Cybersecurity News

1331 readers

5 users here now

Welcome to Cybersecurity News!

A community that collect news and other tidbits related to cybersecurity in all its domains.

There are no hard and fast rules regarding what to post here-- we are fine with both pop news articles and more technical pieces regarding cybersecurity.

We use a bot called flynnbot to repost some rss feed content but the majority of posts are human-curated.

New to Cybersecurity?

Here are some resources to get you started:

Related Communities

[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]

founded 1 year ago

MODERATORS

[email protected]

More than $35 million has been stolen from over 150 victims since December — ‘nearly every victim’ was a LastPass user (www.theverge.com)

submitted 11 months ago by [email protected] to c/[email protected]

4 comments fedilink hide all child comments

cross-posted from: https://lemmy.world/post/4636459

More than $35 million has been stolen from over 150 victims since December — ‘nearly every victim’ was a LastPass user::Security experts believe some of the LastPass password vaults stolen during a security breach last year have now been cracked open following a string of cryptocurrency heists

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 2 points 11 months ago (2 children)

How does this happen? Isn't the database encrypted? Did they use a weak masterpassword?

[–] [email protected] 2 points 11 months ago

lastpass has shitty security and they're constantly getting hacked.

[–] [email protected] 1 points 11 months ago

It is encrypted, but LastPass allowed weak passwords until 2018, and also allowed low iterations on their vaults. On top of that, because the hackers have access to the entire vault, they can do local brute force attacks, bypassing any rate limiting LastPass had in place to prevent it. They're using massive mining rigs (or servers with a lot of GPU power) to run brute force attacks with thousands of guesses per second.