https://www.pcworld.com/article/1923963/an-exploit-can-reveal-your-keepass-master-password-in-plaintext.html * News + Accessories + Business + Entertainment + Gaming + Laptops + Mobile + PCs & Components + Security + Smart Tech + Software + Wi-Fi & Networks + Windows * Best Picks + Accessories + Business + Entertainment + Gaming + Laptops + Mobile + PCs & Components + Security + Smart Tech + Software + Wi-Fi & Networks + Windows * Reviews + Accessories + Business + Entertainment + Gaming + Laptops + Mobile + PCs & Components + Security + Smart Tech + Software + Wi-Fi & Networks + Windows * How-To + Accessories + Business + Entertainment + Gaming + Laptops + Mobile + PCs & Components + Security + Smart Tech + Software + Wi-Fi & Networks + Windows * Deals + All Deals + Coupon Codes o All Coupon Codes o eBay Coupon o HP Coupon Code o OnePlus Coupon o Samsung Promo Code o Microsoft Coupon o Dell Coupon Code o Motley Fool Discount o GoPro Promo Code o Starz Promo Code o AT&T Wireless Promo Code o Black Friday 2021 Coupons o Cyber Monday 2021 Coupons * Laptops * Windows * Security * More + Accessories + Business + Entertainment + Gaming + Mobile + PCs & Components + Smart Tech + Software + Wi-Fi & Networks * Newsletters * Digital Magazine - Subscribe * Digital Magazine - Log in Skip to content * Menu * * News + Accessories + Business + Entertainment + Gaming + Laptops + Mobile + PCs & Components + Security + Smart Tech + Software + Wi-Fi & Networks + Windows * Best Picks + Accessories + Business + Entertainment + Gaming + Laptops + Mobile + PCs & Components + Security + Smart Tech + Software + Wi-Fi & Networks + Windows * Reviews + Accessories + Business + Entertainment + Gaming + Laptops + Mobile + PCs & Components + Security + Smart Tech + Software + Wi-Fi & Networks + Windows * How-To + Accessories + Business + Entertainment + Gaming + Laptops + Mobile + PCs & Components + Security + Smart Tech + Software + Wi-Fi & Networks + Windows * Deals + All Deals + Coupon Codes o All Coupon Codes o eBay Coupon o HP Coupon Code o OnePlus Coupon o Samsung Promo Code o Microsoft Coupon o Dell Coupon Code o Motley Fool Discount o GoPro Promo Code o Starz Promo Code o AT&T Wireless Promo Code o Black Friday 2021 Coupons o Cyber Monday 2021 Coupons * Laptops * Windows * Security * More + Accessories + Business + Entertainment + Gaming + Mobile + PCs & Components + Smart Tech + Software + Wi-Fi & Networks * Newsletters * Digital Magazine - Subscribe * Digital Magazine - Log in * Type your search and hit enter * Hot Topics * Best laptops * Best cheap laptops * Laptop deals * Best SSDs * Best monitors * * * * When you purchase through links in our articles, we may earn a small commission. This doesn't affect our editorial independence. Home / Software / News News An exploit can reveal your KeePass master password in plaintext A fix is on the way, possibly as soon as early June. Alaina Yee By Alaina Yee Senior Editor, PCWorld May 19, 2023 2:13 pm PDT KeePass Image: Michael Ansaldo/Foundry KeePass password manager users may want to be extra vigilant for the next several weeks or so. A newly discovered vulnerability allows retrieval of of the master password in plaintext, even when the database is locked or the program is closed. And while a fix is in the works, it won't arrive until early June at the soonest. As reported by Bleeping Computer (which covers the issue in full technical detail), a security researcher known as vdohney published a proof-of-concept tool that demonstrated the exploit in action. An attacker can perform a memory dump to gather most of the master password in plaintext, even when a KeePass database is closed, the program is locked, or the program is no longer open. When pulled out of the memory, the first one or two characters of the password will be missing, but can then be guessed to figure out the entire string. For those unfamiliar with memory dumping vulnerabilities, you can think of this scenario a bit like KeePass's master password as loose change in a pants pocket. Shake out the pants and you get nearly the whole dollar (so to speak) needed to buy entry into the database--but those coins shouldn't be floating around in that pocket to begin with. The proof-of-concept tool demonstrates this issue in Windows, but Linux and macOS are believed to be vulnerable, too, as the problem exists within in KeePass, not the operating system. Standard user accounts in Windows aren't safe, either--dumping the memory does not require administrative privileges. To execute the exploit, a malicious actor would need either access to the computer remotely (gained through malware) or physically. [image-6]KeePass comes in two editions, 2.x and 1.x. They are both still maintained, though 2.x is the newer edition with more available features. All existing versions of KeePass 2.x (e.g., 2.53.1) are affected. Meanwhile, KeePass 1.x (an older edition of the program that's still being maintained), KeePassXC, and Strongbox, which are other password managers compatible with KeePass database files, are not affected according to vdohney. A fix for this vulnerability will come in KeePass version 2.54, which is likely to launch in early June. Dominick Reichl, the developer of KeePass, gave this estimate in a sourceforge forum along with the caveat that the timeframe is not guaranteed. An unstable test version of KeePass with the security mitigations is available now. Bleeping Computer reports that the creator of the proof-of-concept exploit tool cannot reproduce the issue with the fixes in place. However, even after upgrading to the fixed version of KeePass, the master password may still be viewable in the program's memory files. To fully protect against that, you'll have to wipe your PC completely using the mode that overwrites existing data, then freshly reinstall the operating system. Our top Antivirus pick Norton 360 Deluxe Norton 360 Deluxe Editors' Choice Read our review Price When Reviewed: PS29.99 for the first year Best Prices Today: $17.99 at PCWorld Software Store | PS29.99 at Norton That's a pretty drastic move, however. More reasonably, don't let untrusted individuals access your computer, and don't click any unknown links or install any unknown software. A good antivirus program (like one of those among our top recommendations) helps, too. When the fixed version of KeePass launches, you can also change your master password after upgrading--doing so should make the previous password irrelevant if it's still lurking in your memory files. You can also reduce your exposure by restarting your PC, clearing your hibernation and swap files, and temporarily accessing your KeePass database in a safe alternative like KeePassXC instead. Device encryption can also help against a physical attack on your PC (or if you think someone could mine this info after you donate or junk the PC). There are ways to stay protected--and fortunately, this appears to be only a proof-of-concept concern, rather than an active exploit. Author: Alaina Yee, Senior Editor [ay_idg_byline2-1] Alaina Yee is PCWorld's resident bargain hunter--when she's not covering PC building, computer components, mini-PCs, and more, she's scouring for the best tech deals. Previously her work has appeared in PC Gamer, IGN, Maximum PC, and Official Xbox Magazine. You can find her on Twitter at @morphingball. * * Recent stories by Alaina Yee: * Google will start deleting inactive accounts: Gmail, Docs, YouTube at risk * 5 free Chrome browser extensions we can't live without * Facebook fixes friend request bug that revealed your viewing habits Coupon Codes * Dell CouponDell coupon code: Get $250 off PowerEdge Servers, Networking & Storage * Samsung Promo Code40% off Samsung promo code * Motley Fool DiscountSign up and get 15 stock recommendations * eBay CouponSave extra 30% with this eBay coupon * Overstock CouponOverstock Coupon - 20% Off | 2023 Home Decor Special * PCWorld helps you navigate the PC ecosystem to find the products you want and the advice you need to get the job done. * * * * * Policies + Privacy Policy + Cookie Policy + European Privacy Settings + Member Preferences + Editorial independence + Licensing & Eprints + California: Do not Sell my Personal Info * About + About Us + Advertise + Ad Choice + Contact Us + Foundry Careers + GamePro * PCWorld Categories + Business Laptop Mobile PC Hardware Deals * Subscribe + Recent cover images of Macworld Digital Magazine + Digital Magazine - Subscribe Manage Subscription Gift Subscription Newsletters Copyright (c) 2023 IDG Communications, Inc. [Explore the Foundry Network +] Top Of Page Do Not Sell My Info Privacy Settings