Attackers Are Targeting People, Not Networks
One of the most-cited breaches of the last five years never touched the company's corporate network. Cody Kretsinger walks through the actual way in: an engineer home for the night, off the clock, running something on a personal machine nobody at work knew about. For certain people at every company, that machine sits close enough to the crown jewels to end the whole thing. How attackers decide which single person is worth the time, and what to do about the handful of people at your own company who can unlock everything.
WATCH / LISTENOne attack, told properly. Each episode takes a single breach or backdoor apart: how it was built, who caught it, and what almost happened instead. Part of Galactic's Threat Aware.
Transcript
Auto-generated transcript, apologies for any errors. Download as text
Cold open
Somewhere a senior engineer is home and off for the night. Maybe streaming a movie off of his own media server, the one running on a personal computer, the one he set up years ago and completely forgot about. That machine has a hole in it. A known one now, but the fix came out in 2020. He just never installed it. Why would he? He's at home. And he is One of four people on the planet with the keys to the vaults, the keys to the crown jewels, the actual encryption keys for an entire organization, and a company whose entire job is keeping your password safe.
Sometimes attackers don't need to go through a fortress, they don't need to lay a finger on the hardened corporate network everyone's so proud of. So what do they do? They go to An engineer's house through the thing he watches movies on. Maybe they drop a keylogger and wait for him to log into work. Password, MFA, all of it. And they copy it right from his own fingertips. Then they can walk into a vault and leave with backups of customer data.
Narrator
This is Privilege Escalation. Part of the Threat Aware Podcast Network. Incidents get reported, they rarely get explained. Each episode takes one attack apart from the inside, delivered with the perspective of someone who has spent time on both sides of an attack. How they got in, and how you stop them. Here's your host, Cody Kretsinger.
I'm Cody Kretsinger, and this is Privilege Escalation. Today we're talking about LastPass. Yes, LastPass. But really, it's about where your perimeter actually is. And it's not where you think. It's in somebody's living room. And I'd know because that's exactly where I'd go looking. LastPass, the password manager that millions of people use. The whole business is about trust, right? And in 2022, they got breached. The way in wasn't some zero day against their infrastructure. It was actually just one employee's home computer. I want you to stop picturing the network when you think about attack service. Start picturing people and specific ones because that's exactly how the other side pictures it.
Attackers, red teamers, threat actors, they just don't see the bits in the bytes. The good ones study the people too. So LastPass keeps backups of customer vault data in cloud storage. To get to them, you need Decryption keys. And only four people in that whole company could touch those keys. Four. The attackers picked one. In fact, they picked a senior DevOps engineer. And instead of going after the conglomerate of LastPass, they went after him at home. On his personal computer, he was running a piece of media software, what we now understand to probably be Plex.
Plex is the kind of thing that you Used to stream your own movies. This specific version of Plex had a vulnerability and the patch had been out for something like two years. He just never applied it because he's at home. It's a home machine. It's not corporate. And frankly, let's be honest, it probably wasn't even on his radar. That was the door. Attackers walked through it, got onto his personal machine, and planted a keylogger. They waited. They waited for him to just do his job. He logs into work, types his master password, does the MFA dance and shimmy, you know, the one where you gotta check your phone and all that stuff.
The whole routine there. And the key logger or the piece of software that just records keystrokes, scooped it all off of his keyboard. Now they're holding a key holder's credentials. The attackers walk into the corporate vault and they leave. With backups of customer password vaults. So to be clear, nobody broke into LastPass or the LastPass network. They broke into a DevOps employee's living room. And it just so happened that LastPass came with it. Let me tell you how this looks from my old side of the table. When you're up against a company with real security, so things like a hardened network or a security operations center, a SOC.
The works. You stop trying to kick in the door. You instead kick in a person, or really you just you pick a person to go after. And not a random one, just the right one. So you figure out who actually holds the access to the things that matter. And in most shops, that's just a tiny handful of people, oftentimes listed on the website. And then you learn that one human. Where do they go to work from? What do they run at home? What they bragged about Online three years ago, the home lab that they were proud of.
And you're not in a rush as an attacker because you've got one target and all of the time in the world. Here's the asymmetry of this kind of attack. The company might have a hundred people defending the corporate network. The engineer defending his own living room, that's just him on his own time, with software he's going to forget to update. The network was never the soft spot. It often never is. The person was in this circumstance, and the person, the identity, is almost always the weakness. So what do you do about it? Well, you need to know who your four people are.
Every organization has them. It's a handful who can unlock everything, the admins, the key holders, the one person who can reset everything. Find them. And it's likely a shorter list than you think. And then you treat them differently, but not like you're thinking. Not with more training slides, but with just a different setup. The privileged work that they do, the stuff that touches the crown jewels, that needs to happen on some sort of lockdown machine that does nothing else. So no personal email, no media software, no home lab, just a boring single-purpose. Computer. So what's running on their home computer in this particular instance stops being the question that can end a company.
And let's get honest about what you can see. Almost certainly your organization can't watch personal devices for your most privileged people. That's not a gap you can patch. It's a gap that you design around by making sure that the work that matters never happens somewhere you're actually blind. Here's the honest truth about this situation. The secure vendor that everybody talks about is essentially one gaming server away from a breach. So is your hardened network, and let's be honest, so are you. We built this whole comfort blanket out of the wrong things. We, you know, there's this idea of we used a trusted vendor, we've got a next gen firewall, we passed an audit.
And the entire time the keys to the kingdom are sitting on a laptop next to a media box that somebody set up in 2019 and never patched. Because it's their house. And no one ever told them their house was in scope. A company whose literal job, literal job, is protecting passwords lost its vault backups. Not through the fortress they built, through one engineer's Home movie setup. And if it can happen to the people who do this for a living, sit with that for a second. Right now, unpatched in homes of a handful of people, there is more credentials out there that can unlock your whole company or somebody else's.
The ugly part here isn't that the engineer messed up. Blaming him is honestly the lazy read on the situation, and I won't do that. The ugly part is that we set it up this way. We handed one guy the keys to everything. We let him use the same tired brain and the same evening that we've all got, and never once gave him a setup that assumed he was the target. He was because identities almost always are. So if you're gonna do one thing after this, go write down the names. The actual human beings who unlock everything you've got.
Your four people. It might be two, it might be twelve, but get them on paper. Then ask one question about each. If somebody owned their personal life, their home computer, their phone, their Sunday off, could they reach your crown jewels? If the answer is yes, you don't have a technology problem. You've got a handful of people carrying your whole company. Around on machines you can't see. Fix that first, and everything else is the details.