The incident demonstrates just how important it is to keep all the software on your computer up-to-date. Plex told PCMag that it was unsure as to why the LastPass employee didn’t update their Plex Media Server, since the company “will provide notifications via the admin UI about updates that are available, and will also do automatic updates in many cases.” For reference, the version that addressed this exploit was roughly 75 versions ago.”

“Unfortunately, the LastPass employee never upgraded their software to activate the patch. “At the time, as noted in that post, an updated version of the Plex Media Server was made available to all (),” said a spokesperson for Plex. Unfortunately, the LastPass DevOps engineer was running an older, still vulnerable version of Plex. “An attacker who already had admin access to a Plex Media Server could abuse the Camera Upload feature to make the server execute malicious code,” Plex said when it patched the security flaw, known as CVE-2020-5741.

However, the exploited vulnerability was almost three years old and had already been patched, per Plex. While LastPass said that hackers exploited a vulnerability on a “third-party media software package” on the engineer’s computer to plant the keylogger, PCMag recently learned that the target was Plex Media Server software. The popular password manager said that threat actors used information obtained from an earlier hack in August, in combination with access credentials gleaned from a keylogger that was installed on the DevOps engineer’s computer, to break into LastPass’s cloud-based storage and steal customer data.Īccording to a report from PCMag, however, the whole thing could have been avoided entirely - or at least delayed - if the employee in question had simply installed a software update. Earlier this week, LastPass disclosed that a major security breach last year that saw hackers steal customers’ encrypted password vaults, personal information, and more was orchestrated by installing malware on one employee’s home computer.

Lastpass vault