Our investigation has revealed that a threat actor has exfiltrated encrypted backups from a third-party cloud storage service related to Central, Pro, and join products. This is a serious issue, as losing backups is almost as bad as losing your password vaults. We also have evidence that the threat actor was able to exfiltrate an encryption key for a portion of the encrypted backups. This means that the backups were not as secure as they seemed, as the encryption key could be used to easily unencrypt them. The affected information may include account usernames, salted and hashed passwords, Multi-Factor Authentication settings, product settings, and licensing information. While Rescue and GoToMyPC encrypted databases were not exfiltrated, MFA settings of a small subset of customers were impacted. GoTo has taken the necessary steps to reset passwords and reauthorise MFA settings. The breach occurred at a third-party cloud storage service, which both GoTo and LastPass use. This raises questions about the security configuration of the cloud-based storage for the backups, as well as the encryption key for those backups. Graham Cluley is a veteran of the anti-virus industry, having worked for a number of security companies since the early 1990s. He is now an independent security analyst, and regularly makes media appearances and speaks internationally on the topics of computer security, hackers, and online privacy.
This Cyber News was published on grahamcluley.com. Publication date: Mon, 30 Jan 2023 16:37:02 +0000