Security Experts:

Connect with us

Hi, what are you looking for?


Identity & Access

LastPass Rushes to Patch Flaw That Exposed User Passwords

It took the developers of the popular password manager LastPass just a few hours to patch a critical vulnerability that could have been exploited to hack the application and gain access to users’ passwords.

It took the developers of the popular password manager LastPass just a few hours to patch a critical vulnerability that could have been exploited to hack the application and gain access to users’ passwords.

The flaw, discovered by Google Project Zero researcher Tavis Ormandy, affected the LastPass add-on for Firefox. The expert noticed that a design flaw allowed a piece of JavaScript to click on the LastPass icon and interact with the application without the user’s knowledge.

According to Ormandy, an attacker could have exploited the vulnerability to completely compromise the add-on by tricking the victim into accessing a specially crafted website. The weakness could have allowed hackers to delete files, execute scripts, steal all passwords, and log into the targeted account in order to steal newly saved passwords.

LastPass released a patch for the vulnerability within hours after the Google researcher sent his report. The company noted that the flaw only affects the Firefox add-on. The fix has been pushed to users of LastPass 4.0 and later in version 4.1.21a.

In addition to Ormandy, security researcher Mathias Karlsson of Detectify disclosed on Wednesday a serious vulnerability that he reported to LastPass more than one year ago.

Karlsson found a flaw in the autofill functionality that allowed him to extract passwords for all commonly used websites simply by getting the victim to access a malicious site. The expert said LastPass patched the vulnerability within a day and awarded him a $1,000 bug bounty.

Last year, researchers Alberto Garcia Illera and Martin Vigo disclosed several flaws, bad practices and design issues that exposed the passwords of LastPass users to various types of attacks. The company also reported suffering a data breach last year, but said the attackers likely did not access any user accounts.

Ormandy has analyzed several security products over the past period and now he seems to have turned his attention to password managers. The expert has promised to analyze 1Password next.

This is not the first time the Google researcher has analyzed password managers. Earlier this year, he disclosed some serious vulnerabilities in a password manager shipped with various Trend Micro products.

Related: LastPass Notifies Users of OTP, Bookmarklet Vulnerabilities

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.


Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.


Expert Insights

Related Content

Identity & Access

Zero trust is not a replacement for identity and access management (IAM), but is the extension of IAM principles from people to everyone and...

Identity & Access

Hackers rarely hack in anymore. They log in using stolen, weak, default, or otherwise compromised credentials. That’s why it’s so critical to break the...

Application Security

Fortinet on Monday issued an emergency patch to cover a severe vulnerability in its FortiOS SSL-VPN product, warning that hackers have already exploited the...

Application Security

Virtualization technology giant VMware on Tuesday shipped urgent updates to fix a trio of security problems in multiple software products, including a virtual machine...

Application Security

Password management firm LastPass says the hackers behind an August data breach stole a massive stash of customer data, including password vault data that...

Application Security

Microsoft on Tuesday pushed a major Windows update to address a security feature bypass already exploited in global ransomware attacks.The operating system update, released...

Application Security

Electric car maker Tesla is using the annual Pwn2Own hacker contest to incentivize security researchers to showcase complex exploit chains that can lead to...

Identity & Access

Strata Identity has raised $26 million in a Series B funding round led by Telstra Ventures, with additional investment from Forgepoint Capital, Innovating Capital,...