Updated Incident Report for LastPass vulnerability

[frogboy]

Incident Report: March 31, 2017 (8:10 PM)

On Saturday, March 25th, security researcher Tavis Ormandy from Google’s Project Zero reported a security finding related to the LastPass browser extensions. In the last 24 hours, we’ve released an update which we believe fixes the reported vulnerability in all browsers and have verified this with Tavis himself.

Most users will be updated automatically. Please ensure you are running the latest version (4.1.44 or higher), which can always be downloaded at LastPass | Password Manager, Auto Form Filler, Random Password Generator & Secure Digital Wallet App.

Now that the issue is resolved, we want to provide a postmortem to our community on what the report entailed and how we are building a better, more secure LastPass going forward. Please note, due to the nature of the vulnerability, this postmortem is highly technical.

Overview

• This was a client-side vulnerability in the LastPass browser extensions and could be exploited to steal data and manipulate the LastPass extension
• Exploiting required luring a user to a malicious website (through phishing, spearphishing, or other attack), or to a trusted website running malicious adware
  • This requires a per-user attack that must be executed through the user’s local browser
• All extensions have now been updated with the fix and submitted to the extension stores
  • Our mobile apps for Android and iOS were not affected.
  Read More. Security Update for the LastPass Extension | The LastPass Blog
  
  

 

[Solarlynx]

Thanks.

Just checked - mine LP Chrome extension is 4.1.45.

 

[frogboy]

I got 4.1.44a on Cyberfox but it did not update automatically i had to remove LastPas and reinstall it.

 

[LASER_oneXM]

thanks for this info ! ....updated my main machine few minutes ago: for me its extremly important to update this kind of
software/tools as soon/fast as possible !

 

[HarryNguyen0330]

I got 4.1.44a on Cyberfox but it did not update automatically i had to remove LastPas and reinstall it.

And your Cyberfox will be outdated soon, so switch back to Firefox or looking for other popular variants like Waterfox would be better for both security and stability.

 

[frogboy]

And your Cyberfox will be outdated soon, so switch back to Firefox or looking for other popular variants like Waterfox would be better for both security and stability.

I have giving Waterfox a trial in the last few weeks already. But i will continue to use Cyberfox until it is discontinued.

 

[Axelrod Sven]

Geh... another vulnerability... will update LastPass immediately. Thanks for the update!