lastpass vulnerable 为什么_vulnerable是什么意思_lastpass apk(2)

The fake login page requests the user entering his master password and the 2-factor authentication code, if the victim has enabled it.

When the victim submits the information requested they are sent to a web server controlled by the attacker.

The attacker can use the information toaccess LastPass API and use the credentials to download and decrypt the victims password.

Cassidy explained thatLastPass, differently from other password managers likeKeePass, encourages users to keep an encrypted backup of their password vault on its servers, this choice allows users to sync with multiple devices, but also enlarge their suce of attack. An attacker that is able to access the users LastPass login credentials can get a copy of the password file.

Similar attacks against LastPass users are not a novelty, in 2015 the experts Garcia and Vigo developed a technique called Even the LastPass Will be Stolen, Deal with It!.

My work comes at LastPass from a different angle: you dont have access to a LastPass users machine. Instead, you trick the user into giving you their credentials. Cassidy explained.

The researcher reported the issue to LastPass in November, and its experts acknowledged the flaw in December.

LastPass has already released an update that mitigates this kind of phishing scheme avoiding users from being logged outand implemented a security alert to warn users when theyve entered their master password into a fake LastPass form.

本文来自电脑杂谈，转载请注明本文网址：
https://www.pc-fly.com/a/shouji/article-42642-2.html