In September 2023, KrebsOnSecurity revealed findings from safety researchers who concluded {that a} collection of six-figure cyberheists throughout dozens of victims resulted from thieves cracking grasp passwords stolen from the password supervisor service LastPass in 2022. In a court docket submitting this week, U.S. federal brokers investigating a spectacular $150 million cryptocurrency heist mentioned they’d reached the identical conclusion.
On March 6, federal prosecutors in northern California mentioned they seized roughly $24 million price of cryptocurrencies that had been clawed again following a $150 million cyberheist on Jan. 30, 2024. The criticism refers back to the particular person robbed solely as “Sufferer-1,” however in line with blockchain safety researcher ZachXBT the theft was perpetrated in opposition to Chris Larsen, the co-founder of the cryptocurrency platform Ripple.
ZachXBT was the first to report on the heist, of which roughly $24 million was frozen by the feds earlier than it may very well be withdrawn. This week’s motion by the federal government merely permits investigators to formally seize the frozen funds.
However there is a vital conclusion on this seizure doc: It mainly says the U.S. Secret Service and the FBI agree with the findings of the LastPass breach story revealed right here in September 2023. That piece quoted safety researchers who mentioned they had been witnessing six-figure crypto heists a number of occasions every month that they believed all seemed to be the results of crooks cracking grasp passwords for the password vaults stolen from LastPass in 2022.
“The Federal Bureau of Investigation has been investigating these information breaches, and legislation enforcement brokers investigating the moment case have spoken with FBI brokers about their investigation,” reads the seizure criticism, which was written by a U.S. Secret Service agent. “From these conversations, legislation enforcement brokers on this case discovered that the stolen information and passwords that had been saved in a number of victims’ on-line password supervisor accounts had been used to illegally, and with out authorization, entry the victims’ digital accounts and steal info, cryptocurrency, and different information.”
The doc continues:
“Primarily based on this investigation, legislation enforcement had possible trigger to consider the identical attackers behind the above-described industrial on-line password supervisor assault used a stolen password held in Sufferer 1’s on-line password supervisor account and, with out authorization, accessed his cryptocurrency pockets/account.”
Working with dozens of victims, safety researchers Nick Bax and Taylor Monahan discovered that not one of the six-figure cyberheist victims appeared to have suffered the types of assaults that sometimes preface a high-dollar crypto theft, such because the compromise of 1’s e-mail and/or cell phone accounts, or SIM-swapping assaults.
They found the victims all had one thing else in widespread: Every had at one level saved their cryptocurrency seed phrase — the key code that lets anybody acquire entry to your cryptocurrency holdings — within the “Safe Notes” space of their LastPass account previous to the 2022 breaches on the firm.
Bax and Monahan discovered one other widespread theme with these robberies: All of them adopted the same sample of cashing out, quickly transferring stolen funds to a dizzying variety of drop accounts scattered throughout numerous cryptocurrency exchanges.
Based on the federal government, the same stage of complexity was current within the $150 million heist in opposition to the Ripple co-founder final 12 months.
“The size of a theft and fast dissipation of funds would have required the efforts of a number of malicious actors, and was in line with the web password supervisor breaches and assault on different victims whose cryptocurrency was stolen,” the federal government wrote. “For these causes, legislation enforcement brokers consider the cryptocurrency stolen from Sufferer 1 was dedicated by the identical attackers who carried out the assault on the web password supervisor, and cryptocurrency thefts from different equally located victims.”
Reached for remark, LastPass mentioned it has seen no definitive proof — from federal investigators or others — that the cyberheists in query had been linked to the LastPass breaches.
“Since we initially disclosed this incident again in 2022, LastPass has labored in shut cooperation with a number of representatives from legislation enforcement,” LastPass mentioned in a written assertion. “Up to now, our legislation enforcement companions haven’t made us conscious of any conclusive proof that connects any crypto thefts to our incident. Within the meantime, we’ve been investing closely in enhancing our safety measures and can proceed to take action.”
On August 25, 2022, LastPass CEO Karim Toubba instructed customers the corporate had detected uncommon exercise in its software program growth surroundings, and that the intruders stole some supply code and proprietary LastPass technical info. On Sept. 15, 2022, LastPass mentioned an investigation into the August breach decided the attacker didn’t entry any buyer information or password vaults.
However on Nov. 30, 2022, LastPass notified prospects about one other, much more severe safety incident that the corporate mentioned leveraged information stolen within the August breach. LastPass disclosed that felony hackers had compromised encrypted copies of some password vaults, in addition to different private info.
Consultants say the breach would have given thieves “offline” entry to encrypted password vaults, theoretically permitting them on a regular basis on the planet to attempt to crack a number of the weaker grasp passwords utilizing highly effective programs that may try thousands and thousands of password guesses per second.
Researchers discovered that most of the cyberheist victims had chosen grasp passwords with comparatively low complexity, and had been amongst LastPass’s oldest prospects. That’s as a result of legacy LastPass customers had been extra prone to have grasp passwords that had been protected with far fewer “iterations,” which refers back to the variety of occasions your password is run via the corporate’s encryption routines. On the whole, the extra iterations, the longer it takes an offline attacker to crack your grasp password.
Over time, LastPass pressured new customers to choose longer and extra advanced grasp passwords, they usually elevated the variety of iterations on a number of events by a number of orders of magnitude. However researchers discovered sturdy indications that LastPass by no means succeeded in upgrading lots of its older prospects to the newer password necessities and protections.
Requested about LastPass’s persevering with denials, Bax mentioned that after the preliminary warning in our 2023 story, he naively hoped individuals would migrate their funds to new cryptocurrency wallets.
“Whereas some did, the continued thefts underscore how far more must be achieved,” Bax instructed KrebsOnSecurity. “It’s validating to see the Secret Service and FBI corroborate our findings, however I’d a lot fairly see fewer of those hacks within the first place. ZachXBT and SEAL 911 reported one more wave of thefts as not too long ago as December, exhibiting the menace remains to be very actual.”
Monahan mentioned LastPass nonetheless hasn’t alerted their prospects that their secrets and techniques—particularly these saved in “Safe Notes”—could also be in danger.
“Its been two and a half years since LastPass was first breached [and] a whole lot of thousands and thousands of {dollars} has been stolen from people and corporations across the globe,” Monahan mentioned. “They may have inspired customers to rotate their credentials. They may’ve prevented thousands and thousands and thousands and thousands of {dollars} from being stolen by these menace actors. However as an alternative they selected to disclaim that their prospects had been are danger and blame the victims as an alternative.”
