LastPass Reveals Second Attack Resulting in Breach of Encrypted Password Vaults

LastPass, which in December 2022 disclosed a severe data breach that allowed threat actors to access encrypted password vaults, said it happened as a result of the same adversary launching a second attack on its systems. The company said one of its DevOps engineers had their personal home compute...

LastPass Reveals Second Attack Resulting in Breach of Encrypted Password Vaults

LastPass, which in December 2022 disclosed a severe data breach that allowed threat actors to access encrypted password vaults, said it happened as a result of the same adversary launching a second attack on its systems. The company said one of its DevOps engineers had their personal home compute...

LastPass: Hackers Stole User Data and Encrypted Password Vaults

By Deeba Ahmed It turns out that hackers stole much more than just the source code from LastPass. This is a post from HackRead.com Read the original post: LastPass: Hackers Stole User Data and Encrypted Password Vaults...

LastPass Admits to Severe Data Breach, Encrypted Password Vaults Stolen

The August 2022 security breach of LastPass may have been more severe than previously disclosed by the company. The popular password management service on Thursday revealed that malicious actors obtained a trove of personal information belonging to its customers that include their encrypted...

Price manipulation can lead to users lossing funds

Lines of code Vulnerability details H Price manipulation can lead to users lossing funds Impact Early malicious user will profit from future users' deposits while future users' will loose funds/value. Proof of Concept An early user can call the deposit function of any of the ERC4626 vaults with...

Medium: Vaults can be griefed to not be able to be used for deposits

Lines of code Vulnerability details Description Interaction with SavETHVault and StakingFundsVault require a minimum amount of MINSTAKINGAMOUNT. In order to be used for staking, there needs to be 24 ETH or 4 ETH for the desired BLS public key in those vaults. The issue is that vaults can be grief...

If noone deposit in one Vault, assets deposited to the other Vault will be locked.

Lines of code Vulnerability details Impact In each Vault epoch, idFinalTVL and idClaimTVL values is only set when someone call triggerDepeg or triggerEndEpoch from Controller. In case of depeg, we will swap assets of hedge and risk Vault. But if one Vault has noone deposited, idFinalTVL will be...

Hackers Had Access to LastPass's Development Systems for Four Days

Password management solution LastPass shared more details pertaining to the security incident last month, disclosing that the threat actor had access to its systems for a four-day period in August 2022. "There is no evidence of any threat actor activity beyond the established timeline," LastPass...

Obsidian Plugin Persistence

This module searches for Obsidian vaults for a user, and uploads a malicious community plugin to the vault. The vaults must be opened with community plugins enabled NOT restricted mode, but the plugin will be enabled automatically. Tested against Obsidian 1.7.7 on Kali, Ubuntu 22.04, and Windows...

Source code of password manager LastPass stolen by attacker

In a security incident notice from LastPass the company informed the public know that an unauthorized party gained access to portions of the LastPass development environment through a single compromised developer account. There is no evidence that this incident involved any access to customer dat...

Vaults are not locked properly

Lines of code Vulnerability details Impact Even though after Auction starts, Vault ownership moves to Witch but still Cauldron Admin can perform operations on this Vault. This includes transferring funds from a Vault which has live Auction ongoing Proof of Concept 1. Auction is started on Vault i...

Setting a high feeRate can block exercise or cause negative flow of funds

Lines of code Vulnerability details Impact When an admin intentionally or unintentionally sets a feeRate greater than 1e18 100%, The exercise function can fail with arithmetic operation underflow at line 289 In the case, when beneficiary is connected to multiple vaults, the exercise function will...

GHSA-Q9QR-H33G-FW3J TeamPass Storing Passwords in a Recoverable Format vulnerability

TeamPass version 2.1.27 and earlier contains a Storing Passwords in a Recoverable Format vulnerability in Shared password vaults that can result in all shared passwords are recoverable server side. This attack appears to be exploitable via any vulnerability that can bypass authentication or role...

ConvexYieldWrapper griefing attack is possible that removes all the vaults from any user

Handle hyh Vulnerability details Impact Griefing attack is possible, an attacker can can remove all vaultIds from an arbitrary account. I.e. anyone can mix up vault configuration for any user. Proof of Concept ConvexYieldWrapper.removeVault doesn't have access controls and allows anyone to manage...

Lack of auth for vaults

Handle 0x1f8b Vulnerability details Impact Anyone can create vaults and remove vaults from anyone. Proof of Concept The contract ConvexYieldWrapper expose two methods: addVault show in his comment Adds a vault to the user's vault list but according to the code it not use the users vault, it use...

Vaults don't work with fee-on transfer tokens

Handle cmichel Vulnerability details Certain ERC20 tokens make modifications to their ERC20's transfer or balanceOf functions. One type of these tokens is deflationary tokens that charge a certain fee for every transfer or transferFrom. Impact The Vault.addValueBatch functions will recive less...

NFTXVaultFactoryUpgradeable implementation can be replaced in production breaking the system

Handle hyh Vulnerability details Impact NFTXVaultFactory contract holds information regarding vaults, assets and permissions vaults, vaultsForAsset and excludedFromFees mappings. As there is no mechanics present that transfers this information to another implementation, the switch of...

DonPAPI - Dumping DPAPI Credz Remotely

Dumping revelant information on compromised targets without AV detection DPAPI dumping Lots of credentials are protected by DPAPI. We aim at locating those "secured" credentials, and retreive them using : User password Domaine DPAPI BackupKey Local machine DPAPI Key protecting TaskScheduled blob...

Use mutex lock on VaultHelper.sol

Handle tensors Vulnerability details Impact I strongly recommend adding a nonreentrant modifier on the functions within VaultHelper.sol The contract makes a bunch of unsafe external calls to the user submitted addresses vault and gauge. Also, add some checks to make sure vault and gauge are...

An attacker can steal funds from multi-token vaults

Handle WatchPug Vulnerability details The total balance should NOT be simply added from different tokens' tokenAmounts, considering that the price of tokens may not be the same. function balanceOfThis public view returns uint256 balance address memory tokens = manager.getTokensaddressthis; for...