Password Managers Exposed: New Recovery Attacks Threaten User Security

New Vulnerabilities Expose Password Managers to Recovery Attacks

A recent study has uncovered a series of vulnerabilities in popular cloud-based password managers, including Bitwarden, Dashlane, and LastPass. The research, conducted by experts from ETH Zurich and Università della Svizzera italiana, identified 12 attacks against Bitwarden, seven against LastPass, and six against Dashlane, all of which target the zero-knowledge encryption (ZKE) promises of these services.

The attacks, which assume a malicious server, range from integrity violations to complete organizational vault compromise, with the majority enabling password recovery. The vulnerabilities were found in key escrow mechanisms, item-level encryption with flawed metadata handling, sharing features, and backward compatibility with legacy code. 1Password was also found to be vulnerable to similar issues, although these were already known.

Vulnerabilities Identified

• Key escrow mechanisms, which are designed to allow for secure recovery of encrypted data in the event of a forgotten password or lost encryption key.
• Item-level encryption with flawed metadata handling, which can allow an attacker to recover sensitive information.
• Sharing features, which can be exploited to gain unauthorized access to shared password vaults.
• Backward compatibility with legacy code, which can introduce vulnerabilities in older systems.

The vendors have begun implementing countermeasures to address these vulnerabilities, but the research serves as a reminder of the importance of ongoing security testing and evaluation.

About Author

Vaibhav

See author's posts