Passwordstate Password Manager Hacked In Supply Chain Attack

Click Studios, the company behind the Passwordstate enterprise password manager, notified customers that attackers compromised the app’s update mechanism to deliver malware in a supply-chain attack after breaching its networks.

Passwordstate is an on-premises password management solution used by over 370,000 security and IT professionals at 29,000 companies worldwide, as the company claims.

Its customer list includes companies (many of them in the Fortune 500 rankings) from a wide range of industry verticals, including government, defense, finance, aerospace, retail, automotive, healthcare, legal, and media.

According to a notification email regarding the supply-chain attack sent to customers, malicious upgrades were potentially downloaded by customers between April 20 and April 22.

“Initial analysis indicates that bad actor using sophisticated techniques had compromised the In-Place Upgrade functionality,” Click Studios told customers in an email with the “Confirmation of Malformed Files and Essential Course of Action” title.

“Any in-Place Upgrade performed between 20th April 8:33 PM UTC and 22nd April 0:30 AM UTC had the potential to download a malformed Passwordstate_ipgrade.zip [..] sourced from a download network not controlled by Click Studios,” the company added.

Also Read: How To Prevent WhatsApp Hack: 7 Best Practices

“The attackers crudely added a ‘Loader’ code section, just an extra 4KB from an older version” to Passwordstate’s original code, said J. A. Guerrero-Saade, SentinelOne Principal Threat Researcher.

“At a glance, the Loader has functionality to pull a next stage payload from the C2 above. There’s also code to parse the ‘PasswordState’ vault’s global settings (Proxy UserName/Password, etc).”

Malware harvested system info, Passworrdstate data

Once deployed, the malware would collect system information and Passwordstate data, which later gets sent to attacker-controlled servers.

The CDN servers used in the attack are no longer reachable as they were taken down since starting with April 22nd 7:00 AM UTC.

Click Studios advises customers who have upgraded their client during the breach to reset all passwords in their Passwordstate database.

It also recommends prioritizing the password reset as follows:

• all credentials for Internet-exposed systems (firewalls, VPN, external websites, etc.)
• all credentials for internal infrastructure
• all remaining credentials

The company also released a hotfix [ZIP] to help Passwordstate users remove the malware dubbed Moserpass by following instructions in the email notification linked above.

Indicators of compromise (IOCs) including a hash of the malicious loader and one of the command-and-control server addresses were shared earlier by cybersecurity firm CSIS Security Group A/S after analyzing one of the rogue DLL deployed in this supply-chain attack.

“ClickStudios mentioned more than 29000 prestigious customers worldwide,” CSIS Security Group said. “We assume this attack could have impacted a large numbers of these customers.”

Also Read: 15 Best Tools For Your Windows 10 Privacy Settings Setup

A Click Studios spokesperson was not available for comment when contacted by BleepingComputer earlier today. 
 

Update: Changed the malware’s name to Moserpass.