Exclusive: LastPass CEO Explains Possible Hack

PC World — The CEO of password management company LastPass says it's highly unlikely hackers gained access to his millions of users' data--but that he doesn't want to take any chances.

Speaking exclusively with PCWorld, LastPass CEO Joe Siegrist explained how his company came to the conclusion that its servers, which provide cross-platform password storage for millions of customers, may have been accessed by an outside party. Just one day earlier, LastPass announced via its blog that it had noticed a "network traffic anomaly" and was implementing additional security as a result.

Siegrist now says he may have been "too alarmist" in assuming the worst, but that--even if it ended up hurting his company's image--he wanted to act quickly and make sure everyone was informed. Given the proximity of the event to Sony's Playstation Network hack, after all, security was certainly high on many users' minds.

I chatted with Siegrist for about half an hour Thursday afternoon. The following is an edited version of our conversation.

[Read: LastPass, Online Password Manager, May Have Been Hacked]

PCWorld: What exactly happened that made you think something was amiss?

Siegrist: We tend to look over traffic logs and look over what's going on with the networks pretty regularly. Anytime we find any outlier, we want to know why. We try to figure out what's pulling the data and moving the bits.

This one stuck out to us as abnormal because it happened at a time we didn't think anyone was working, and it was from machines that wouldn't be transferring a lot of data between each other. Because of that, it made us a little nervous, a little antsy, so we decided to go through the worst-possible potential case, even if we couldn't find any real supporting evidence that anything bad had occurred.

PCW: What do you know right now about what kind of data could have been taken or compromised

Siegrist: With the level and the scale of the transfer, we don't think a lot of data could have been taken--but certainly enough to cover people's usernames and [encrypted] passwords. That would be enough to set up a potential attacker so they could start going through and looking for people with weak master passwords without having to hit our servers. That's really the threat that we're concerned about and why we're handling it the way we are.

We know the machines involved have the users' encrypted blob data as well as the data for their usernames, their password hashes, and the salt for those hashes. Because of that and the size of the data, we don't think more than a couple hundred blobs could have been taken.

Continue Reading