If a locked submitting cupboard is stolen together with its key, can you continue to say it’s locked? GoTo thinks you may • Graham Cluley

Final week, GoTo (the mum or dad firm of LastPass, which has been the sufferer of some current horrendous safety breaches itself) introduced it had additionally been hacked.

Right here’s a part of what GoTo mentioned:

Our investigation so far has decided {that a} risk actor exfiltrated encrypted backups from a third-party cloud storage service associated to the next merchandise: Central, Professional, be part of.me, Hamachi, and RemotelyAnywhere.

Urk. That’s dangerous. Shedding backups is arguably as dangerous as shedding your password vaults. However hey, good to know the backups had been encrypted…

We even have proof {that a} risk actor exfiltrated an encryption key for a portion of the encrypted backups.

Oh. So if you mentioned the backups had been encrypted, you truly meant that they had been encrypted however they may very well be unencrypted with ease?

To say the backups had been encrypted is a bit like attempting to argue {that a} locked field is locked, if the important thing to the locked field is stolen similtaneously the field.

The affected data, which varies by product, might embody account usernames, salted and hashed passwords, a portion of Multi-Issue Authentication (MFA) settings, in addition to some product settings and licensing data. As well as, whereas Rescue and GoToMyPC encrypted databases weren’t exfiltrated, MFA settings of a small subset of their prospects had been impacted.

GoTo has apparently been forcing password resets on affected accounts and reauthorising MFA settings “out of an abundance of warning.”

Signal as much as our e-newsletter
Safety information, recommendation, and suggestions.

Apparently the breach occurred at a third-party cloud storage service, which GoTo and the beleagured LastPass each use.

Though, little question, there can be questions as as to whether GoTo had adequately configured the safety of the cloud-based storage for its backups, there are maybe much more inquiries to ask relating to how cautious it was being with the encryption key for these backups.

Discovered this text fascinating? Comply with Graham Cluley on Twitter or Mastodon to learn extra of the unique content material we put up.