I wasn't specific about that. I should have said a full dump of their database.
Yes, if someone got into their supply chain, they could push a malicious update. That's also true of KeePass and every other password manager. There's no way to avoid that vector.
Re:LastPass: Notice of Security Incident
by woojoo666 on Thursday August 25, 2022 @09:57PM
(#32602486)
Are there any instances of this happening? I feel like it would be caught so fast it's not worth trying
Re:LastPass: Notice of Security Incident
by asoberbeck on Friday August 26, 2022 @12:13AM
(#32603284)
> As customers downloaded the update, they unwittingly pulled down and installed the backdoor at the same time. The malicious code was itself cleverly designed, would execute commands, and provided remote admin access. The hackers then used that foothold to create and cryptographically sign the necessary security tokens to hoodwink systems into believing subsequent access to other accounts and resources was legitimate.
This is a dangerous fallacy. Nothing fundamentally would prevent someone who attacked their infrastructure from pushing a malicious app update or a malicious extension update which exfiltrated the decrypted library from the client side.