Researchers Demonstrate 27 Attacks Against Major Password Managers

Key Points:

• Researchers from ETH Zurich demonstrated 27 successful attacks against major password managers, including Bitwarden, LastPass, and Dashlane, revealing vulnerabilities in their Zero-Knowledge Encryption promises.
• The attacks exploit weaknesses such as lack of ciphertext integrity and cryptographic binding, allowing attackers to manipulate data and potentially access users' decrypted passwords.
• Users are advised to update their password manager apps immediately and consider enabling additional security measures like Secret Keys or hardware security keys to enhance protection.

Technical Details: The study highlights vulnerabilities in Bitwarden (12 attacks), LastPass (7 attacks), and Dashlane (6 attacks) by exploiting features like account recovery and legacy security methods. Attackers can manipulate server responses to compromise user data.

MITRE ATT&CK Techniques: None mentioned

IOCs Mentioned: None mentioned