Hacker News Reader

Comment by jniedrauer | Hacker News Reader

> the attacker(s) had access to privileged credentials that were previously stored in the LastPass account of a Ubiquiti IT employee

The interesting part of this story is how the employee's LastPass got popped. My guess is their local workstation was compromised, and their LastPass was either not logged out in a browser plugin, or they didn't have 2 factor auth required for each login and a keylogger got the password. In either case, it's a good reminder to be paranoid about your password manager, make sure it's got a logout timer, and use 2 factor auth.

I also don't let my cloud password managers touch a mobile device. It's fairly inconvenient, so I hesitate to recommend this to others. But I don't trust mobile devices very much. Anyone have thoughts on this?

View on HN

> My guess is their local workstation was compromised

Honestly I don't think it was even that complicated, considering when I needed to spend money on some SaaS product the "chief accountant" (because there was no CFO) straight up sent me a photo of the corporate credit card and said "delete that when you're done".

Sure, but to be fair, credit cards really aren't that dangerous of a credential to wave around. You can cancel your card at anytime, and even dispute the charges. Its like instant key rotation, with a way to also roll back time.

And they can have monthly spending limits too

> My guess is their local workstation was compromised

You mean someone was physically at the laptop/desktop and could access the OS and apps? Maybe if the employee was working remote (covid?) from, say, a cafe and left the laptop unattended when refilling coffee?

Or something else? ... Hmm, could also have been eg a browser zero day that gave someone remote access to the computer? Or a dev tools supply chain attack?

It's not that complicated. The local workstation could have had a trojan or virus that installed a keylogger or screengrabber.

Ok, thanks

Or someone watched over their shoulder. 1Password makes it all too easy to accidentally reveal your password within the app. Someone with a video camera just needs one clear frame - 1/60th of a second - with a good enough view.

Or keylogger?

Easy to imagine they just got a spiked chrome binary installed

How could an attacker make that happen?

Hack the admin machine

Reply on news.ycombinator.com