Cert-In warns of LastPass-like cyber-attack in India: Check details

India’s cyber security team, Indian Computer Emergency Response Team (Cert-In) has warned Internet users in India about a host of cyber-attacks regarding their LastPass accounts. The agency said that the malicious actors behind the LastPass data breach are using various techniques such as phishing, credential stuffing, and brute force to garner data of LastPass users in India.

In its advisory, the cyber-security response team said that the actors responsible for the LastPass data breach gained access to the source code and technical information from the utility’s developer environment to target users. The hackers reportedly used information copied from backup containing basic customer account information and related metadata from which users were accessing the password manager service, that is, LastPass.

“The backup data from the encrypted storage container was stored in a binary format containing both unencrypted data (website URLs) as well as encrypted sensitive fields such as website usernames and passwords, secure notes and form-filled data,” the agency wrote in its advisory.

“For successful execution, the threat actor may target users with a possible brute force attempt to guess the master password, or may perform phishing, credential stuffing and brute force attacks against online accounts associated with the Password manager utility,” the agency added.

It is worth noting that advisory from Cert-In comes almost a week after LastPass admitted that that hackers were able to “copy a backup of customer vault data” in a recent data breach. “The threat actor copied information from backup that contained basic customer account information and related metadata including company names, end-user names, billing addresses, email addresses, telephone numbers, and the IP addresses from which customers were accessing the LastPass service,” the company had written in its blog post.

Apart from warning users about the cyber-attack, the security agency also shared a bunch of tips for users to stay safe online. Here’s what the agency said…

How to safeguard yourself against cyber-attacks

— Change your password every 60-90 days on user-level accounts.

— Always use strong passwords with a combination of alphabets (both uppercase and lowercase), numerals and special characters. It would minimise the ability for successful brute force password guessing.

— Never reuse the master password on other websites.

— Do not browse un-trusted websites or click on un-trusted links and exercise caution while clicking on the link provided in any unsolicited emails and SMSs.

— Only click on URLs that clearly indicate the website domain.

— When in doubt, users can search for the organisation’s websites directly using search engines.

— Keep your personal information private.

The post Cert-In warns of LastPass-like cyber-attack in India: Check details appeared first on BGR India.