LastPa ss pushes out Android update to prevent unwanted access
0LastPa.ss pushes out Android update to prevent unwanted access.
Even if a phone is found unlocked, LastPass requires that a fingerprint or passcode be entered to gain access to temporary two-factor authentication codes. Following the discovery of a method to bypass LastPass's prompt for a password or PIN on Android, an update has been released to rectify the vulnerability.
In the latest version of LastPass, a fingerprint or passcode is now required and can no longer be bypassed. The previous workaround to circumvent the prompt required physical access to an unlocked Android device, making it a relatively low-risk vulnerability. The exploit never allowed for time-based, one-time passwords to be generated which would have granted access to linked accounts.
The vulnerability was originally reported in June 2017 and was confirmed by LastPass. Several months passed with no timeline for a fix. According to parent company LogMeIn, Inc., the issue in question was not reported through their bug bounty program and therefore did not receive the attention is should have in a timely manner.
Reforms and changes to bug reporting are being made by LastPass to prevent important vulnerabilities from going unnoticed in the future.