Writing
Anatomy of an Identity Incident

The Vault Was Only as Safe as a Home Computer

Anatomy of an Identity Incident — LastPass, 2022. The decryption keys to every customer's vault backups were reachable through one engineer's personal home PC.

Michael AbramovichMarch 5, 20235 min read

Forensic write-ups of public identity breaches, strictly at the identity layer. No vendor is the villain — the point is the structural class of failure, not the logo on it.

The 60-second version

In the second of two linked 2022 intrusions, an attacker who had already stolen technical information from a development environment went looking for the keys to the kingdom — literally, the decryption keys for cloud backups of customer vault data. Only four engineers held those keys. The attacker picked one, and got to them not through the corporate network but through that engineer's personal home computer, exploiting a vulnerable third-party media application to plant a keylogger.

From there it was patient and quiet. The keylogger captured the engineer's master password as they typed it — after they had passed multi-factor authentication — which opened their corporate password vault, which held the credentials and keys needed to reach the cloud storage, which held the backups of everyone else's vaults. The crown jewels were protected by MFA and held by only four people. They were also one consumer-software vulnerability on one home PC away.

The identity timeline

Only identity-relevant events.

  • Earlier in 2022 — A first intrusion lifts source code and technical information from a development environment. No customer vaults yet, but the attacker now has a map.
  • The target selection — The decryption keys for the customer backup storage are held by just four senior DevOps engineers. Concentrated access makes target selection easy: pick one of four.
  • Aug 12 – Oct 26, 2022 — The window of the second intrusion. The attacker compromises the chosen engineer's personal home computer by exploiting a vulnerable third-party media software package, gaining remote code execution and implanting a keylogger.
  • The capture — The engineer authenticates with MFA and types their master password. The keylogger records it. The attacker now has the engineer's corporate vault.
  • The escalation — Inside that vault are the credentials and decryption keys for the shared cloud storage. The attacker uses them to reach the backups of customer vault data and exfiltrate them — encrypted vault contents alongside unencrypted metadata such as stored site URLs.
  • Disclosure — The full shape of the second incident, including the home-computer vector and the four-key-holder detail, reaches customers months after the intrusion window closed.

The pivot point

The pivot is the master password being captured by a keylogger on a device the company did not control.

It is worth being exact about what MFA did and did not do here, because this is where the lesson lives. The engineer authenticated correctly. MFA worked — it proved the engineer possessed the second factor. But MFA proves possession at a moment; it says nothing about whether the device doing the typing is trustworthy. A keylogger sitting underneath the login watches the master password go by regardless of how many factors preceded it. The second factor was a closed front door on a house with no back wall.

And the reason the capture mattered so much is the second half of the pivot: that one master password unlocked a vault that contained the decryption keys for everyone's backups. The blast radius wasn't one engineer's secrets; it was the concentration. Four people held the keys, those keys lived behind a password a keylogger could read, and that password was typed on a personal machine running consumer media software. Stack those three facts and the crown jewels were reachable from a living room.

What would have caught it

Naming controls, not products.

Privileged work on managed, hardened endpoints only. The single structural fix: access to decryption keys and production secrets must not be possible from an unmanaged personal device. Device trust and posture checks — is this a managed, compliant machine? — are the control that makes a home-PC keylogger a dead end.

Hardware-bound credentials, so a captured password isn't enough. A typed master password can be keylogged. A credential bound to a hardware authenticator cannot be replayed from a different machine. For the highest-value access, the secret should be something a keylogger cannot turn into usable access on its own.

Breaking up key concentration. Four people holding the keys to all customer backups is efficient and dangerous. Splitting control — quorum/M-of-N approval for decryption-key use — means compromising one engineer is not enough.

Detecting anomalous access to backup storage. Bulk access to customer backup data is a rare, high-signal event. Alerting on it gives a tripwire independent of whether the endpoint was clean.

Treating "first intrusion" as "they now have a map." The two incidents were linked: data from the first enabled the second. A breach that "only" took source code or technical data should raise privileged-access scrutiny, because reconnaissance is what the attacker actually bought.

The last mile

Corporate identity did its job up to the edge of the managed world. MFA was enforced. The vault was a vault. Access to the keys was limited to a handful of trusted engineers. Every one of those is a reasonable control, and none of them was the failure.

The failure was in the span the corporate controls did not reach: the privileged engineer's personal device. That home computer was outside the company's management — no enforced patching of its consumer software, no EDR, no device-trust gate — and yet it was functionally upstream of the most sensitive keys the company held. The mile between "this engineer is trusted and uses MFA" and "this engineer can only exercise that trust from a device we actually control" was nobody's. It wasn't the identity product's job; MFA was on. It wasn't, in practice, anybody's job, because the personal-device boundary is exactly the kind of seam that falls between IT, security, and an individual's home life.

That is the shape of the last mile for privileged human identity. The crown-jewel access is easy to grant and easy to protect at login; what's hard, and ownerless, is guaranteeing the conditions under which that access is exercised — the device, its posture, the concentration of who holds what. Those conditions are continuous operational work across every privileged human, forever, and the product you bought does not do them for you.

For defenders

Five things you can check this week.

  1. Forbid privileged access from unmanaged devices. Gate decryption keys, production, and secret stores behind device-trust/posture checks. A personal laptop should not be able to reach them, full stop.
  2. Make the highest-value credentials hardware-bound. So a keylogged or phished password alone cannot be turned into access.
  3. Count your key-holders, then break up the concentration. If a single compromised person can reach all customer data, require quorum approval for the most sensitive actions.
  4. Alert on bulk access to backups and secret stores. It's rare enough to be high-signal.
  5. Escalate after a "minor" breach. If source code or internal data leaks, assume reconnaissance and tighten privileged access before the second act.

Built from public reporting and the parties' own disclosures; sources below.

Sources

#lastpass #privileged-access #endpoint #secrets #last-mile