Using AWS with LastPass... A major catastrophe! 30 million encrypted consumer vaults compromised

[Telos]

Although an initial intrusion into LastPass ended on August 12, officials with the leading password manager said the threat actor “was actively engaged in a new series of reconnaissance, enumeration, and exfiltration activity” from August 12 to August 26. In the process, the unknown threat actor was able to steal valid credentials from a senior DevOps engineer and access the contents of a LastPass data vault. Among other things, the vault gave access to a shared cloud-storage environment that contained the encryption keys for customer vault backups stored in Amazon S3 buckets.

Read on...

 

[Coop777]

Ouch. A cardinal rule of thumb where I work is not to use my business computer for anything personal, and not to use my personal computer for anything work related.

 

[Her0]

This is crazy... and they are saying this was all due to a Plex media RCE exploit Plex media server seen exploited in the wild utilizing a 3 year old RCE