LastPass Employee Could’ve Prevented Hack With a Software Update

It turns out the large breach at LastPass could have been stopped, or at least delayed, if a company worker had up-to-date a piece of application on their property pc. 

This week, LastPass discovered the hacker pulled off the breach by installing malware on an employee’s house laptop or computer, enabling them to capture keystrokes on the machine. But one lingering concern was how the malware was delivered. 

At the time, LastPass mentioned(Opens in a new window) only that the hacker exploited “a vulnerable third-occasion media software package bundle,” without naming the seller or the specific flaw. That led quite a few to wonder if the hacker had abused a at present not known vulnerability, which could place many other customers in harm’s way. 

PCMag has since figured out the hacker targeted the Plex Media Server application to load the malware on the LastPass employee’s property computer system. But curiously, the exploited flaw was practically nothing new. According to Plex, the vulnerability is just about 3 several years previous and was patched lengthy ago.

Plex told PCMag the vulnerability is CVE-2020-5741(Opens in a new window), which the corporation publicly disclosed to buyers in May possibly 2020. “An attacker who now had admin access to a Plex Media Server could abuse the Camera Add aspect to make the server execute destructive code,” the firm mentioned back again then.

(Credit: Plex)

“At the time, as pointed out in that publish, an current version of the Plex Media Server was produced available to all (7-May possibly-2020),” a spokesperson for Plex said. “Unfortunately, the LastPass worker under no circumstances upgraded their application to activate the patch. For reference, the edition that resolved this exploit was roughly 75 versions ago.”   

LastPass declined to remark. But earlier this week, the corporation verified “the threat actor exploited a vulnerability in an before, unpatched variation of Plex Media Server on a LastPass DevOps engineer’s dwelling laptop or computer. We have reached out to Plex Media Server to tell them.”

Why the LastPass worker didn’t update their Plex Media Server is mysterious. Plex instructed PCMag that the enterprise “will offer notifications via the admin UI about updates that are available, and will also do automatic updates in lots of situations.”

“With no extra facts about all of the specifics, there is no way for us to speculate why this man or woman did not update Plex in excess of these a extended period of time of time,” the spokesperson additional.

The incident goes to clearly show the importance of holding your software up-to-day. That claimed, it is crucial to be aware the hacker previously possessed admin access to the employee’s Plex Media Server account to exploit the CVE-2020-5741 flaw. This suggests the attacker was presently preying on the LastPass staffer, and could have appear up with other means to infect their personal computer with malware. 

Nonetheless, the breach at LastPass displays the company produced an additional error by allowing for the personnel to use their dwelling laptop to obtain very delicate details. In accordance to LastPass, the hacker planted keylogging malware on the household laptop, enabling them “to capture the employee’s master password as it was entered, following the employee authenticated with MFA (multi-issue authentication), and acquire access to the DevOps engineer’s LastPass company vault.” 

The entry then paved a way for the hacker to steal a copy of customers’ encrypted password vaults, along with un-encrypted facts on users’ account information and facts, such as e mail addresses and cell phone numbers. The breach has since shattered believe in in LastPass, but the organization has been doing the job to bolster its safety in response.