Σοβαρά κενά ασφαλείας εντοπίζονται στο LastPass για Chrome και Firefox

27 Mar


Σύμφωνα με το Engadget ο ερευνητής του Project Zero της Google Tavis Ormandy, που είχε εντοπίσει εμφανή προβλήματα ασφάλειας στον δημοφιλή password manager LasrPass, “ξαναχτύπησε “.

Αυτήν την φορά εντόπισε αρχικά exploit σε μια έκδοση του extension του για τον Firefox και μετά ένα νέο bug που επηρεάζει τόσο τον Chrome όσο και τον Firefox. Τα ευρήματα του όμως δεν τελειώνουν εδώ, αφού εντόπισε και τρίτη ευπάθεια που επιτρέπει την υποκλοπή passwords από οποιοδήποτε domain.

The first vulnerability has apparently not been addressed yet, which Ormandy mentions may be the result of Mozilla needing time to review the updated extension before pushing it to users. Based on his tweet, it could reveal a user’s password, but not all of the details have been revealed yet.

The second issue could be more serious, with the ability to steal a user’s passwords or, if the binary version of the extension is installed, run any code the attacker tells it to (in an example, Ormandy causes the target’s computer to open a Calculator program.) According to LastPass the issue has been resolved, although a promised follow-up blog post with more details has yet to appear.

There’s even less info available about the latest vulnerability identified, although the version number (4.1.35) matches a LastPass changelog note for its most recent Internet Explorer add-on.

Leave a comment

Posted by on 27 March, 2017 in MinOtavrS blog


Tags: , , ,

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: