The vulnerability in question is CVE-2020-5741 (CVSS score: 7.2), a deserialization flaw impacting Plex Media Server on Windows that allows a remote, authenticated attacker to execute arbitrary Python code in the context of the current operating system user. LastPass breaches cast doubt on password manager safety. This, in turn, is said to have been made possible by exploiting a nearly three-year-old now-patched flaw in Plex to achieve code execution on the engineer's computer, the streaming media service told The Hacker News in a statement. The second attack specifically singled out one of the four DevOps engineers, targeting their home computer with a keylogger malware to obtain the credentials and breach the cloud storage environment. Security reporting in the admin console will. Remember that length wins over complexity, LastPass said. The longer the master password the better, particularly when all available character sets are used. The intrusion ultimately enabled the adversary to steal partially encrypted password vault data and customer information. Usernames and master passwords, which create a unique encryption key, should be at least 12 characters long, according to LastPass. 4 It also includes support for bookmarklets. 3 The standard version of LastPass comes with a web interface, but also includes plugins for various web browsers and apps for many smartphones. The embattled password management service last week revealed how unidentified actors leveraged information stolen from an earlier incident that took place prior to August 12, 2022, along with details "available from a third-party data breach and a vulnerability in a third-party media software package to launch a coordinated second attack" between August and October 2022. LastPass is a password manager distributed in subscription form as well as a freemium model with limited functionality.
#Lastpass security breach 2023 update
The massive breach at LastPass was the result of one of its engineers failing to update Plex on their home computer, in what's a sobering reminder of the dangers of failing to keep software up-to-date.
0 kommentar(er)
