Lastpass security breach 201911/10/2023 According to the researchers, these companies don’t always encrypt and clear passwords from the computer’s memory when the user logs out. The vulnerability in question is CVE-2020-5741 (CVSS score: 7.2), a deserialization flaw impacting Plex Media Server on Windows that allows a remote, authenticated attacker to execute arbitrary Python code in the context of the current operating system user. Dashlane, LastPass, and KeePass: Research carried out by Independent Security Evaluators (ISE) uncovered that while running in the background, these password managers could leak unencrypted credentials. This, in turn, is said to have been made possible by exploiting a nearly three-year-old now-patched flaw in Plex to achieve code execution on the engineer's computer, the streaming media service told The Hacker News in a statement. The second attack specifically singled out one of the four DevOps engineers, targeting their home computer with a keylogger malware to obtain the credentials and breach the cloud storage environment. The intrusion ultimately enabled the adversary to steal partially encrypted password vault data and customer information. The embattled password management service last week revealed how unidentified actors leveraged information stolen from an earlier incident that took place prior to August 12, 2022, along with details "available from a third-party data breach and a vulnerability in a third-party media software package to launch a coordinated second attack" between August and October 2022. The massive breach at LastPass was the result of one of its engineers failing to update Plex on their home computer, in what's a sobering reminder of the dangers of failing to keep software up-to-date.
0 Comments
Leave a Reply.AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |