LastPass Devs Were Phished for Credentials

By Teri Robinson for Security Boulevard
Wednesday, March 1, 2023

• 1.5k
• 24
• 24
• 24
• 16
• More
• 24
• 24
• 27

LastPass has followed news of last month’s breach with details on a second attack in which developers were phished for their credentials.

The latest LastPass incident highlights “an emerging vector of sophisticated cyberattacks: Targeting victim’s employees who have privileged access to internal systems, instead of attacking the victims directly,” said Ilia Kolochenko, founder of ImmuniWeb and a member of Europol Data Protection Experts Network.

“Following a series of devastating supply-chain attacks in the last three years, most organizations now take their third-party security extremely seriously and significantly limit data sharing with their external suppliers or vendors,” Kolochenko explained. “Creative cybercriminals have, however, discovered another low-haging-fruit attack vector—a grim derivate of the pandemic and working-from-home trend—victim’s employees.”

Because some tech employees at some multinational organizations and government agencies still work from home and use personal devices that are not monitored and protected by their employer, the risk of these types of attacks is rising. “Moreover, when working-from-home employees are using employer’s equipment, many foundational security tasks, such as timely installation of patches or restrictions to use unvetted software, may become less efficient and flawed,” said Kolochenko. “Eventually, instead of running frontal attacks against a well-protected corporation, cybercriminal gangs stealthily steal the ‘keys to the kingdom’ from a breached employee’s machine. Worst, such intrusions are hardly detectable by various anomaly detection systems and thus oftentimes remain unnoticed.”

In the year to come, companies should “expect a surge of sophisticated attacks on privileged tech employees aimed at stealing their access credentials and getting access to the ‘crown jewels,’” he said, advising that organizations “urgently consider reviewing their internal access permissions and implement additional patterns to be monitored as anomalies, such as excessive access by a trusted employee or unusual access during non-business hours.” Read Full Article