London Daily

Focus on the big picture.

Password manager Passwordstate hacked to deploy malware on customer systems

Password manager Passwordstate hacked to deploy malware on customer systems

A mysterious threat actor has compromised the update mechanism of enterprise password manager application Passwordstate and deployed malware on its users' devices, most of which are enterprise customers.

A mysterious threat actor has compromised the update mechanism of enterprise password manager application Passwordstate and deployed malware on its users’ devices, most of which are enterprise customers.

Click Studios, the Australian software firm behind Passwordstate, has notified its 29,000 customers earlier today via email.

According to a copy of the company’s communications, obtained by Polish tech news site Niebezpiecznik, the malware-laced update was live for 28 hours between April 20, 20:33 UTC and April 22, 00:30 UTC.


Danish security firm CSIS, which dealt with the aftermath of this supply chain attack, published today an analysis of the attacker’s malware. The security firm said the threat actor forced the Passwordstate apps to download an additional ZIP file named “Passwordstate_upgrade.zip” that contained a DLL file named “moserware.secretsplitter.dll.” After installation, this DLL file would ping a remote command and control server, from where it would request new commands and retrieve additional payloads.

While initially it was unknown what attackers collected from infected systems, in two updates [PDF, PDF] published after this article went live, Click Studios said the malware collected the following information and sent it back to its command and control server:

Computer Name, User Name, Domain Name, Current Process Name, Current Process Id, All running Processes name and ID, All running services name, Display name and status, Passwordstate instance’s Proxy Server Address, Username and Password

In other words, the password store was taken. According to the Australian company, the following information is typically included in the password table:

Title, UserName, Description, GenericField1, GenericField2, GenericField3, Notes, URL, Password

Although the company said “there is no evidence of encryption keys or database connection strings” were taken, Juan Andres Guerrero-Saade, Principal Threat Researcher at SentinelOne, pointed out on Twitter, that there are tools currently available that can decrypt the Passwordstate vaults and recover cleartext passwords.

Click Studios released a hotfix package [ZIP] that would help customers remove the attacker’s malware, which the company named Moserware. [instructions are in the image above]

Click Studios said the hack took place after a threat actor compromised the “In-Place Upgrade functionality” of a CDN network not controlled by Click Studios. Only the company’s Windows client appears to have been modified to add malware in the attack.

29,000 companies now have to rotate passwords


In the aftermath of this security breach, the Australian firm has told customers to change all the passwords they stored inside compromised Passwordstate password managers as soon as possible.

Since this is a password manager is sold primarily in bulk to enterprises, to whom it is advertised as an on-premises system, changing passwords won’t involve just email and website accounts, but also passwords for internal gear such as firewalls, VPNs, switches, routers, network gateways, and others, which many employees would most likely have saved inside the app thinking it was a secure local storage system.

“This is a real annoying breach,” William Thomas, a malware analyst at UK security firm Cyjax, told The Record. “Imagine having to change all your passwords for each device on the network, on a Friday.”

Several network administrators have told The Record on Friday that they had to work over the weekend to change the passwords of all their IT inventory as a result of the breach. Many companies also intend to activate incident response plans to check logs for unauthorized access as a result of this incident as well, resulting in many overtime hours for their already swamped security personnel.

Comments

Darth Neo 140 days ago
This is hardly relevant. The event happened in 2021 and the vendor identified and took action within 28hrs. They have subsequently made major improvements to their software, including removing the previous method of updating. The issue affected Build 9117 and they are now on release 9823. I have to question the reasoning on reporting news that is over 2 years old and has been resolved promptly by the vendor.

Newsletter

Related Articles

London Daily
0:00
0:00
Close
Unelected PM of the UK holds an emergency meeting because a candidate got voted in… which he says is a threat to democracy…
You Are So Beautiful
Rob Schneider explains California reparations legislation.
Postmodern Jukebox European Tour Version
Who knew badminton could get so intense?
An old French tune (by Georges Brassens) Pomplamoose ft. John Schroeder
Farmers break through police barriers in Brussels.
Sattahip Motor Show 20
London's Iconic British Telecom Tower Sold To Become Hotel
SONATE AU CLAIR DE LUNE - Moonlight sonata
Ukraine Arrests Father-Son Duo In Lockbit Cybercrime Bust
A kiss to build a dream on
US Offers $15 Million For Info On Leaders Of Cybercrime Group Lockbit
Wonderful Tonight - Eric Clapton (Boyce Avenue acoustic cover)
Russia Claims UK Cultural Agency Spied for Ukraine
Mean Blues
Apple warns against drying iPhones with rice
La Chansonnette
Alexei Navalny: UK sanctions Russian prison chiefs after activist's death
Pattaya Addicts
German economy is in 'troubled waters' - ministry
Franz Liszt - Liebestraum - Love Dream
In a recent High Court hearing, the U.S. argued that Julian Assange endangered lives by releasing classified information.
Dream a little dream of me
New video
Unchained Melody sung like you've NEVER heard!
Tucker Carlson says Boris Johnson wants "a million dollars, in Bitcoin or cash, from Tucker Carlson to talk about Ukraine.
Dave Brubeck - Take Five
Russia is rebuilding capacity to destabilize European countries, new UK report warns
Édith Piaf - Non, Je Ne Regrette Rien (Sofie)
EU Commission wants anti-drone defenses at Brussels HQ
Rondo Alla Turca
Von der Leyen’s 2nd-term pitch: More military might, less climate talk
Kiss of fire
Global Law Enforcement Dismantles Lockbit Ransomware Operation
Tom Jones - I´ll Never Fall In Love Again 1967, 1989, 2001
Prince William Urges End to Gaza Conflict
Israel Cachao López - Guajira Clásica
UK court to hear Assange's final appeal against extradition to the US, where he faces charges related to his journalistic work—the publication of a classified video in 2010 that exposed US war crimes against humanity.
Edward Maya - Stereo Love (feat. Vika Jigulina) (Extended Mix)
About 50-60% kids either chose to be YouTuber or influencer
Strauss - Radetzky March - Karajan
A viral video of Nationals MP Barnaby Joyce lying on a Canberra footpath is celebrated by his media mates.
La vie en rose
European Countries React to Navalny's Death by Summoning Russian Diplomats
The Temptations - My Girl (Smokey Robinson Tribute) 2006 Kennedy Cent
Israel has gone ‘beyond self-defence’ in Gaza, says Labour’s Streeting
Orlando Cachaito Lopez Redencion
English farmers to be offered ‘largest ever’ grant scheme amid food security concerns
Edith Piaf - NON, JE NE REGRETTE RIEN
Cameron government knew Post Office ditched Horizon IT investigation
RADETZKY MARCH-2008-Wien, New Year Concert
EU Calls for Immediate Ceasefire in Gaza Conflict
Only you (And you alone)
EU Vows To Hold Putin "Accountable" After Meeting Alexei Navalny's Wife
Strangers In The Night
EU Launches Probe Into TikTok Over Child Protection Under Digital Content Law
Charles Aznavour - La Boheme
The EU Initiates Naval Mission to Defend Red Sea Trade Routes
Summer time
EU and UK Announce Joint Effort on Migration
Sting and Stevie Wonder - Fragile (from Sting's 60th birthday concert)
Brazil's Lula Likens Gaza Operation to Holocaust, Israel Says "Red Line" Crossed
Aux Champs Elysees
Ministers Confirm Proposal to Prohibit Mobile Phone Usage in English Schools
Stand By Me - Ben E. King (Boyce Avenue acoustic cover)
Microsoft-backed OpenAI valued at $80bn after company completes deal
La Mer (Beyond the Sea) – Avalon Jazz Band
‘Alexei would want to tell Russia not to give up fighting’
She
Rwandan Footballer's Dismissal Sparks Concerns Over UK Asylum Plan
Nathalie Song by Enzo Petrachi Stjepan Hauser Cello
Whisky Challenges China's Baijiu Market During New Year Celebrations
Shape of My Heart - Sting (Boyce Avenue acoustic cover)
Avdiivka - Symbol Of Ukrainian Resistance Now In Control Of Russian Troops
Radiohead - Creep
Putin Critic Alexei Navalny's "Killers" Refusing To Hand Over Body, Say Allies
Quizás,Quizás,Quizás - Andrea Bocelli - Jennifer Lopez
"Historic Step": Zelensky Signs Security Pact With Germany
Perhaps, Perhaps, Perhaps - Multi-Couples
"Historic Step": Zelensky Signs Security Pact With Germany
Pentatonix Havana
20 Tech Giants Sign Effort To Fight AI Election Interference Across Globe
Paula Cole - Autumn Leaves
Joe Biden Accuses Putin of Causing Navalny's Death
Oscar Benton Bensonhurst Blues
Russian opposition leader Alexey Navalny has died at the Arctic prison colony
OH NANANA vs ABUSADAMENTE
Tucker Carlson grocery shopping in Russia. This is so interesting.
Nina Simone - ”I Put A Spell On You”. Vezi aici cum cântă Jeremy Ragsd
Julian Assange's Wife Warns of His Death if Extradited to US
NIGHTWISH - The Phantom Of The Opera
‘A lot higher than we expected’: Russian arms production worries Europe’s war planners
Motorshow 2016 Tanjay Negros Oriental
Greece Legalizes Same-Sex Marriage and Adoption Rights
Monica Bellucci - Ti Amo
Hungarian Foreign Minister: Europeans will lose Europe, the Union's policy must change drastically
Michael Jackson - Billie Jean Milena The Voice France 2018
In Britain Homeowners are receiving CPO’s (Compulsory Purchase Orders) so their homes can be redistributed to migrants
Michael Buble (Help Me Make It Through The Night) feat Loren Allred
Memories Canon In D - Maroon 5 (Boyce Avenue piano acoustic cover)
Matteo Simoni - Marina
Maroon 5 - One More Night
Maroon 5 - Memories
Mark Knopfler - Brothers In Arms (Berlin 2007 Live)
Mark Knopfler & Emmylou Harris - Romeo And Juliet (Real Live Roadrunni
Marina, Marina - The LUCKY DUCKIES intimist live concert at Guimarães
Major Lazer & DJ Snake – Lean On Mauranne The Voice France 2016
Love Theme from Romeo and Juliet - Joslin - Henri Mancini, Nino Rota
LoLa & Hauser - Love Story
Linkin Park Jay-Z - Numb Encore (Live 8 2005)
Hallelujah Mennel Ibtissem, The Voice France Leonard Cohen
Leonard Cohen - Dance Me to the End of Love
Leonard Cohen & Natasha Rostova - Dance me to the end of love
La casa de papel - Bella Ciao
La Camisa Negra
L'italiano (Toto Cutugno) - The Gypsy Queens
Juanes - La Camisa Negra
Jonathan and Charlotte - Britain's Got Talent 2012 Live Semi Final - U
John Powell - Assassin's Tango
Joe Cocker - You Can Leave Your Hat On (LIVE in Dortmund)
Joe Cocker - Unchain My Heart 2002 Live
Joe Cocker - A Whiter Shade Of Pale
Jay Z & Alicia Keys - Empire State of Mind LIVE
Jason Mraz - Im Yours (live)
Jarrod Radnich - Bohemian Rhapsody - Virtuosic Piano Solo
James Blunt - You're Beautiful
James Blunt - You're Beautiful & Bonfire Heart (Live at The Nobel Peac)
If You Go Away - Helen Merrill & Stan Getz (Tribute to Virna Lisi)
I'LL BE MISSING YOU
I Say a Little Prayer
Hotel California ( Eagles ) 1994 Live
Historia de un amor - Luz Casal. Vezi interpretarea Biancăi Sumanariu
Here Comes The Sun - The Beatles (Boyce Avenue acoustic cover) on Spot
Heart - Stairway to Heaven Led Zeppelin - Kennedy Center Honors
HAVANA by Camila Cabello Zumba Pre Cooldown TML Crew Kramer Pastra
HAUSER and Señorita - I Will Always Love You
HAUSER - Waka Waka
HAUSER - Sway
HAUSER - Lambada
HAUSER - Historia de un Amor
HAUSER - Despacito
Great Pretender
Georgia May Foote & Giovanni Pernice Samba to 'Volare' - Strictly Come
Gary Moore - Still Got The Blues
GIPSY KINGS VOLARE Penelope Cruz
Fugees - Killing Me Softly With His Song
French Latino - Historia de un Amor
For A Few Dollars More The Danish National Symphony Orchestra (Live)
Flashdance • What a Feeling • Irene Cara
Filip Rudan - “Someone You Loved” Audicija 4 The Voice Hrvatska Sez
Eric Clapton - Wonderful Tonight
Enya - Only Time
Enrique Iglesias - Bailando (English Version) ft. Sean Paul
Enrique Iglesias - Bailamos
Elena Yerevan Historia de un amor
Ed Sheeran - Shape of You (Official Music Video)
Ed Sheeran - Perfect Symphony [with Andrea Bocelli]
Ed Sheeran - Perfect (Official Music Video)
Easy On Me - Adele (Boyce Avenue 90’s style piano acoustic cover) on S
ERA - Ameno
ELENA YEREVAN- Cancion Del Mariachi-IN STUDIO-2017 DPR
Dust In The Wind - Kansas (Boyce Avenue acoustic cover)
Don't Let Me Be Misunderstood
Despacito x Shape Of You - Pentatonix
Deep Purple - Child In Time - Live (1970)
David Foster When A Man Loves A WomanIt's A Mans World (SealMichael Bo
Dance me to the end of Love ( Pi-Air Design )
Coolio - Gangsta's Paradise (feat. L.V.) [Official Music Video]
Conquest Of Paradise (Vangelis), played on Böhm Emporio organ
Cielito Lindo
Chico & The Gypsies - Bamboleo
Canción Del Mariachi - Antonio Banderas, Los Lobos • Desperado
Camila Cabello - Havana (Audio) ft. Young Thug
Camila Cabello - Havana ( cover by J.Fla )
California Dreamin' - The Mamas & The Papas José Feliciano (Boyce Ave
Buster Benton - Money Is The Name of The Game
Hallelujah Pentatonix
Bobby McFerrin - Don't Worry Be Happy (Official Music Video)
Bob Dylan - Knockin' On Heaven's Door Emilia The Voice Kids France
Besame Mucho - Cesaria Evora
Ben E. King - Stand by Me Sax Cover Alexandra Ilieva Thomann
Bella Ciao
Bella Ciao - INSTRUMENTAL
Beautiful in White x Canon in D (Piano Cover by Riyandi Kusuma)
Bad Romance - Vintage 1920's Gatsby Style Lady Gaga Cover ft. Ariana Savalas & Sarah Reich(1)
BELLA CIAO 2020 - KARAOKE ITALIANO
BAMBOLEO - Gipsy Kings • Antonio Banderas, Katya Virshilas
BAILANDO (original)
Awesome Ukrainian yodeler - SOFIA SHKIDCHENKO (with English subtitles)
Avicii - The Nights
Atom - The Great Gig in the Sky
Aretha Franklin - (You Make Me Feel Like) A Natural Woman (Official Ly
Antonio Banderas - Cancion del Mariachi (Desperado)
André Rieu - Zorba's Dance (Sirtaki)
André Rieu - Can't Help Falling In Love
André Rieu & Mirusia - Ave Maria
Andrew Reyes Elton John - Don't Let The Sun Go Down The Voice 2020 (
Andreas Kümmert Whiter Shade Of Pale The Voice of Germany 2013 Showd
And I Love You So
All About That Bass - Postmodern Jukebox European Tour Version
Alan Walker - Faded (Piano Cover)
Ain't No Sunshine -- Bill Withers (cover by Canen 12 y.o.)
African music
Adriana Vidović - “Creep” Audicija 4 The Voice Hrvatska Sezona 3
Adriana Vidović - “Believer” Nokaut 3 The Voice Hrvatska Sezona 3
A Fistful of Dollars - The Danish National Symphony Orchestra and Tuva
4 Beautiful Soundtracks Relaxing Piano [10min]
2CELLOS - Whole Lotta Love vs. Beethoven 5th Symphony [OFFICIAL VIDEO]
2CELLOS - Smooth Criminal (Live at Suntory Hall, Tokyo)
2CELLOS - Smells Like Teen Spirit [Live at Sydney Opera House]
2CELLOS - Despacito [OFFICIAL VIDEO]
13 Year Old Girl Playing Il Silenzio (The Silence) - André Rieu
094.All About That Bass
00 - SADNESS PART 1
(Ghost) Riders In the Sky (American Outlaws Live at Nassau Coliseum, 1
(Everything I Do) I Do It For You - Bryan Adams (Boyce Avenue ft. Conn
What a wonderful world
Moon river
×