https://www.androidpolice.com/lastpass-breach-plex-update/ Buy a Samsung Galaxy S23 Ultra and get $100 in Samsung Instant Credit Android Police Android Police logo * Latest + News + Deals + Podcast * Categories + Android + Google + Phones + Wearables + ChromeOS + Smart home + Chromebooks + Tablets + Games + Apps * Reviews, Guides & Features + Reviews + Editorials + Guides & How-tos + Features * The Best + The best Android phones + The best smartwatches + The best Android tablets + The best Chromebooks + The best wireless earbuds + The best 5G phones + The best Android apps + The best Android games * More + Share a tip! + AP's privacy policy + Meet the team + Write for us! * Newsletter Follow Us Follow Android Police * * * * * * * * * [ ] * Home * Applications * Applications news LastPass breach could've been stopped with a 3-year-old Plex update By Jules Wang Published 1 day ago This story's more than about one employee's Plex account Source: LastPass Readers like you help support Android Police. When you make a purchase using links on our site, we may earn an affiliate commission. Read More. LastPass has taken a reputational tumble from one of the great password managers out there to becoming mired in infamy after not one , but two massive data breaches last year. We learned more details about the second incident last week -- a malicious party installed a keylogger onto a senior engineer's home computer through an exploit in Plex, the personal cloud service for movie storage and streaming, and was able to break into corporate-level caches as a result. But it turns out that the engineer had a big part to play in this major failure as well. ANDROIDPOLICE VIDEO OF THE DAY Plex has revealed that the exploit in question took advantage of a vulnerability that was disclosed back on May 7, 2020. The company tells PCMag that, for some reason, the LastPass employee never updated their client to apply the patch. The loophole allowed those with access to a server administrator's Plex account to upload a malicious file through the Camera Upload feature and, by overlapping the locations of the server data directory with a library that allowed Camera Uploads, have the media server execute it. The company released Plex Media Server v1.19.3 that very same day to patch the gap. "For reference, the version that addressed this exploit was roughly 75 versions ago," a LastPass spokesperson said. LastPass declined to comment on the new information. What's glaring to us is that the chain of events that led to this breach started right from the top: LastPass allowed this senior employee to access privileged work surfaces through their personal computer, opening up the possibility for someone to gain access to this employee's Plex account, to execute a long-patched exploit that worked due to the aforementioned's negligence, and to gain unfettered access to those work surfaces from there. Each stage of this sequence was set up by a decision that may have been justified for one reason or another at the time. But with the way things have developed, LastPass will need a bigger shovel if it wants to dig itself out of this hole. Subscribe to our newsletter Comments Share Tweet Share Share Share Share Copy Email Share Share Tweet Share Share Share Copy Email Link copied to clipboard Related Topics * News * Applications * lastpass * plex About The Author Jules Wang * Multimedia Editor (1689 Articles Published) Jules joined the Android Police team in 2019. He currently manages weekend news, our newsletter, and our podcast. Before that, he was at our now-sister site, Pocketnow. He loves public transportation, podcasts, and people in general. He also likes to take views from the bigger picture in technology from how people are attracted to it to how it's utilized across every other industry. Close Poll What was your favorite gadget at MWC 2023? ( ) Motorola Rizr Rollable Concept 67%, 68 votes ( ) Honor Magic Vs 6%, 6 votes ( ) OnePlus 11 Concept 12%, 12 votes ( ) Xiaomi 13 and 13 Pro 11%, 11 votes ( ) Honor Magic 5 Pro 4%, 4 votes Total Votes: 101 See More Vote View results * Today's best tech deals * The latest AP Podcast This $100 Pixel 7 discount lets you upgrade to 256GB for free 3 days ago You'll be glad you snagged this UE Boom 3 deal when summer rolls around 4 days ago Get more bang for your buck with this great deal on the excellent Lenovo Flex 5i Chromebook 5 days ago See More How do you pronounce 'Rizr,' the Android Police podcast asks? 1 day ago The Galaxy S23, the triumph of ZKD, and the Android Police podcast Feb 26, 2023 Samsung didn't upgrade the Galaxy S23 the right way, the Android Police podcast says Feb 19, 2023 See More Trending Now Google's celebrating an early spring with new Android and Wear OS features 5 Samsung Galaxy S23 settings you need to change immediately LastPass reveals its recent security attack was worse than it initially thought Read Next How to know if someone has blocked your phone number 22 best offline Android games to play when there's no internet How to block ads on your Android phone or tablet How to mass delete emails in Gmail * Share A Tip * Home * Write For Us * Terms * Privacy * Copyright * Meet The Team * How We Test * About Us * Fact Checking Policy * Corrections Policy * Ethics Policy * Ownership Policy * Partnership Disclaimer * Contest Rules Copyright (c) 2023 www.androidpolice.com [p]