www.darkreading.com Open in urlscan Pro
2606:4700::6811:7663  Public Scan

Form analysis
0 forms found in the DOM

Text Content

The Edge
DR Tech
Sections
Close
Back
Sections
Featured Sections
The Edge
Dark Reading Technology
Attacks / Breaches

Cloud

ICS/OT

Remote Workforce

Perimeter

Analytics
Security Monitoring

Security Monitoring
App Sec
Database Security

Database Security
Risk
Compliance

Compliance
Threat Intelligence

Endpoint
AuthenticationMobile SecurityPrivacy

AuthenticationMobile SecurityPrivacy
Vulnerabilities / Threats
Advanced ThreatsInsider ThreatsVulnerability Management

Advanced ThreatsInsider ThreatsVulnerability Management
Operations
Identity & Access ManagementCareers & People

Identity & Access ManagementCareers & People
Physical Security

IoT

Black Hat news
Omdia Research
Security Now
Events
Close
Back
Events
Events
 * Anatomy of a Data Breach - A Dark Reading June 22 Event
   
 * Black Hat USA - August 5-10 - Learn More
   

Webinars
 * How to Launch a Threat Hunting Program
   Apr 27, 2023
 * What's "CNAPP-ening"? Bring Your Cloud Security into Focus!
   May 04, 2023

Resources
Close
Back
Resources
Dark Reading Library >
Webinars >
Reports >
Slideshows >
White Papers >
Partner Perspectives: Microsoft
Tech Library >

Newsletter

The Edge
DR Tech
Sections
Close
Back
Sections
Featured Sections
The Edge
Dark Reading Technology
Attacks / Breaches

Cloud

ICS/OT

Remote Workforce

Perimeter

Analytics
Security Monitoring

Security Monitoring
App Sec
Database Security

Database Security
Risk
Compliance

Compliance
Threat Intelligence

Endpoint
AuthenticationMobile SecurityPrivacy

AuthenticationMobile SecurityPrivacy
Vulnerabilities / Threats
Advanced ThreatsInsider ThreatsVulnerability Management

Advanced ThreatsInsider ThreatsVulnerability Management
Operations
Identity & Access ManagementCareers & People

Identity & Access ManagementCareers & People
Physical Security

IoT

Black Hat news
Omdia Research
Security Now
Events
Close
Back
Events
Events
 * Anatomy of a Data Breach - A Dark Reading June 22 Event
   
 * Black Hat USA - August 5-10 - Learn More
   

Webinars
 * How to Launch a Threat Hunting Program
   Apr 27, 2023
 * What's "CNAPP-ening"? Bring Your Cloud Security into Focus!
   May 04, 2023

Resources
Close
Back
Resources
Dark Reading Library >
Webinars >
Reports >
Slideshows >
White Papers >
Partner Perspectives: Microsoft
Tech Library >
The Edge
DR Tech
Sections
Close
Back
Sections
Featured Sections
The Edge
Dark Reading Technology
Attacks / Breaches

Cloud

ICS/OT

Remote Workforce

Perimeter

Analytics
Security Monitoring

Security Monitoring
App Sec
Database Security

Database Security
Risk
Compliance

Compliance
Threat Intelligence

Endpoint
AuthenticationMobile SecurityPrivacy

AuthenticationMobile SecurityPrivacy
Vulnerabilities / Threats
Advanced ThreatsInsider ThreatsVulnerability Management

Advanced ThreatsInsider ThreatsVulnerability Management
Operations
Identity & Access ManagementCareers & People

Identity & Access ManagementCareers & People
Physical Security

IoT

Black Hat news
Omdia Research
Security Now
Events
Close
Back
Events
Events
 * Anatomy of a Data Breach - A Dark Reading June 22 Event
   
 * Black Hat USA - August 5-10 - Learn More
   

Webinars
 * How to Launch a Threat Hunting Program
   Apr 27, 2023
 * What's "CNAPP-ening"? Bring Your Cloud Security into Focus!
   May 04, 2023

Resources
Close
Back
Resources
Dark Reading Library >
Webinars >
Reports >
Slideshows >
White Papers >
Partner Perspectives: Microsoft
Tech Library >

--------------------------------------------------------------------------------

Newsletter
SEARCH
A minimum of 3 characters are required to be typed in the search bar in order to
perform a search.




Announcements
 1. 
 2. 
 3. 

Event
How to Launch a Threat Hunting Program | Webinar <REGISTER>
Event
How to Accelerate XDR Outcomes: Bridging the Gap Between Network and Endpoint |
Webinar <REGISTER>
Report
Black Hat USA 2022 Attendee Report | Supply Chain & Cloud Security Risks Are Top
of Mind | <READ IT NOW>
PreviousNext

Vulnerabilities/Threats

5 MIN READ

Commentary



HOW PASSWORD MANAGERS CAN GET HACKED

Password managers aren't foolproof, but they do help mitigate risks from weak
credentials and password reuse. Following best practices can contribute to a
company's defenses.
Stu Sjouwerman
Founder & CEO, KnowBe4, Inc.
April 11, 2023
Source: Brian Jackson via Alamy Stock Photo
PDF


Over the past few months, several leading password managers have been victims of
hacking and data breaches. For instance, LastPass, which experienced a massive
breach last year, recently announced again that the company's password vault has
been stolen. And thanks to the bad practice of reusing passwords too often,
Norton LifeLock also reported compromises to its password manager.



Why are password managers so attractive to cybercriminals? It's simple. Password
managers hold the "keys to the castle." If a password manager gets compromised,
attackers gain access to all stored passwords at once, which means they can walk
into any secured environment or impersonate any user, circumventing all
cybersecurity defenses. The market for password managers is growing rapidly, and
attackers will target anything that can get more bang for their buck.


ATTRACTIVE TARGETS

Some of the most common ways password managers are being hacked include:


1. MALWARE-TARGETING PASSWORD MANAGERS

Malware programs have been targeting password managers for the last several
years. In 2014, malware called Citadel, designed to target password managers,
became notorious for having compromised one in 500 PCs worldwide. However, back
then, only a small number of users used a password manager. Today, the average
person needs to remember upward of 100 passwords, which is why the market for
password managers and the malware market for targeting them are both growing.



For example, the attack on the Solana blockchain last year that resulted in a $7
million heist was caused by malware that targeted crypto wallets and password
managers called Luca Stealer; another Trojan, dubbed StealC, specifically
targets browser extensions and authenticators by password managers; password
stealers targeting Web browsers have also been around for decades.




2. PHISHING ATTACKS AGAINST PASSWORD MANAGERS

Phishing attacks targeting password managers are on the rise. For example, in
January 2023, researchers came across Google Ads that were redirecting victims
to fake Bitwarden and 1Password pages, trying to steal their master credentials.
What's more, customers of password managers such as LastPass, who have already
had their credentials exposed in an earlier data leak, are at an increased risk
of scams and phishing attacks. Attackers know their email addresses, phone
numbers, and the online services they use, and therefore they can be easily
targeted using a variety of phishing techniques.


3. SOFTWARE VULNERABILITIES IN PASSWORD MANAGERS

Just like all other forms of software, password managers are prone to
vulnerabilities. Recently, researchers reported a vulnerability in KeePass that
could allow attackers to export all usernames and passwords in clear text.
Earlier this year, Google discovered that popular password managers such as
Dashlane, Bitwarden, and Apple's Safari browser password manager can all be
manipulated into auto-filling passwords on untrusted pages.




4. CREDENTIAL-STUFFING ATTACKS USING LEAKED CREDENTIALS

Credential-stuffing attacks are becoming increasingly common. This is a type of
attack where threat actors leverage previously leaked credentials (nearly 25
billion of these are for sale on underground marketplaces) to gain unauthorized
access into websites, applications, and networks. Most password managers have a
"master password" to access all credentials, and since 65% of users reuse their
passwords across different websites, it's possible that attackers use
brute-force techniques or make educated guesses on the possible password
combinations. Late last year, LastPass confirmed a credential-stuffing attack
against some of its users.


DO PASSWORD MANAGERS MAKE SENSE IN 2023?

The benefits of having a password manager far outweigh the risks. Password
managers help mitigate two of the biggest risks for users and businesses — weak
credentials and password reuse. Yes, attacks on password managers are on the
rise, but the probability of a business being attacked due to poor credentials
or password reuse is much higher than the likelihood of a password manager
getting hacked.

There are a number of things organizations can do to mitigate the risks of
password managers:

 * Security-train employees: Most password-stealing malware gets installed when
   users get phished or social engineered — users download, click, or open
   something they shouldn't have. This is why it is extremely important for
   organizations to instill secure behavior in employees (alertness, strong
   passwords, safe browsing, responsible use of social media, not trusting
   anything at face value, etc.) so they don't fall victim to a phishing attack.
 * Patch regularly: Make sure you patch all your software and systems regularly.
   Unpatched software is the second-biggest reason password-stealing Trojans get
   installed on computers. Ensure you check and install all critical patches,
   especially the ones that are featured on CISA's Known Exploited Vulnerability
   Catalog.
 * Use phishing-resistant multifactor authentication: Use phishing-resistant MFA
   or passwordless options wherever you can. Not just to protect the master
   password on your password manager, but also on all of your critical websites,
   applications, and services.
 * Check password-dump websites for leaked credentials: Check online
   leaked-password websites (such as haveibeenpwned.com) or take breach password
   tests to ascertain if any of your credentials are floating around in online
   databases.
 * Use a good password manager: Use password managers that deploy strong
   encryption; that follow secure development life cycle (SDLC) programming; are
   responsive, transparent, and responsible to their customers; and that promote
   security features such as MFA, passwordless options, contextual features
   (user gets locked out if it's an unknown device or location), and
   phishing-detection capabilities.

Are password managers foolproof? Nope. But nothing is these days. The operating
systems we use, the devices and applications we use — everything is hackable.
Password managers come with some great benefits — they can tell you if your
password is strong or not, they prevent you from reusing your password, some can
stop you from entering credentials into bogus URLs, and some will even alert you
when a website gets compromised.

As long as organizations follow the above tips and best practices, password
managers can prove to be a vital tool in the defense arsenal of any
organization.

Attacks/BreachesVulnerability Management
Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities,
data breach information, and emerging trends. Delivered daily or weekly right to
your email inbox.
Subscribe

More Insights
White Papers
 * 
   9 Traits You Need to Succeed as a Cybersecurity Leader
 * 
   Cymulate Named Innovation Leader, Frost & Sullivan's - Frost Radar BAS, 2022

More White Papers
Webinars
 * 
   How to Launch a Threat Hunting Program
 * 
   What's "CNAPP-ening"? Bring Your Cloud Security into Focus!

More Webinars
Reports
 * 
   Successfully Managing Identity in Modern Cloud and Hybrid Environments
 * 
   The 10 Most Impactful Types of Vulnerabilities for Enterprises Today

More Reports

Editors' Choice
7 Things Your Ransomware Response Playbook Is Likely Missing
Becky Bracken, Editor, Dark Reading
Samsung Engineers Feed Sensitive Data to ChatGPT, Sparking Workplace AI Warnings
Jai Vijayan, Contributing Writer, Dark Reading
LastPass Breach Reveals Important Lessons
Mike Walters, VP of Vulnerability and Threat Research & Co-Founder, Action1
Corporation
FIN7, Former Conti Gang Members Collaborate on 'Domino' Malware
Jai Vijayan, Contributing Writer, Dark Reading
Webinars
 * How to Launch a Threat Hunting Program
 * What's "CNAPP-ening"? Bring Your Cloud Security into Focus!
 * Artificial Intelligence, ChatGPT and Cybersecurity: A Match Made in Heaven or
   a Hack Waiting to Happen?
 * Unleashing AI to Assess Cybersecurity Risk
 * Puzzled by Patching: Solve Endpoint Pains

More Webinars
Reports
 * Successfully Managing Identity in Modern Cloud and Hybrid Environments
 * The 10 Most Impactful Types of Vulnerabilities for Enterprises Today
 * Shoring Up the Software Supply Chain Across Enterprise Applications
 * The Promise and Reality of Cloud Security
 * 10 Hot Talks From Black Hat USA 2022

More Reports

White Papers
 * 9 Traits You Need to Succeed as a Cybersecurity Leader
 * Cymulate Named Innovation Leader, Frost & Sullivan's - Frost Radar BAS, 2022
 * What Are the Top and Niche Use Cases for Breach and Attack Simulation
   Technology?
 * 2023 Cloud Threat Report
 * Cybersecurity in 2023 and beyond: 12 leaders share their forecasts

More White Papers
Events
 * Anatomy of a Data Breach - A Dark Reading June 22 Event
 * Black Hat USA - August 5-10 - Learn More
 * Black Hat Asia - May 9-12 - Learn More

More Events
More Insights
White Papers
 * 
   9 Traits You Need to Succeed as a Cybersecurity Leader
 * 
   Cymulate Named Innovation Leader, Frost & Sullivan's - Frost Radar BAS, 2022

More White Papers
Webinars
 * 
   How to Launch a Threat Hunting Program
 * 
   What's "CNAPP-ening"? Bring Your Cloud Security into Focus!

More Webinars
Reports
 * 
   Successfully Managing Identity in Modern Cloud and Hybrid Environments
 * 
   The 10 Most Impactful Types of Vulnerabilities for Enterprises Today

More Reports

DISCOVER MORE FROM INFORMA TECH

 * Interop
 * InformationWeek
 * Network Computing
 * ITPro Today

 * Data Center Knowledge
 * Black Hat
 * Omdia

WORKING WITH US

 * About Us
 * Advertise
 * Reprints

FOLLOW DARK READING ON SOCIAL

 * 
 * 
 * 
 * 
 * 
 * 


 * Home
 * Cookies
 * Privacy
 * Terms



Copyright © 2023 Informa PLC Informa UK Limited is a company registered in
England and Wales with company number 1072954 whose registered office is 5
Howick Place, London, SW1P 1WG.





Cookies Button


ABOUT COOKIES ON THIS SITE

We and our partners use cookies to enhance your website experience, learn how
our site is used, offer personalised features, measure the effectiveness of our
services, and tailor content and ads to your interests while you navigate on the
web or interact with us across devices. You can choose to accept all of these
cookies or only essential cookies. To learn more or manage your preferences,
click “Settings”. For further information about the data we collect from you,
please see our Privacy Policy

Accept All
Settings



COOKIE PREFERENCE CENTER

When you visit any website, it may store or retrieve information on your
browser, mostly in the form of cookies. This information might be about you,
your preferences or your device and is mostly used to make the site work as you
expect it to. The information does not usually directly identify you, but it can
give you a more personalized web experience. Because we respect your right to
privacy, you can choose not to allow some types of cookies. Click on the
different category headings to find out more and change our default settings.
However, blocking some types of cookies may impact your experience of the site
and the services we are able to offer.
More information
Allow All


MANAGE CONSENT PREFERENCES

STRICTLY NECESSARY COOKIES

Always Active

These cookies are necessary for the website to function and cannot be switched
off in our systems. They are usually only set in response to actions made by you
which amount to a request for services, such as setting your privacy
preferences, logging in or filling in forms.    You can set your browser to
block or alert you about these cookies, but some parts of the site will not then
work. These cookies do not store any personally identifiable information.

Cookies Details‎

PERFORMANCE COOKIES

Performance Cookies

These cookies allow us to count visits and traffic sources so we can measure and
improve the performance of our site. They help us to know which pages are the
most and least popular and see how visitors move around the site.    All
information these cookies collect is aggregated and therefore anonymous. If you
do not allow these cookies we will not know when you have visited our site, and
will not be able to monitor its performance.

Cookies Details‎

FUNCTIONAL COOKIES

Functional Cookies

These cookies enable the website to provide enhanced functionality and
personalisation. They may be set by us or by third party providers whose
services we have added to our pages.    If you do not allow these cookies then
some or all of these services may not function properly.

Cookies Details‎

TARGETING COOKIES

Targeting Cookies

These cookies may be set through our site by our advertising partners. They may
be used by those companies to build a profile of your interests and show you
relevant adverts on other sites.    They do not store directly personal
information, but are based on uniquely identifying your browser and internet
device. If you do not allow these cookies, you will experience less targeted
advertising.

Cookies Details‎
Back Button


BACK



Search Icon
Filter Icon

Clear
checkbox label label
Apply Cancel
Consent Leg.Interest
checkbox label label
checkbox label label
checkbox label label

 * 
   
   View Cookies
   
    * Name
      cookie name

Confirm My Choices