How are people feeling about the Security Incident? Do you feel comfortable to be using LogMeIn? Have you turned off LogMeIn until you have more information?

Agreed, but probably because they don't know enough. My problem is there is a lack of direction on what would be best for us users. I have removed all my computers from LogMeIn until I know more.

The problem is you admit to not knowing enough so I would be relying on a hunch that is was safe. There are no precautionary steps suggested either. Should all users change network passwords? If user's store credentials are those stored locally in their client or are they stored in your cloud? Should all users change LogMeIn passwords for precautionary reasons.LogMeIn Control Panel keeps a network connection open to those cloud based servers that might be compromised, so that is a security issue at my end that until I know more information I don't agree that your service is fully functional.

For anyone who hasn't seen it yet, I just received the following in an email from GoTo. I haven't totally digested it yet, but it sounds like password changes are being forced (which is most likely a good thing). Dear Customer, I am writing to update you on our ongoing investigation about the security incident we told you about in November 2022. Our investigation to date has determined that a threat actor exfiltrated encrypted backups related to Central and Pro from a third-party cloud storage facility. In addition, we have evidence that a threat actor also exfiltrated an encryption key for a portion of the encrypted data. However, as part of our security protocols, we salt and hash Central and Pro account passwords. This provides an additional layer of security within the encrypted backups. Recommended Actions Out of an abundance of caution, we are resetting your Central or Pro password. If you use Multi-Factor Authentication to sign into your account, you may be prompted to update your Multi-Factor Authentication settings during this process. As an additional step to protect you, your account will automatically be migrated to GoTo’s enhanced Identity Management Platform as part of your password reset. This platform provides additional security for your users with more robust authentication and login-based security options, including enhanced controls, stronger password requirements, and a Single Sign-On option to access multiple GoTo (formerly LogMeIn) products. Note: all users who have reset their password since December 12 have already migrated to the new platform and do not need to take this action. Additional guidance can be found here for Central and Pro. What information was affected The information in the affected backups include your Central and Pro account usernames and salted and hashed passwords. It also includes your deployment and provisioning information, One-To-Many scripts (Central only), some Multi-Factor Authentication information, licensing and purchasing data such as user emails, phone numbers, billing addresses, and the last four digits of credit card numbers (we do not store full credit card or bank details). Based on our investigation to date, we continue to believe that the threat actor did not have access to GoTo’s production systems. Furthermore, Central and Pro's peer-to-peer technology and end-to-end encryption provide security against interception and eavesdropping of data transferred during remote sessions. Your session data in transit is always protected by Transport Layer Security (TLS) 1.2. While the investigation is ongoing, we wanted to provide this important update to you, and recommend clear and actionable steps in response to what we have learned. We are committed to protecting you, your information, and the security of our products and will continue to update you. If you have any additional questions, please contact customer support. Paddy Srinivasan CEO, GoTo (formerly LogMeIn) (Minor edit made to include the resource links in the original email. Please note if you did not receive the email no action is required - GlennD)

We have locked down all of our accounts, which has caused a fair amount of issues within our workflow.Is there any official response that GoToMyPC was NOT affected? Not a "we don't see anything as of yet".

Agreed. It's like with flight delays - even if there is no news you should keep telling people that there is no news, so they know you are engaged and working on their behalf. Silence makes people fear the worst.

11/30/22 Security Incident

29 Replies

JoJoKopp
Active Contributor
3 years ago
What are you finding regarding the other products? Do any work similar to LogMeIn. I have a user who has 6 screens in the office and only one screen at home, so using RDP is not really helpful in his scenario. He is used to LogMeIn and just moving from screen to screen and struggles with just pulling up the app he wants on his single screen at home.
JoJoKopp
Active Contributor
3 years ago
GlennD - I understand that your hands our tied and you are still researching, but until you can say that LogMeIn is secure, then I think the fully functional is not useful at all. To have an open port to LogMeIn without knowing that the software cloud I am connected to is completely secure is not something that I can do. When you can say that it is secure and the reasoning behind it being secure, like you rebuilt a server or moved it to another cloud or whatever someone has to do to take a breached server and make it secure again, I can't use it's functionality. So, a better answer to me is that we continue to research and I understand your frustrations.
cvillard1
Active Contributor
3 years ago
Just passing this along to others and to GoTo. This is why users are concerned and GoTo should make some sort of update.

https://techcrunch.com/2022/12/14/parsing-lastpass-august-data-breach-notice/
GlennD
GoTo Manager
3 years ago
Hi cvillard1 and JoJoKopp

I completely understand your concern and frustration, unfortunately, we do not have more details that can be shared currently. All of our services are fully functional and we have not identified any additional actions required for customers.

Our investigation is ongoing and as soon as new information is available to be shared I will update you here in the community.
cvillard1
Active Contributor
3 years ago
Well I ended up speaking with a manager and, to be fair, their hands are tied by higher ups no doubt. This is a tricky situation and said they would pass along my feedback. I get that they can only provide what they have the ability to provide.

Don't get me wrong though, I am getting quotes from other services like TeamViewer/SplashTop/etc because I have a business I need to keep running and the longer no info is available stating the services are indeed safe, the more confidence degrades.
JoJoKopp
Active Contributor
3 years ago
So customer care doesn't really care about their customers. Maybe they should change their name.
cvillard1
Active Contributor
3 years ago
So they could not really offer much in the way of any news or anything different than what was posted in the article. I had requested a letter stating that the services were safe to use on company letter head but they were not able to provide that to me. Unfortunately when I talked to them about cancelling services and going with someone else, they said they were not offering refunds at this time.
JoJoKopp
Active Contributor
3 years ago
What did customer care say when you called them? I haven't called yet because I was too busy implementing a company VPN so I could get everyone working from home again. It has been a crazy few weeks. Are they going to refund any money since we can use their services?
cvillard1
Active Contributor
3 years ago
Yes, this is an excellent point and example!
timmo08
Active Contributor
3 years ago
Agreed. It's like with flight delays - even if there is no news you should keep telling people that there is no news, so they know you are engaged and working on their behalf. Silence makes people fear the worst.

Forum Discussion

11/30/22 Security Incident

29 Replies

Recent Discussions

LogMeIn Intune deployment prompting users for login on certain devices

macOS Sequoia 15.2 - LMI Run at Boot?

One2Many failures

Is LogMeIn FIPS-2 compliant?

Pre-Host Connection 2FA for Technicans