digitalkey
Security

LastPass is scrambling to fix another serious vulnerability

For the second time in two weeks developers of the popular LastPass password manager are working to fix a serious vulnerability that could allow malicious websites to steal user passwords or infect computers with malware.

Like the LastPass flaws patched last week, the new issue was discovered and reported to LastPass by Tavis Ormandy, a researcher with Google's Project Zero team. The researcher revealed the vulnerability's existence in a message on Twitter, but didn't publish any technical details about it that could allow attackers to exploit it.

According to Ormandy, the flaw affects the latest version of the LastPass browser extension for all major browsers. He claims to have tested the exploit successfully on Windows and Linux, but believes that it likely works on Mac as well.

If the extension's binary component is also installed, the vulnerability allows attackers to execute malicious code on users' computers when they visit a rogue website. If the component is not present, the flaw can still be used to extract passwords from users' secure password vaults.

To make things worse, it seems the extension's presence in the browser is enough for the flaw to be exploitable. Ormandy said on Twitter that the attack still works even if the user is logged out.

This is supposedly true only for the remote code execution attack, because without a logged-in session the password vault would remain encrypted and not accessible to a website.

"We are now actively addressing the vulnerability," the LastPass developers said Monday in a blog post. "This attack is unique and highly sophisticated. We don’t want to disclose anything specific about the vulnerability or our fix that could reveal anything to less sophisticated but nefarious parties."

LastPass recommends that users launch websites for which they have stored passwords directly from inside their password vaults by using the "launch" feature. The company also advises users to turn on two-factor authentication for any online services that offer this option and to beware of phishing attacks and potentially malicious links.

Ormandy believes that it will take the company a long time to fix this vulnerability because it is "a major architectural problem." The standard vulnerability disclosure deadline enforced by Google Project Zero is 90 days.

IDG Insider

PREVIOUS ARTICLE

« V-Moda gives you a choice: Use its new Crossfade 2 headphones with or without wires

NEXT ARTICLE

Malware infection rate of smartphones is soaring - Android devices often the target »
author_image
IDG News Service

The IDG News Service is the world's leading daily source of global IT news, commentary and editorial resources. The News Service distributes content to IDG's more than 300 IT publications in more than 60 countries.

  • Mail

Recommended for You

International Women's Day: We've come a long way, but there's still an awfully long way to go

Charlotte Trueman takes a diverse look at today’s tech landscape.

Trump's trade war and the FANG bubble: Good news for Latin America?

Lewis Page gets down to business across global tech

20 Red-Hot, Pre-IPO companies to watch in 2019 B2B tech - Part 1

Martin Veitch's inside track on today’s tech trends

Poll

Do you think your smartphone is making you a workaholic?