{"id":9095,"date":"2015-06-18T09:41:49","date_gmt":"2015-06-18T13:41:49","guid":{"rendered":"https:\/\/www.kaspersky.com\/blog\/?p=9095"},"modified":"2020-02-26T11:02:02","modified_gmt":"2020-02-26T16:02:02","slug":"lastpass-calls-for-master-password-reset","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com\/blog\/lastpass-calls-for-master-password-reset\/9095\/","title":{"rendered":"LastPass users need to change their passwords immediately"},"content":{"rendered":"<p>An online password manager can make your life much easier by automatically entering individual passwords for each website and service you visit. It is a very convenient tool \u2013 unless it is hacked. In that instance, by discrediting a single password, cyber criminals can receive access to invaluable information,\u00a0including\u00a0banking credentials.<\/p>\n<p>LastPass, a popular password manager, <a href=\"https:\/\/threatpost.com\/lastpass-network-breached-calls-for-master-password-reset\/113324\" target=\"_blank\" rel=\"noopener nofollow\">has recently disclosed a network breach<\/a>. Attackers compromised user email addresses, password reminders, per-user salts and authentication hashes. The passwords themselves were not compromised, as the service doesn\u2019t store them in its cloud. Nevertheless, LastPass recommends users change their LastPass master passwords and enable multi-factor authentication.<\/p>\n<p>Let\u2019s give credit to the company: When LastPass found the breach, it quickly released a public warning. To the hackers\u2019 benefit, many large companies try keeping breaches a secret, but not here.<\/p>\n<p>Still, potential consequences of the breach seem to be dubious. CEO and founder of LastPass Joe Siegrist <a href=\"https:\/\/blog.lastpass.com\/2015\/06\/lastpass-security-notice.html\/\" target=\"_blank\" rel=\"noopener nofollow\">claims that the incident will not influence \u201cthe vast majority of users\u201d<\/a>. Some researchers support this position, declaring there is no risk for users with strong passwords.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">We've updated the blog with follow-up information to user questions about yesterday's announcement: <a href=\"https:\/\/t.co\/DaW6LiIp7M\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/DaW6LiIp7M<\/a><\/p>\n<p>\u2014 LastPass (@LastPass) <a href=\"https:\/\/twitter.com\/LastPass\/status\/610906651969728513?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">June 16, 2015<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Other researchers consider that the breach can lead to a new wave of malicious activity aimed directly at LastPass users. Being armed with the list of real email addresses hackers can create a targeted phishing campaign to defraud the lacking data. For example, LastPass is advising users to change their master passwords.<\/p>\n<p>What stops cybercriminals from spamming LastPass users with fraudulent letters, disguised as official ones? When people receive an unsuspicious email with warnings and recommendations from the \u201cdevelopers\u201d, they can readily follow a link to change their master password \u2014 and give it right to the cyber criminals\u2019 hands.<\/p>\n<blockquote class=\"twitter-pullquote\"><p>#LastPass users need to\u00a0change their #passwords immediately<\/p><a href=\"https:\/\/twitter.com\/share?url=https%3A%2F%2Fkas.pr%2F8Byd&amp;text=%23LastPass+users+need+to%C2%A0change+their+%23passwords+immediately+\" class=\"btn btn-twhite\" data-lang=\"en\" data-count=\"0\" target=\"_blank\" rel=\"noopener nofollow\">Tweet<\/a><\/blockquote>\n<p>Here is what we can recommend to LastPass users:<\/p>\n<ol>\n<li>Follow official recommendations: Change your master password and enable multi-factor authentication. It would be absolutely great if you could enable it on other websites as well, e.g. on social networks and emails.<\/li>\n<li>Do not to click links in e-mail letters which claim they are from LastPass. These letters can be fake, that\u2019s why it\u2019s better to enter the url manually in your browser\u2019s address bar.<\/li>\n<li>Be sure that you don\u2019t use your master password on any other website. It\u2019s always good to use different passwords for different services.<\/li>\n<\/ol>\n<p>This is not the first time LastPass has had to deal with security issues. Last summer the University of California Berkeley revealed security flaws in five security managers, including LastPass. The other four were RoboForm, My1Login, PasswordBox and NeedMyPassword.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Data breaches have become a routine. You can\u2019t prevent it, but there is a way to minimize the damage. <a href=\"http:\/\/t.co\/Gq4ERG41NK\" target=\"_blank\" rel=\"noopener nofollow\">http:\/\/t.co\/Gq4ERG41NK<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/497132120155103232?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">August 6, 2014<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>As you may know, there is no perfect security solution. A company needs courage to take responsibility and reveal breaching incidents despite the risk of losing clients. Some LastPass users will want to switch to other services, while others will be loyal no matter what happens.<\/p>\n<p>If you are considering the new password manager, we can\u2019t help but recommend the one we are sure of \u2014 <a href=\"https:\/\/www.kaspersky.com\/password-manager\" target=\"_blank\" rel=\"noopener nofollow\">Kaspersky Password Manager<\/a>. We don\u2019t store users\u2019 passwords, so this data is impossible to steal from Kaspersky servers \u2013 it\u2019s simply not there.<\/p>\n<p>You can go even further and install <a href=\"https:\/\/www.kaspersky.com\/advert\/total-security-multi-device?redef=1&amp;THRU&amp;reseller=gl_KDpost_pro_ona_smm__onl_b2c_kasperskydaily_lnk____ktsmd___\" target=\"_blank\" rel=\"noopener nofollow\">Kaspersky Total Security \u2014 Multi-Device<\/a>. It has built-in password manager as well as all the security features you need to protect your devices and your data from any existing malware.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The web service for secure password storage, LastPass, asks users to change their passwords ASAP.<\/p>\n","protected":false},"author":40,"featured_media":9101,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[5],"tags":[901,191,78,1147,909,124,187,76,43,1146,97,268],"class_list":{"0":"post-9095","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-news","8":"tag-breach","9":"tag-data","10":"tag-hackers","11":"tag-kaspersky-password-manager","12":"tag-kaspersky-total-security","13":"tag-lastpass","14":"tag-passwords","15":"tag-phishing","16":"tag-privacy","17":"tag-risks","18":"tag-security-2","19":"tag-vulnerabilities"},"hreflang":[{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/lastpass-calls-for-master-password-reset\/9095\/"},{"hreflang":"en-ae","url":"https:\/\/me-en.kaspersky.com\/blog\/lastpass-calls-for-master-password-reset\/4947\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/lastpass-calls-for-master-password-reset\/5490\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/lastpass-calls-for-master-password-reset\/5898\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/lastpass-calls-for-master-password-reset\/6288\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/lastpass-calls-for-master-password-reset\/6227\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/lastpass-calls-for-master-password-reset\/8181\/"},{"hreflang":"pt-br","url":"https:\/\/www.kaspersky.com.br\/blog\/lastpass-calls-for-master-password-reset\/5447\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/lastpass-calls-for-master-password-reset\/5676\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/lastpass-calls-for-master-password-reset\/7977\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/lastpass-calls-for-master-password-reset\/8181\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/lastpass-calls-for-master-password-reset\/9095\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/lastpass-calls-for-master-password-reset\/9095\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.com\/blog\/tag\/breach\/","name":"breach"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/9095","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/users\/40"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/comments?post=9095"}],"version-history":[{"count":4,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/9095\/revisions"}],"predecessor-version":[{"id":33530,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/9095\/revisions\/33530"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/media\/9101"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/media?parent=9095"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/categories?post=9095"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/tags?post=9095"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}