNET, recommend you cancel LastPass and move to another brand. Sophos recommends that users read up about what happened and decide for themselves.

 

We’ve had so many readers ask about the LastPass breach that we decided to provide a technical explanation of what happened. If you’re not technically inclined, please skip to the next question!

 

This incident occurred because a hacker logged in to the LastPass Employee's password vault using the Employee’s master password. That required the LastPass Employee to approve a second type of authentication designed to protect the account. LastPass did not reveal what type of authentication was used.

 

Here’s how it all unfolded.

 

• Years ago - The LastPass Employee created a Plex user account and installed the Plex Media server on his home computer. He did not use MFA on his Plex account and did not update the Plex software, but it remained on his computer.

• May 2020 - Plex discovers a vulnerability and patches its software. Users are instructed to install the new version, but the LastPass Employee never did.

• August 2022 - LastPass Incident #1. The LastPass Employee's corporate laptop was breached. The method that the hacker used to gain access to the computer is not known.

• August 2022 - Plex is breached. Plex sent an email suggesting that everyone change their password.

• August - October 2022 - LastPass Incident #2. The threat actor logged into the LastPass Employee's Plex account on the web, uploading malicious keylogger code, which got installed on the LastPass Employee's home computer. Keyloggers record everything a user types and transmit it to the hacker.

 

  Next, on his home computer, the LastPass Employee logged into his LastPass account using his master password. The keystrokes he typed were sent to the hacker. 

 

Next, using the characters recorded by the keylogging software, the threat actor logged into the Employee's LastPass vault. The Employee approved the second-factor authentication message.

 

Now, the hacker had access to the company's secrets, including Amazon security certificates and encryption keys — the crown jewels of LastPass’s business, which by the way, do not require multifactor authentication.

 

This breach could have been prevented if the LastPass Employee had used a “physical security key” to protect his LastPass account. A physical security key is a hardware device that must be attached to a computer to complete the log-on process. Hackers can’t get past that because they don’t have access to the hardware.

 

As part of their response, LastPass assisted the Employee “with hardening the security of their home network and personal resources." In summary, a critical path for this high-profile breach occurred because the user didn’t update software on this computer.

 

And what about LastPass’s customers? There is no indication at this time that LastPass users’ passwords were stolen. That’s because an essential step of a password manager’s functionality is stored on each user’s computer, not on the password manager's servers. 

   

-----

 

“On many websites, you can put in a hidden email address, but it must be legitimate. How does this work, and should you do that to protect your primary email account?”

 

You can use these disposable email addresses to keep your personal email address private. Apple’s “Hide My Email” can generate unique, random email addresses forwarded to your personal email account. This way, you don’t have to share your email address when purchasing online, filling out forms, or signing up for newsletters. These “hidden” emails will help reduce the spam you receive. The most critical steps to protecting your email account are using a long password unique to the account and multifactor authentication if it’s offered.

​

-----

 

"Do I need to shut down my computer every night?"

​

No, in most cases, you don’t. Every week or so, it’s a good idea to restart your personal computer so the software can update itself. As the BBC says, when a computer runs software, it loads much of the program into its memory. To prevent technical issues, operating systems usually insist that when updates are needed, shut down the software and restart it so the new software can be installed.

 

Remember this critical step at home and work: set your computer so a password must be entered to wake the machine from sleep.

​