A sample size of three of the most popular and widely used password managers (Bitwarden, LastPass and DashLane) finds that they share similar vulnerabilities, and that some of these are likely not things that can be fully addressed given the nature of how cloud-based vaults protect secrets.
A new report from WithSecure documents a recent rash of ransomware attacks, spanning at least eight months, initiated by a fake version of the KeePass password manager that was spread through Microsoft ads.
Security exploit on the password manager allows anyone with privileged access to the system and any kind of memory dumps to locate strings that each contain one unprotected plaintext character from the master password.
The immediate danger to LastPass users from this security breach is, fortunately, minimal. The password manager stores each user’s master password on their own local device, preventing a server compromise from exposing it.