Bonum Certa Men Certa

LastPass Breach and More Collaterals, Beyond LastPass: How Sirius 'Open Source' Causes Security Headaches/Breaches for Clients (Without Even Telling Them!)

Date: Tue, 30 Aug 2022 09:00:50 +0100
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; 
rv:1.7.6) Gecko/20050317 Thunderbird/1.0.2 Mnenhy/0.7.4.0
From: Roy Schestowitz
Subject: Handover to Shift 2 (30/08/22)
To: [whole team]



[...]

https://www.darkreading.com/cloud/lastpass-data-breach-source-code-stolen

users need to change all the passwords they have there and not keep them there if they value real security not paper mills.


Summary: Sirius 'Open Source' failed to protect its clients. While in Sirius I've been warning management about this for 4 years; all I received for these warnings was a bunch of threats against me (for raising and politely bringing up the subject).

TODAY is a holiday here, but the subject cannot be left aside. The saga cannot be paused because the holidays are being exploited by truly nefarious companies for cover-up.



Those who are following Daily Links may have noticed already that there are further admissions of a breach at LastPass; mind the timing... just before the most major holiday, probably by intention (it's a well-known Public Relations or "disaster mitigation" strategy).

"Suffice to say, in the case of security breaches, people must be informed as soon as possible so that they can take action."We've decided that it would be better not to surrender to such "strategic timing" tricks. The revelations were scheduled to be accompanied by PR, complete with "waffle" and face-saving lies (postponed for months... to be explained much later). Suffice to say, in the case of security breaches, people must be informed as soon as possible so that they can take action. But not so with LastPass! It would not be the first company to do so. They just wish to say they said something (without anyone truly noticing), at least in retrospect. It's in-hindsight optics.

But this post isn't primarily about LastPass itself; it is a bigger blunder that a company which calls itself "Open Source" actively outsourced away from Open Source to this highly untrustworthy company. The CEO of "Sirius Open Source" [sic] was even trying to defend all the LastPass lies, just as he doubles down on his own lies routinely. He is a pathological liar, so he can probably relate to those who do the same at LastPass.

What we're seeing at LastPass is just face-saving admissions to clean their hands and claim they were "transparent" and complied with the law (to avoid fines/penalties). But we might not see much press coverage about this; journalists (what's left of them) are already on holiday. The editors won't pick any stories from them, no matter how important or urgent those stories may be. Heck, not many people will read the news, either!

"What we're seeing at LastPass is just face-saving admissions to clean their hands and claim they were "transparent" and complied with the law (to avoid fines/penalties)."As we shall show, in light of more incidents and few reports (far too few), the time to cover this is tonight, not next month as expected/scheduled.

LastPass has certainly failed, but so did Sirius. Sirius cannot claim to be a passive victim here!!

Sirius was picking on the people who reported that LastPass had suffered a security breach and wanted to do the right thing about it. That's me. In this particular case it's not the fault of another company but the fault of Sirius for putting all the passwords "in the cloud" in spite of repeated warnings from its long-serving and loyal staff. Honest staff.

LastPass users: Your info and password vault data are now in hackers’ hands - Ars Technica

Having cautioned about LastPass, which had already suffered breaches, I was repeatedly threatened in video calls for doing what's right. Of course those video calls were done using proprietary software -- that's what Sirius was becoming. Of course they said I'd receive a copy of the recording but never received any! At Sirius, the lying and deceit had become routine, they ultimately became the norm. In a company where about half the staff goes by the name "manager" the only way to progress was to participate in the lying.

So what happens now? Well, Sirius could get sued by the clients, not just asked for a refund, for misinforming and neglecting systems, even abusing people who cautioned about this internally. I don't intend to contact clients personally, but maybe they will realise this regardless (by serendipity). What about ISO? Will it revoke certifications? We'll cover this in a separate part next month.

Do not expect much press coverage about LastPass, owing partly to timing. From the latest Daily Links:



I cautioned about this internally about half a dozen times (the LastPass breaches alone), but nothing was done by any of the managers. So they're all culpable. They all failed to act. One of them, who lies routinely, said that according to LastPass, LastPass is OK and things are safe. They're just lying to everyone, like he habitually does. Cover-up basically.

"My latest warning about LastPass came about 1-2 days before I left the company."Sirius is a disaster, it is a catastrophe, and it'll never admit it. So someone needs to say this out loud. They're probably still covering up for Sirius and its misguided use of LastPass, strictly hiding it from most of the clients (as usual).

My latest warning about LastPass came about 1-2 days before I left the company. I reproduce my full message below, but bear in mind that some of the pertinent details will be shown next month when we're done with the report and move on to bigger issues:



Hi,

I've been receiving some relatively solid and professional legal advice for several weeks already. To put it quite bluntly, the impression legal professionals get is that the company cannot afford lawyers and thus makes wild guesses, based on a gut feeling at best.

In Rianne's case, the allegations are shockingly weak. This, in turn, makes the trail of correspondence work very strongly in our favour. We're not impulsive, we just follow the law. We've both followed the law all along. We know our rights and we have people to assess the law.

The latest invitation is legally problematic for several distinct reasons. It would not constitute a fair 'trial', on a number of different grounds. What you're trying to apply here is the controversial Reid method, which isn't just notorious but also unlawful in some jurisdictions. No proper protocols and procedures were followed until (probably due to a lack of legal advice) more recently. In fact, "Investigation Meeting" suddenly and disingenuously became "Disciplinary Hearing". The process embarked upon did not respect the employee's right to privacy (setting out the importance of confidentiality) and it seems to be more of a personal vendetta than a real, justifiable case.

Regarding any such hearing, where possible the employer should get somebody who's not involved in the case to carry out the investigation, for example another manager or someone from HR. HR does not exist in Sirius per se, so the company needs to contract outwards, just like several years ago where HR sided with us, not with the harasser in chief. We never received an apology after that incident. And moreover, I wish to make it known that I am referring to a single example of many such incidents. I can elaborate later.

The sudden and very much unprovoked-for suspension is problematic on a number of legal grounds. There's consensus among legal professionals (visited or spoke to several) that it was inappropriate and over the top. Perhaps the purpose of it was to obstruct the accused from accessing defensive/supportive evidence. There's no reason for a suspension of someone who for 12 years never ever did something "dodgy" to company or client assets; quite the contrary. Unless the employer thinks there is a risk that the employee might tamper with evidence or influence witnesses, a suspension is entirely unnecessary. I have no history of tampering with evidence or influencing witnesses. In fact, the "evidence" presented (only a fortnight later!) is actually controlled by me rather than the company. The IRC logs are very informal and have nothing to do with Sirius.

There is also consensus that what's proposed constitutes a kangaroo court and the reason you don't want an independent HR agency to handle this (like before) is that the case will be thrown out with prejudice and the company may be held accountable for a lot more than just frivolous accusations and moral damages (twofold).

On deciding whether to suspend an employee, there are also clear legal guidelines. If there's a serious issue or situation, an employer might consider suspending someone while they investigate. But in this case, the nature of the accusations makes it abundantly frivolous. An employer should consider each situation carefully. Suspension will only be needed in some rather rare situations. This is why, right from the very beginning, the letters and demands sent were legally invalid. If an employer feels they need to suspend someone, it's important to consider alternative options to suspension and the wellbeing of the person they're thinking of suspending (unless the intention is to shock and seek reprisal). The employer should think about who will handle matters if further action is needed, but in this case it seems like one or two person control the process from beginning to end. Where possible, a different person should handle each step of the disciplinary procedures: the investigation, the disciplinary hearing and outcome, and the appeal hearing (if an appeal is raised).

It might moreover be useful to document (e.g. write in great length) and to show a clear, systematic pattern; I can prove and neatly present a pattern of evidence which points to the actions by the CEO being vindictive. It would not be unprecedented either. Expect a 50-page report quite soon. A legal team is looking into it.

The process has in general been a travesty and a potential source of disgrace to the company. In this particular case, someone acting as a judge for oneself is not looking good. In principle, recusing oneself is one option, but the process is already tarnished by irregularities that hamper any perception of objectivity and fairness.

This is not a good way to end a relationship with the company. It didn't have to end like this.

A good company values its workers, listens to workers, instead of treating them like enemies to be deceived and marginalised. Apropos, only minutes ago: https://techcrunch.com/2022/11/30/lastpass-goto-breached-customer-information/ If only someone kept warning that LastPass was trouble...



That "someone" was only ever me, raising the alarm like half a dozen times. I still have copies of messages warning against this. Or reporting the incidents spotted in LastPass (at the time LastPass was gaslighting the reporters).

Remember that LastPass wasn't just adopted to store Sirius account credentials; clients' credentials (for full access to machines) were outsourced to LastPass, likely without their knowledge. In other words, if LastPass breaches resulted in breaches of customers' systems, they might not even know it was the fault of Sirius. They might not know passwords of theirs ended up in LastPass.

Here are more recent reports (around the time I left) about the breach:



LastPass Password Vaults Stolen By Hackers—Change Your Master Password Now - Forbes

The denials from LastPass were basically lies. It doesn't matter how many facts one presents to Sirius management, it'll still never admit mistakes and move to something safe, self-hosted, and "Open Source" (like the company's name). Passwords used to be stored in a wiki (Foswiki) behind a VPN and it was initially self-hosted. Better solutions exist now, e.g. Bitwarden. As this weeks-only coverage from "It's FOSS" put it, "Bitwarden gets better every day, making things more convenient."

"It's not about a lack of features; it's about a lack of real leadership in Sirius."Sirius could use Bitwarden or many other things.

It's not about a lack of features; it's about a lack of real leadership in Sirius. Bitwarden has a lot of good features. To quote the above: "Bitwarden is easily the most popular open-source password manager right now. It is simple to use, cost-effective, conveniently available on mobile/desktop, and secure enough for most common use cases. While it already supported passwordless authentication techniques like fingerprint sign-in, Face ID, PIN, on mobile/desktop, it now has a new addition."

Sirius also rejected FOSS for communications, despite several members of staff pushing for FOSS and volunteering to install FOSS. Lip service isn't enough.

To quote the CEO would be worthless (no point pasting E-mail) because he responded with no substance, only a link that parrots lies from LastPass itself.

Hackers stole encrypted LastPass password vaults, and we’re just now hearing about it - The Verge

In spite of this apathy, the subject was again mentioned in handovers and various other means, not just E-mails, only to be dismissed or ignored. If clients lost or lose (or will lose) control of their systems, Sirius is likely to blame. Some crackers out there probably have a list of all the passwords of all the important machines of clients, sometimes even private keys!

This is what happens when companies implement "Mickey Mouse" security and clients trust such "Mickey Mouse" companies to manage their critical systems.

Sirius is of course still not interested in facts or actual news. Expect Sirius management to dismiss the latest revelations as not important and resort to defamatory ad hominem against the messengers, i.e. the usual.

"Some time next month we'll cover "Communication Tools" at Sirius and how much further the privacy/security failure goes."It's worth noting that, from a purely legal point of view, we didn't even inform the clients about: 1) the breach; 2) the passwords being there, possibly without their knowledge or consent.

The issues go far further than password management, but LastPass is what's in the news right now. It's worth adding that Sirius uses LastPass in ways it ought not be used, e.g. if they are setting up a new client in OTRS they send the password to LastPass (via LastPass to client). "Mickey Mouse" all over this thing!

Some time next month we'll cover "Communication Tools" at Sirius and how much further the privacy/security failure goes.

Screenshot credits: LastPass Password Vaults Stolen By Hackers—Change Your Master Password Now - Forbes, LastPass users: Your info and password vault data are now in hackers’ hands - Ars Technica, Hackers stole encrypted LastPass password vaults, and we’re just now hearing about it - The Verge

Recent Techrights' Posts

Not Just Slow News But Also Late News (Julian Assange Landing in Thailand)
Why did AP take so long (nearly a week) to release these?
[Meme] Smart Alec Poettering
How many Microsofters can the Debian Project withstand?
Getting Rid of Microsoft Does Not Go Far Enough
Microsoft already has many problems. One day Microsoft won't exist anymore. But that does not guarantee users' freedom.
Alyssa Rosenzweig's LibrePlanet Talk About Freeing the Apple GPU
Alyssa Rosenzweig is the graphics witch behind the reverse-engineered drivers for the Apple GPU. She previously led Panfrost, the free drivers for Arm Mali GPUs powering devices like the Pinebook Pro. She graduated in 2023 with a Computer Science degree from the University of Toronto and now writes free software full-time.
Links 30/06/2024: LLMs Under Fire and Dictatorship of the Old
Links for the day
[Meme] Walking Outside the Guardrails of the Walled Gardens Built by Monopolies
So-called "advertiser-unfriendly" material was never a problem for Wikileaks
This War Crime Footage, Nothing Political Per Se, Is What They Made Julian Assange Plead Guilty To (War Criminals Not Convicted, Only Those Who Expose Them)
Wikileaks' Julian Assange: Exposing the US Military Crimes
20 Years Passed, Let's Go Even Faster Now
We are hoping to bring more original stories
 
In the First 6 Months of 2024 Thailand Moved to GNU/Linux, Not to Windows Vista 11
maybe users moved from Vista 10 and 11 to GNU/Linux, seeing where Microsoft was heading with forced hardware "upgrades"
Eko K. A. Owen, New Outreach and Communications Coordinator for the FSF
Nice to see many new additions to the FSF's team
Microsoft Has Slaves and Enablers, Not Partners
Obligatory meme too
Windows in Åland Islands: From 100% to Less Than Half
Åland Islands lost the sense of urgency to move to GNU/Linux
Tobias Platen Covered Freedom-To-Play Games in LibrePlanet 2024
Freedom-To-Play games using Taler
[Meme] Opening a 'Webapp' With 'Only' 4 GB of RAM
Until 2020 none of my PCs ever had more than 2 GB of RAM
Destination 'Five Percent'
We reckon GNU/Linux can break the 5% barrier some time by the end of this year, even without counting Chromebooks
A Crisis of Online Journalism
Almost a week ago a journalist was forced to plead guilty for an act of journalism
Germany One of Many Countries Where Microsoft's Bing Lost Market Share After All That LLM Nonsense (Bing Chat and Further Rebrands/Renames)
openai.com traffic plunged 60% last month
Microsoft’s Latest Antitrust Scrutiny
4 new stories
Microsoft Layoffs, Mass Plagiarism, and More
outrage included
GNU/Linux Climbed 0.25% This Month (in statCounter)
Around midday on Tuesday we'll start seeing preliminary data for July
Ilya Gulko Introduces Pollyanna
"Pollyanna is a web framework that makes it easy to create your own libre social space, such as a social network or blog."
'FSFE': Underage Labour, GAFAM Fronting, and Identity Theft to Undermine the FSF's Current Fundraiser
looking to raise funds at the same time as the FSF
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Saturday, June 29, 2024
IRC logs for Saturday, June 29, 2024
Links 29/06/2024: Astronauts at Risk, Ukraine Updates
Links for the day
Fedora and Red Hat Leftovers
mostly redhat.com
Microsoft is Now Googlebombing or Spamming 'Open Source' and 'Linux' to Promote Proprietary Surveillance, Azure
Notice the title and the image, what's being promoted etc.
Seychelles: GNU/Linux Doing OK
Seychelles cannot be considered poor
Gemini Protocol Isn't Even Remotely "Dead"
"Lupa knows of 505,000 (half a million!) working Gemini URLs at present, up from about 425,000 this time last year"
About 10 New Free Software Foundation (FSF) Members Per Day
The total changed from 46 to 47 while typing the article
Vista 11 Adoption Unusually Low in Germany and It's Going Down, Not Up
This is not happening only in Germany
Kevin Korte on Computers Being Allowed to Make Decisions Based on Cryptic Algorithms and Proprietary/Secret Data
It uses buzzwords where none are needed
[Meme] Garbage In, Garbage Out (linuxsecurity.com)
It is neither Linux nor security, just chatbot-generated slop
Microsoft-Invaded CISA Spreads Anti-Free Software FUD (as If Proprietary Software Has No Memory Safety Issues), Brittany Day Uses Chatbots to Amplify and Permutate the Microsoft FUD
linuxsecurity.com became an anti-Linux spam site
Microsoft Laying Off Staff in an Act of Retaliation and Union-Busting
retaliatory layoffs at Microsoft
Gemini Links 29/06/2024: Content Drowning in 'Goo' and LLM Slop
Links for the day
Windows Lost Almost 92% Market Share in Egypt
From over 99% to just over 7%
In Ecuador, GNU/Linux Adoption Surged From Under 1% to Over 4% in About 3 Years
Not even counting Chromebooks
LibrePlanet: Cultivating Backups (of Recordings)
an appeal to recover some of these talks
Microsoft/Windows Machines Are Turned Off (or Windows Deleted/Decommissioned) in Web Servers, as the "Market Share" Collapse Continues
Taking full history into account, this is a decrease of over 90% in some cases
Corwin Brust Hosting Freedom: A Behind-the-scenes Tour With the GNU Savannah Hackers
"the "smiling faces" behind it."
Android at 90% or More in Chad
Windows below 2%
David Wilson: Cultivating a Welcoming Free Software Community That Lasts
"a feeling of shared ownership for all users."
Julian Assange Might Continue Wikileaks, But Certainly Not Yet (Recovery Time Needed)
And probably at a symbolic capacity only
Bringing in 12 Santas and Taking 13 Out (Old Interview With Julian Assange)
Julian Assange's life inside the Ecuadorian embassy
Neil Plotnick on GNU/Linux in the High School Classroom
uploaded to the LibrePlanet instance of MediaGoblin
Asia Appears to be Fastest to Adopt GNU/Linux
the home of a considerable majority of the world's population
Alexandre Oliva's LibrePlanet 2024 Talk About "Software Enshittification"
in spite of technical difficulties encountered while recording
What They Used to Do With Mono They Now Do With Systemd (Lower and Deeper Down Than Userspace)
Now we have a project started primarily by Red Hat (and managed by Microsoft GitHub, which is proprietary) being managed by Microsoft and primarily serving Microsoft and IBM
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Friday, June 28, 2024
IRC logs for Friday, June 28, 2024
Links 28/06/2024: Kangaroo Courts and Patents Spam, EFF Still Fighting for CPC's TikTok (a Digital Weapon)
Links for the day
Links 28/06/2024: Overton window and Polarization
Links for the day
[Meme] In 50 Years...
Microsoft's Vista 11 will take 50 years to be fully adopted
Only About 1 in 8 Russian Windows Users is Using Vista 11
it looks like over the past 12 months Vista 11 hardly grew and it remains very low at around 12% of Windows usage in Russia
Links 28/06/2024: More Attacks on the Press, More Censorship in Russia
Links for the day
Gemini Links 28/06/2024: Christmas Prematurely, Self-hosting
Links for the day
IBM: So Long, Suckers. Your Free OS is Now Proprietary. Pay IBM or Else.
almost exactly a year after turning RHEL into proprietary software
Vista 11 is Doomed and Despite Lack of Adoption Microsoft Already Speaks of Vapourware ("12")
"Microsoft has pulled a Windows 11 update after users reported boot loops and startup failures."
ChromeOS Reaches Highest Share in Years at the World's Most Populous Nation, Windows Now at All-Time Low of 13%
We're talking about India today
[Video] "It Is Incredible That Julian Assange Survives"
There was a positive and mutual relationship between Wikileaks and Dr Jill Stein
Never Assume That Because the Law Exists the Powerful Will Follow the Law
Who's going to hold them accountable now?
Nearly a Month Has Passed and Nobody at the Debian Project Even Attempted to Explain What Seems Like Back-dooring of Debian (and Hundreds of Distros That Are Debian-Derived)
I can cynically guess that only matters when a user with a Chinese name does it
[Video] Julian Assange Explains Wikileaks' Logistics
predating indefinite detention
IBM Was Never the "Good Guy", Just a Self-Serving and Opportunistic Money- and Power-Hungry Monopolist, Living Off of Taxpayers' Money (Government Contracts)
The Nazi Party of Germany was its second-biggest client at one point and now it's looking to profit from the work of slaves
"I Hated Working at IBM. They Were the Most Unfriendly People."
Don't forget what Watson the son did to a poor woman on a plane
State of the News (and Depletion of Journalism Online, Not Just Offline)
Newspapers are not coming back and the Web is not coming back either
GNU/Linux Consolidates in North America
Android rising a lot this year, too
[Meme] More Monopolies Granted While Patent Examiners Die (Overworking for Less Compensation)
Work more; Get less
Staff Union of the EPO (SUEPO) is Taking the New Pension Scheme (NPS) to an International Tribunal (ILOAT)
SUEPO wants more EPO staff to participate in collective action
Stella Assange and the Legal Team Speak to the Media a Day After WikiLeaks Founder Julian Assange Arrives in Australia
Published yesterday by a number of mainstream publishers
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Thursday, June 27, 2024
IRC logs for Thursday, June 27, 2024
RIP Daniel Bristot de Oliveira, Red Hat death
Reprinted with permission from Daniel Pocock