Forest Global Training Partners

Cyber Risks · Cisco Talos

Threat Source newsletter (Sept. 8, 2022) — Why there is no one-stop-shop solution for protecting passwords

Summary: Cisco Talos' newsletter notes that LastPass, one of the most popular password management services, recently suffered a breach of its internal development environment, though primary user passwords did not appear compromised as of the writing. The same issue cites a Plex incident that forced all users to reset passwords, and reports that Lazarus Group deployed a new trojan called MagicRAT after exploiting VMware Horizon vulnerabilities, while the SharkBot Android banking trojan was installed on tens of thousands of devices via Google Play apps Mister Phone Cleaner and Kylhavy Mobile Security.

Bottom line: The newsletter's own poll found paid password managers the most popular choice, yet the breach it describes hit one of those providers' internal development environment - and the piece argues no single option is safe, since browser-based managers expose every login if a Google account is compromised. Meanwhile, a Los Angeles school district attack forced more than 600,000 students and staff to reset passwords.

Read the original at Cisco Talos ↗

Topics
Malware
Related