Security News Vulnerability in 1Password for Mac lets attacker steal data from password vault

[Gandalf_The_Grey]

Content source

https://www.security.nl/posting/853207/Lek+in+1Password+for+Mac+laat+aanvaller+data+uit+wachtwoordkluis+stelen

A vulnerability in 1Password for Mac allows data to be stolen from the password manager's password vault, as well as "derived values" used to log into 1Password. 1Password has released a security update to fix the problem. To exploit the vulnerability, however, an attacker must first be able to execute malware on a Mac running 1Password.

Through the vulnerability, the malware can impersonate a trusted 1Password integration, such as the 1Password browser extension. This allows the malware to steal data from the password vault and log into 1Password accounts. The impact of the vulnerability, referred to as CVE-2024-42219, is rated 7.0 on a scale of 1 to 10. Users are advised to update to 1Password for Mac version 8.10.36. The researchers who discovered the vulnerability will give a presentation on it tomorrow at the Defcon conference in Las Vegas.

Translated from Dutch by DeepL

Lek in 1Password for Mac laat aanvaller data uit wachtwoordkluis stelen - Security.NL

www.security.nl

 

[Divine_Barakah]

"Through the vulnerability, the malware can impersonate a trusted 1Password integration, such as the 1Password browser extension." 1Password extension gets authenticated automatically, but some password managers excplicitly ask you to compare the two pins, the one displayed in the browser and the one that is displayed in the app itself. Would that approach protect against this kind of vulnerability?

 

[Jonny Quest]

"Through the vulnerability, the malware can impersonate a trusted 1Password integration, such as the 1Password browser extension." 1Password extension gets authenticated automatically, but some password managers excplicitly ask you to compare the two pins, the one displayed in the browser and the one that is displayed in the app itself. Would that approach protect against this kind of vulnerability?

What password mangers ask for the pin confirmation. Just curious, being a 1Password PC user.

 

[Divine_Barakah]

What password mangers ask for the pin confirmation. Just curious, being a 1Password PC user.

When you install Enpass browser extension and click on it, it asks you to enter the displayed pin to authenticate the extension.

 

[Divine_Barakah]

When you install Enpass browser extension and click on it, it asks you to enter the displayed pin to authenticate the extension.

Remembear did the same, but the product got discontinued.

Sticky Password does it automatically as 1Password.