The developers behind popular password manager LastPass have patched a loophole that exposed your last used password. Originally discovered in August by Tavis Ormandy, a researcher from Google’s Project Zero, the security flaw allowed malicious websites to trick the browser extension into giving away credentials you entered on a previous site.
LastPass says it rolled out an update for the browser add-on on September 13th, two weeks after the vulnerability was first reported by Ormandy.
In order to exploit the bug — which possibly only existed on Google Chrome and Opera — attackers simply had to create a fraudulent link masquerading as a URL from websites someone would trust, such as Google Translate. Once the person clicked the link, the hack required no user interaction and immediately executed an automated script which extracted your last used password.
“We quickly worked to develop a fix and verified the solution was comprehensive with Tavis. We have now resolved this bug; no user action is required and your LastPass browser extension will update automatically,” the company added in a blog post.
While the circumstances for the bug’s misuse are limited, these activities are common on the internet and even if they affected a fraction of LastPass’ user base, it would have cost thousands of users their sensitive data.
The fix should be applied to your browser automatically. However, it’s best to double-check by manually updating the LastPass extension.
How to manually update the LastPass password manager
To manually updated LastPass, click the three-dots at the top right corner of Google Chrome and go to More Tools > Extensions. Scroll down until you find LastPass. Click the Details button on LastPass’ card and then hit the Update button at the top.
On Opera, you can’t force updates and your only option is to reinstall the extension.
Even though you’d expect password managers to be built on the most secured frameworks, security vulnerabilities such as this one can happen. A similar security vulnerability on LastPass’ browser extension previously enabled malicious attackers to steal users’ passwords. Therefore as an added security measure, we recommend switching on two-factor authentication for your accounts.
