Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Identity & Access

LastPass Rushes to Patch Flaw That Exposed User Passwords

It took the developers of the popular password manager LastPass just a few hours to patch a critical vulnerability that could have been exploited to hack the application and gain access to users’ passwords.

It took the developers of the popular password manager LastPass just a few hours to patch a critical vulnerability that could have been exploited to hack the application and gain access to users’ passwords.

The flaw, discovered by Google Project Zero researcher Tavis Ormandy, affected the LastPass add-on for Firefox. The expert noticed that a design flaw allowed a piece of JavaScript to click on the LastPass icon and interact with the application without the user’s knowledge.

According to Ormandy, an attacker could have exploited the vulnerability to completely compromise the add-on by tricking the victim into accessing a specially crafted website. The weakness could have allowed hackers to delete files, execute scripts, steal all passwords, and log into the targeted account in order to steal newly saved passwords.

LastPass released a patch for the vulnerability within hours after the Google researcher sent his report. The company noted that the flaw only affects the Firefox add-on. The fix has been pushed to users of LastPass 4.0 and later in version 4.1.21a.

In addition to Ormandy, security researcher Mathias Karlsson of Detectify disclosed on Wednesday a serious vulnerability that he reported to LastPass more than one year ago.

Karlsson found a flaw in the autofill functionality that allowed him to extract passwords for all commonly used websites simply by getting the victim to access a malicious site. The expert said LastPass patched the vulnerability within a day and awarded him a $1,000 bug bounty.

Last year, researchers Alberto Garcia Illera and Martin Vigo disclosed several flaws, bad practices and design issues that exposed the passwords of LastPass users to various types of attacks. The company also reported suffering a data breach last year, but said the attackers likely did not access any user accounts.

Ormandy has analyzed several security products over the past period and now he seems to have turned his attention to password managers. The expert has promised to analyze 1Password next.

Advertisement. Scroll to continue reading.

This is not the first time the Google researcher has analyzed password managers. Earlier this year, he disclosed some serious vulnerabilities in a password manager shipped with various Trend Micro products.

Related: LastPass Notifies Users of OTP, Bookmarklet Vulnerabilities

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

Expert Insights

Related Content

Identity & Access

Zero trust is not a replacement for identity and access management (IAM), but is the extension of IAM principles from people to everyone and...

CISO Strategy

Okta is blaming the recent hack of its support system on an employee who logged into a personal Google account on a company-managed laptop.

Compliance

Government agencies in the United States have made progress in the implementation of the DMARC standard in response to a Department of Homeland Security...

Email Security

Many Fortune 500, FTSE 100 and ASX 100 companies have failed to properly implement the DMARC standard, exposing their customers and partners to phishing...

Funding/M&A

The private equity firm merges the newly acquired ForgeRock with Ping Identity, combining two of the biggest names in enterprise IAM market.

Application Security

Virtualization technology giant VMware on Tuesday shipped urgent updates to fix a trio of security problems in multiple software products, including a virtual machine...

Identity & Access

Hackers rarely hack in anymore. They log in using stolen, weak, default, or otherwise compromised credentials. That’s why it’s so critical to break the...

Application Security

Fortinet on Monday issued an emergency patch to cover a severe vulnerability in its FortiOS SSL-VPN product, warning that hackers have already exploited the...