July 24, 2024
Ugh! Norton LifeLock password supervisor accounts accessed by hackers • Graham Cluley

What’s occurred?

For those who use Norton lifeLock as your password supervisor, your account might have been compromised.

Woah. What???

In keeping with Bleeping Computer, Gen, the corporate behind Norton LifeLock (and different manufacturers together with Avast, Avira, AVG, ReputationDefender, and CCleaner), is sending information breach notifications to a few of its prospects warning that their accounts have been accessed following a credential-stuffing assault.

So Norton LifeLock obtained hacked?

I’d argue that’s an unfair method to describe what’s occurred.

Norton LifeLock didn’t screw up something like as badly as fellow password supervisor LastPass did in its latest horrendous hack.

Actually, within the notification being despatched to affected Norton LifeLock prospects, the corporate says:

Our personal programs weren’t compromised. Nevertheless, we strongly consider that an unauthorized third social gathering is aware of and has utilized your username and password to your account.

However how did a hacker discover out the username and password to so many individuals’s LifeLock accounts?

Credential-stuffing assaults benefit from the truth that many individuals nonetheless make the error of reusing the identical passwords in other places on the web.

If one service will get breached and its password database stolen, hackers can fling these credentials at different on-line accounts – to see if they may unlock one thing fascinating elsewhere.

When did this assault occur?

The corporate says that the unauthorised entry to buyer accounts started on December 1 2022, however issues heated up significantly on December 12 when a “massive quantity” of failed account logins occurred.

What did the hackers entry in Norton LifeLock accounts?

The information breach notification says that customers’ names, cellphone numbers, and mailing addresses have been accessed, however TechCrunch reports that the corporate “can not rule out that the intruders additionally accessed prospects’ saved passwords.”

Gulp!

What may be carried out to cease this type of assault?

Effectively, the very first thing is to STOP REUSING PASSWORDS (Sorry for shouting, however I’ve been saying this for years…)

The opposite factor you are able to do is allow two-factor authentication (2FA) in your accounts, which provides a further layer of safety even when your password falls into the fallacious palms.

EmailSignal as much as our e-newsletter
Safety information, recommendation, and suggestions.

Norton gives three flavours of 2FA to its account holders – cellular authentication app, safety key, or cell phone quantity. Both of the primary two 2FA strategies are a greater choice than cell phone quantity, however frankly any 2FA is healthier than no 2FA in any respect.

Which brings me to the following level. Why doesn’t Norton LifeLock insist upon customers enabling two-factor authentication for their very own safety?

It definitely seems like it might make life tougher for hackers…

Proper. 2FA isn’t 100% bulletproof, but it surely does pressure criminals to place extra effort into their assaults – which can be unattractive to them, notably at scale.

So what number of accounts had been accessed by the hackers?

Bleeping Laptop stories that Gen claims to have “secured 925,000 inactive and energetic accounts that will have been focused by credential-stuffing assaults.”

Virtually one million!

Yup, it’s a big assault. The corporate says that it’s monitoring the state of affairs intently, flagging accounts with suspicious login makes an attempt, and proactively asking prospects to reset their passwords.

It’s also recommending that 2FA is enabled, however – susceptible to repeating myself – I would love to see extra corporations insist on using two-factor authentication. In the end it not solely helps to guard buyer accounts, however it may additionally cut back reputational harm to the focused service.

Which, I might argue, is especially vital in terms of a service which is meant to retailer your passwords securely.

Discovered this text fascinating? Follow Graham Cluley on Twitter or Mastodon to learn extra of the unique content material we publish.


Graham Cluley is a veteran of the anti-virus business having labored for a variety of safety corporations because the early Nineteen Nineties when he wrote the primary ever model of Dr Solomon’s Anti-Virus Toolkit for Home windows. Now an unbiased safety analyst, he often makes media appearances and is a world public speaker on the subject of pc safety, hackers, and on-line privateness.
Comply with him on Twitter at @gcluley, on Mastodon at @[email protected], or drop him an electronic mail.