LastPass notifies users of yet another data breach
LastPass users are once again being warned about stolen personal data, though this time the breach happened through one of the company’s outside partners. Here are the details.
…
The information accessed was limited to standard business contact information and related customer relationship management (CRM) data, including customer names, phone numbers, email addresses, and physical addresses, as well as support case data and sales-related data.
So not a password leak it seems, but still, another in a long line of reasons not to trust them with anything.
Passwork, a password vault company with ties to Russia, has been used by critical European enterprises and government agencies, posing cybersecurity risks.
…
“Developed in Europe, with full GDPR and NIS2 compliance and data sovereignty,” the website reads.
In reality, however, Passwork was developed in Russia in 2014, and the company was transferred to Spain following Russia’s invasion of Ukraine.
However, the Russian software version is still available in the country, where it is used by major state-owned enterprises, such as energy giants Gazprom and Transneft.
The Russian Ministry of Defense and the Federal Security Service (FSB) are also among Passwork’s users, the investigation finds.
Maby it’s a problem, maby it’s not, but getting bogged down with having to now find out was entirely avoidable.
DARKREADING.COM: AI agents can be weaponized against each other using prompt injections via a chain of flaws in Google’s open source Agent Development Kit (ADK) for Python, potentially disrupting the software supply chain and demonstrating yet another new attack vector introduced by the emerging technology.
Researchers from Pillar Security discovered the flaws, present in the ADK’s adk-python repository, which allowed a low-privileged, public-facing agent in a workflow to trigger commands that could be executed by a high-privileged one, according a report published on Aug. 4. This means that potentially malicious, untrusted text — such as a pull request or issue — could be performed by a trusted AI agent with repository privileges.
“Pillar Security researchers have identified the first practical, real-world case of agent-to-agent exploitation in a multi-agent system in a real production environment, a class of attack not seen in real production systems until now,” Dan Lisichkin, cybersecurity researcher for Pillar, wrote in the report this week.
Coldcold, a hardware bitcoin wallet used faulty random number generation on certain firmwares. The company thought that they had disabled micropython’s weak psuedo-RNG in favor of there own, but a coding oversight resulted in this being overridden. This has allowed hackers to brute force wallet seeds.
Note that migration to a new wallet has to be done carefully, as hackers are watching wallets for transactions, and will race to outbid the owner if the public mempool is used.
