Click Studios, the Australian software company behind the Passwordstate password management application, has notified customers to reset their passwords following a software supply chain attack.
The Adelaide-based firm said a bad actor used sophisticated techniques to compromise the software’s update mechanism and used it to drop malware on user computers.
The breach is said to have occurred between April 20, 8:33 PM UTC, and April 22, 0:30 AM UTC, for a total period of about 28 hours.
“Only customers that performed In-Place Upgrades between the times stated above are believed to be affected,” the company said in an advisory. “Manual Upgrades of Passwordstate are not compromised. Affected customers password records may have been harvested.”
The development was first reported by the Polish tech news site Niebezpiecznik. It’s not immediately clear who the attackers are or how they compromised the password manager’s update feature. Click Studios said an investigation into the incident is ongoing but noted “the number of affected customers appears to be very low.”
Passwordstate is an on-premise web-based solution used for enterprise password management, enabling businesses to…
http://feedproxy.google.com/~r/TheHackersNews/~3/N8mi3pz9fwc/passwordstate-password-manager-update.html