{"id":5898,"date":"2015-06-18T09:18:08","date_gmt":"2015-06-18T13:18:08","guid":{"rendered":"http:\/\/kasperskydaily.com\/uk\/?p=5898"},"modified":"2020-02-26T15:11:12","modified_gmt":"2020-02-26T15:11:12","slug":"lastpass-calls-for-master-password-reset","status":"publish","type":"post","link":"https:\/\/www.kaspersky.co.uk\/blog\/lastpass-calls-for-master-password-reset\/5898\/","title":{"rendered":"LastPass users have to urgently change their passwords"},"content":{"rendered":"<p>Online password managers can make your life much easier by automatically entering individual passwords for each website and service you have an account for. \u00a0It\u2019s a convenient tool. \u00a0That is, \u00a0unless it\u2019s hacked. In this case, by discrediting a single password cyber criminals can receive access to valuable information \u2014 even to your banking credentials.<\/p>\n<p>LastPass, a popular password manager, <a href=\"https:\/\/threatpost.com\/lastpass-network-breached-calls-for-master-password-reset\/113324\" target=\"_blank\" rel=\"noopener nofollow\">has recently disclosed<\/a>\u00a0a\u00a0network breach. Attackers compromised user email addresses, password reminders, per-user salts and authentication hashes. The passwords themselves are not compromised, as the service doesn\u2019t store them in its cloud. Nevertheless, LastPass recommends users to change their LastPass master passwords and enable multi-factor authentication.<\/p>\n<p>\u00a0<\/p>\n<p>Let\u2019s give credits to the company: when LastPass found the breach, it quickly came out with a public warning. For hackers benefits, many huge companies try keeping breaches in secret, but not in this case.<\/p>\n<p>At the same time, potential consequences of the breach seem to be dubious. CEO and founder of LastPass Joe Siegrist <a href=\"https:\/\/blog.lastpass.com\/2015\/06\/lastpass-security-notice.html\/\" target=\"_blank\" rel=\"noopener nofollow\">claims that the incident will not influence \u201cthe vast majority of users\u201d<\/a>. Some researchers support this position, declaring that there is no risk for users with strong passwords.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">We've updated the blog with follow-up information to user questions about yesterday's announcement: <a href=\"https:\/\/t.co\/DaW6LiIp7M\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/DaW6LiIp7M<\/a><\/p>\n<p>\u2014 LastPass (@LastPass) <a href=\"https:\/\/twitter.com\/LastPass\/status\/610906651969728513?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">June 16, 2015<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Other researchers consider that the breach can lead to a new wave of malicious activity aimed directly at LastPass users. Armed with a list of email addresses, hackers could create a targeted phishing campaign to defraud users.<\/p>\n<p>What stops cyber-criminals from spamming LastPass users with fraudulent letters, disguised as official ones? People will have heard about the breach and then receive an email from a hacker, asking them to reset their master password. \u00a0Bingo: they\u2019re in.<\/p>\n<blockquote class=\"twitter-pullquote\"><p>#LastPass users have to urgently change their #passwords<\/p><a href=\"https:\/\/twitter.com\/share?url=https%3A%2F%2Fkas.pr%2FZ8fm&amp;text=%23LastPass+users+have+to+urgently+change+their+%23passwords\" class=\"btn btn-twhite\" data-lang=\"en\" data-count=\"0\" target=\"_blank\" rel=\"noopener nofollow\">Tweet<\/a><\/blockquote>\n<p>Here\u2019s a list of recommendations for all those affected:<\/p>\n<ul>\n<li>Follow official recommendations: change your master password and enable multi-factor authentication.\u00a0Also, if you can, enable 2-factor authentication on other websites as well.<\/li>\n<li>Do not to click links in e-mail letters which claim they are from LastPass. These letters can be fake, that\u2019s why it\u2019s better to enter the url manually in your browser\u2019s address bar.<\/li>\n<li>Be sure that you don\u2019t use your master password on any other web-site. It\u2019s always good to use different passwords for different services, by the way.<\/li>\n<\/ul>\n<p>This is not the first time time when LastPass has to deal with security issues. Last summer the University of California Berkeley revealed security flaws in five security managers, including LastPass. The other four were RoboForm, My1Login, PasswordBox and NeedMyPassword.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Data breaches have become a routine. You can\u2019t prevent it, but there is a way to minimize the damage. <a href=\"http:\/\/t.co\/Gq4ERG41NK\" target=\"_blank\" rel=\"noopener nofollow\">http:\/\/t.co\/Gq4ERG41NK<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/497132120155103232?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">August 6, 2014<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>There is no <em>perfect<\/em> security solution. \u00a0Companies need to have the courage to take responsibility and reveal the breach incident, despite the risk of losing customers. \u00a0Some of LastPass users will want to switch to other services, while others will be loyal no matter what happens.<\/p>\n<p>If you are considering the new password manager, make sure you check out \u2014 <a href=\"https:\/\/kas.pr\/Vg4u\" target=\"_blank\" rel=\"noopener\">Kaspersky Password Manager<\/a>.<\/p>\n<p>You can go even further and install <a href=\"https:\/\/www.kaspersky.co.uk\/advert\/total-security-multi-device?redef=1&amp;THRU&amp;reseller=gb_KDpost_pro_ona_smm__onl_b2c_kasperskydaily_lnk____ktsmd___\" target=\"_blank\" rel=\"noopener\">Kaspersky Total Security \u2014 Multi-Device<\/a>. It has built-in password manager as well as all the security features you need to protect your devices and your data from any existing malware.<\/p>\n<p>\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Online password managers can make your life much easier by automatically entering individual passwords for each website and service you have an account for. \u00a0It\u2019s a convenient tool. \u00a0That is,<\/p>\n","protected":false},"author":40,"featured_media":5899,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[5,2026],"tags":[863,191,78,1046,187,76,43,1045,97,268],"class_list":{"0":"post-5898","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-news","8":"category-threats","9":"tag-breach","10":"tag-data","11":"tag-hackers","12":"tag-kaspersky-password-manager","13":"tag-passwords","14":"tag-phishing","15":"tag-privacy","16":"tag-risks","17":"tag-security-2","18":"tag-vulnerabilities"},"hreflang":[{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/lastpass-calls-for-master-password-reset\/5898\/"},{"hreflang":"en-ae","url":"https:\/\/me-en.kaspersky.com\/blog\/lastpass-calls-for-master-password-reset\/4947\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/lastpass-calls-for-master-password-reset\/5490\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/lastpass-calls-for-master-password-reset\/6288\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/lastpass-calls-for-master-password-reset\/6227\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/lastpass-calls-for-master-password-reset\/8181\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/lastpass-calls-for-master-password-reset\/9095\/"},{"hreflang":"pt-br","url":"https:\/\/www.kaspersky.com.br\/blog\/lastpass-calls-for-master-password-reset\/5447\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/lastpass-calls-for-master-password-reset\/5676\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/lastpass-calls-for-master-password-reset\/7977\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/lastpass-calls-for-master-password-reset\/8181\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/lastpass-calls-for-master-password-reset\/9095\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/lastpass-calls-for-master-password-reset\/9095\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.co.uk\/blog\/tag\/breach\/","name":"breach"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/posts\/5898","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/users\/40"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/comments?post=5898"}],"version-history":[{"count":5,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/posts\/5898\/revisions"}],"predecessor-version":[{"id":19224,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/posts\/5898\/revisions\/19224"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/media\/5899"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/media?parent=5898"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/categories?post=5898"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/tags?post=5898"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}