LastPass is scrambling to fix another serious vulnerability
Security

LastPass is scrambling to fix another serious vulnerability

For the second time in two weeks developers of the popular LastPass password manager are working to fix a serious vulnerability that could allow malicious websites to steal user passwords or infect computers with malware.

Like the LastPass flaws patched last week, the new issue was discovered and reported to LastPass by Tavis Ormandy, a researcher with Google's Project Zero team. The researcher revealed the vulnerability's existence in a message on Twitter, but didn't publish any technical details about it that could allow attackers to exploit it.

According to Ormandy, the flaw affects the latest version of the LastPass browser extension for all major browsers. He claims to have tested the exploit successfully on Windows and Linux, but believes that it likely works on Mac as well.

If the extension's binary component is also installed, the vulnerability allows attackers to execute malicious code on users' computers when they visit a rogue website. If the component is not present, the flaw can still be used to extract passwords from users' secure password vaults.

To make things worse, it seems the extension's presence in the browser is enough for the flaw to be exploitable. Ormandy said on Twitter that the attack still works even if the user is logged out.

This is supposedly true only for the remote code execution attack, because without a logged-in session the password vault would remain encrypted and not accessible to a website.

"We are now actively addressing the vulnerability," the LastPass developers said Monday in a blog post. "This attack is unique and highly sophisticated. We don’t want to disclose anything specific about the vulnerability or our fix that could reveal anything to less sophisticated but nefarious parties."

LastPass recommends that users launch websites for which they have stored passwords directly from inside their password vaults by using the "launch" feature. The company also advises users to turn on two-factor authentication for any online services that offer this option and to beware of phishing attacks and potentially malicious links.

Ormandy believes that it will take the company a long time to fix this vulnerability because it is "a major architectural problem." The standard vulnerability disclosure deadline enforced by Google Project Zero is 90 days.

IDG Insider

PREVIOUS ARTICLE

«V-Moda gives you a choice: Use its new Crossfade 2 headphones with or without wires

NEXT ARTICLE

Malware infection rate of smartphones is soaring – Android devices often the target»

Add Your Comment

Most Recent Comments

Our Case Studies

IDG Connect delivers full creative solutions to meet all your demand generatlon needs. These cover the full scope of options, from customized content and lead delivery through to fully integrated campaigns.

images

Our Marketing Research

Our in-house analyst and editorial team create a range of insights for the global marketing community. These look at IT buying preferences, the latest soclal media trends and other zeitgeist topics.

images

Poll

Should we donate our health data the same way we donate organs?