The hacker who infiltrated LastPass last month had access for four days, according to the company’s investigation. However, LastPass has found no evidence the culprit ever tampered with the company’s software code or accessed user information, such as encrypted passwords.
The company completed its investigation into the breach with the help of cybersecurity firm Mandiant. The results confirm the hacker only managed to gain access to LastPass’s internal IT systems devoted to software development.
“Our investigation revealed that the threat actor’s activity was limited to a four-day period in August 2022,” LastPass said in an update on the breach. “During this timeframe, the LastPass security team detected the threat actor’s activity and then contained the incident. There is no evidence of any threat actor activity beyond the established timeline.”
The investigation also found the attacker exploited a “compromised endpoint” belonging to a LastPass developer, meaning they hijacked access to the developer's computer, possibly through malware.
“While the method used for the initial endpoint compromise is inconclusive, the threat actor utilized their persistent access to impersonate the developer once the developer had successfully authenticated using multi-factor authentication,” LastPass says.
Fortunately, the company designed its development software systems to operate separately from the production side of LastPass. “Secondly the Development environment does not contain any customer data or encrypted vaults,” it adds. "Thirdly, LastPass does not have any access to the master passwords of our customers’ vaults."
Nevertheless, the access allowed the hacker to steal some portions of LastPass’s source code. During the investigation, the company checked whether the attacker may have tampered with any computer code on the developer side. “We conducted an analysis of our source code and production builds and confirm that we see no evidence of attempts of code-poisoning or malicious code injection,” LastPass said.
The company added: “Developers do not have the ability to push source code from the Development environment into Production. This capability is limited to a separate Build Release team and can only happen after the completion of rigorous code review, testing, and validation processes.”
LastPass says it hired “a leading cyber security firm” to bolster its safeguards around accessing and storing company source code. “Further, we have deployed enhanced security controls including additional endpoint security controls and monitoring,” it adds.
However, LastPass declined to answer questions about who may be responsible for the attack, including whether it's linked to a recent wave of SMS phishing attacks against numerous companies. “We have completed our investigation into the security incident and have updated our blog post on the incident to provide transparency and peace of mind to our customers," it said in response to a request for comment.