Month: February 2023

The Oppo Find N2 Flip pictured here might give us some clues as to what subbrand OnePlus’ foldable will look like. | Image: Jon Porter / The Verge

This year’s Mobile World Congress is shaping up to be a real fiesta for unconventional form factors, and OnePlus is the latest company to join the celebration. At a panel discussion today, the company announced its intentions to launch a foldable phone in the second half of 2023. That’s about the extent of the details we have for now, though it seems like a safe assumption that the device will look a lot like one of the existing foldables on the market from Oppo — OnePlus’ parent company.
With companies like Apple and Google yet to enter the foldable market, Oppo is now on its second round of folding phones — though they’ve mostly been limited to China. The Find N was a tablet-style foldable released in 2021 with a surprisingly refined design for a first-gen product. Oppo followed it up in late 2022 with the Find N2 and Find N2 Flip. The latter is a clamshell-style device in the vein of Samsung’s Z Flip series, and it’ll be Oppo’s first foldable available in Europe when it goes on sale in just a couple of days.

None of the above has made it to the US, naturally, but with OnePlus’ established distribution channels in North America, there’s at least some hope that its upcoming foldable will be sold here. While China and Europe have their fair share of foldables from Motorola, Honor, and Oppo, in the US, it’s basically all Samsung. Other options include Motorola’s 2020-vintage Razr 5G and the Microsoft Surface Duo 2. Pretty slim pickings.
It’s hard to say which way OnePlus will go with its forthcoming device: flipping or folding. Company president Kinder Liu offered only a vague description: that it would be a “flagship phone that doesn’t settle because of its folding form, in terms of industrial design, mechanical technology, and other aspects.” However it folds, if OnePlus’ device comes to the US, it might put some sorely needed pressure on Samsung.

The Oppo Find N2 Flip pictured here might give us some clues as to what subbrand OnePlus’ foldable will look like. | Image: Jon Porter / The Verge

This year’s Mobile World Congress is shaping up to be a real fiesta for unconventional form factors, and OnePlus is the latest company to join the celebration. At a panel discussion today, the company announced its intentions to launch a foldable phone in the second half of 2023. That’s about the extent of the details we have for now, though it seems like a safe assumption that the device will look a lot like one of the existing foldables on the market from Oppo — OnePlus’ parent company.

With companies like Apple and Google yet to enter the foldable market, Oppo is now on its second round of folding phones — though they’ve mostly been limited to China. The Find N was a tablet-style foldable released in 2021 with a surprisingly refined design for a first-gen product. Oppo followed it up in late 2022 with the Find N2 and Find N2 Flip. The latter is a clamshell-style device in the vein of Samsung’s Z Flip series, and it’ll be Oppo’s first foldable available in Europe when it goes on sale in just a couple of days.

None of the above has made it to the US, naturally, but with OnePlus’ established distribution channels in North America, there’s at least some hope that its upcoming foldable will be sold here. While China and Europe have their fair share of foldables from Motorola, Honor, and Oppo, in the US, it’s basically all Samsung. Other options include Motorola’s 2020-vintage Razr 5G and the Microsoft Surface Duo 2. Pretty slim pickings.

It’s hard to say which way OnePlus will go with its forthcoming device: flipping or folding. Company president Kinder Liu offered only a vague description: that it would be a “flagship phone that doesn’t settle because of its folding form, in terms of industrial design, mechanical technology, and other aspects.” However it folds, if OnePlus’ device comes to the US, it might put some sorely needed pressure on Samsung.

Read More 

The attacker stole credentials from a senior DevOps engineer to gain access to shared cloud storage containing the encryption keys for customer vault backups. | Illustration: Beatrice Sala

LastPass says that a threat actor was able to steal corporate and customer data by hacking an employee’s personal computer and installing keylogger malware, which let them gain access to the company’s cloud storage. The update provides more information about how the series of hacks happened last year that resulted in the popular password manager’s source code and customer vault data being stolen by an unauthorized third party.
Last August, LastPass notified its users of a “security incident” in which an unauthorized third party used a compromised developer account to access the password manager’s source code and “some proprietary LastPass technical information.” The company later disclosed a second security breach in November, announcing that hackers had accessed a third-party cloud storage service used by the password manager and were able to “gain access to certain elements” of “customers’ information.”

New details on the 2nd LastPass incident are fun: – got into Sr DevOp’s home via vuln media software- installed keylogger- got master pass to corp vault (seemingly because it was being accessed from home computer) Cool to see that LastPass is sharing https://t.co/YFoISimpYR… https://t.co/LYixQvKN9a— MG (@_MG_) February 27, 2023

On December 22nd, LastPass revealed that the hackers had used information from the first breach in August to access its systems during the second incident in November and that the attacker was able to copy a backup of partially encrypted customer vault data containing website URLs, usernames, and passwords. LastPass then advised its users to change all of their stored passwords as “an extra safety measure,” despite maintaining that the passwords were still secured by the account’s master password.
Now, LastPass has revealed the threat actor responsible for both security breaches was “actively engaged in a new series of reconnaissance, enumeration, and exfiltration activities” between August 12th and October 26th. During this time, the attacker stole valid credentials from a senior DevOps engineer to gain access to shared cloud storage containing the encryption keys for customer vault backups stored in Amazon S3 buckets. Using these stolen credentials made it difficult to distinguish between legitimate and suspicious activity.
It’s suspected the hacker accessed the private computer via Plex media software installed on the machine
Just four DevOps engineers had access to the decryption keys needed to access the cloud storage service. One of the engineers was targeted by exploiting an (undisclosed) vulnerable third-party media software package on their home computer and installing keylogger malware. Ars Technica reports that the computer was likely hacked through the Plex media platform, which similarly reported a data breach shortly after LastPass disclosed its first incident in August. Neither company has confirmed this to be the case. We have reached out to LastPass and Plex for clarification and will update this story should we hear back.
After installing the keylogger, LastPass says the threat actor “was able to capture the employee’s master password as it was entered, after the employee authenticated with [multifactor authentication], and gain access to the DevOps engineer’s LastPass corporate vault.” The company has since taken additional steps to secure its platform, including revoking certificates and rotating credentials known to the threat actor and implementing additional logging and alerting across its cloud storage.
Alongside the announcement, LastPass has published a complete list of the data that was compromised across both security breaches on a dedicated support page. BleepingComputer reports that LastPass has made efforts to conceal this information, however, noting that HTML tags had been added to the document to prevent the updates from being indexed by search engines. LastPass has additionally published a PDF containing further details regarding the incidents last year alongside two additional security bulletins — one for LastPass Free, Premium, and Families customers and another for business administrators — with recommended actions to secure your accounts.

The attacker stole credentials from a senior DevOps engineer to gain access to shared cloud storage containing the encryption keys for customer vault backups. | Illustration: Beatrice Sala

LastPass says that a threat actor was able to steal corporate and customer data by hacking an employee’s personal computer and installing keylogger malware, which let them gain access to the company’s cloud storage. The update provides more information about how the series of hacks happened last year that resulted in the popular password manager’s source code and customer vault data being stolen by an unauthorized third party.

Last August, LastPass notified its users of a “security incident” in which an unauthorized third party used a compromised developer account to access the password manager’s source code and “some proprietary LastPass technical information.” The company later disclosed a second security breach in November, announcing that hackers had accessed a third-party cloud storage service used by the password manager and were able to “gain access to certain elements” of “customers’ information.”

On December 22nd, LastPass revealed that the hackers had used information from the first breach in August to access its systems during the second incident in November and that the attacker was able to copy a backup of partially encrypted customer vault data containing website URLs, usernames, and passwords. LastPass then advised its users to change all of their stored passwords as “an extra safety measure,” despite maintaining that the passwords were still secured by the account’s master password.

Now, LastPass has revealed the threat actor responsible for both security breaches was “actively engaged in a new series of reconnaissance, enumeration, and exfiltration activities” between August 12th and October 26th. During this time, the attacker stole valid credentials from a senior DevOps engineer to gain access to shared cloud storage containing the encryption keys for customer vault backups stored in Amazon S3 buckets. Using these stolen credentials made it difficult to distinguish between legitimate and suspicious activity.

Just four DevOps engineers had access to the decryption keys needed to access the cloud storage service. One of the engineers was targeted by exploiting an (undisclosed) vulnerable third-party media software package on their home computer and installing keylogger malware. Ars Technica reports that the computer was likely hacked through the Plex media platform, which similarly reported a data breach shortly after LastPass disclosed its first incident in August. Neither company has confirmed this to be the case. We have reached out to LastPass and Plex for clarification and will update this story should we hear back.

After installing the keylogger, LastPass says the threat actor “was able to capture the employee’s master password as it was entered, after the employee authenticated with [multifactor authentication], and gain access to the DevOps engineer’s LastPass corporate vault.” The company has since taken additional steps to secure its platform, including revoking certificates and rotating credentials known to the threat actor and implementing additional logging and alerting across its cloud storage.

Alongside the announcement, LastPass has published a complete list of the data that was compromised across both security breaches on a dedicated support page. BleepingComputer reports that LastPass has made efforts to conceal this information, however, noting that HTML tags had been added to the document to prevent the updates from being indexed by search engines. LastPass has additionally published a PDF containing further details regarding the incidents last year alongside two additional security bulletins — one for LastPass Free, Premium, and Families customers and another for business administrators — with recommended actions to secure your accounts.

Read More