Kaspersky recently addressed a security flaw in its Password Manager (KPM) for Windows, which was identified as CVE-2023-23349
A security vulnerability in Kaspersky Password Manager (KPM) for Windows recently caught attention. This flaw allowed a local user utilizing the KPM extension for Google Chrome to retrieve auto-filled credentials from a memory dump. To exploit this vulnerability, an attacker needed to deceive a user into visiting a login page with saved credentials, which the KPM extension would autofill. Subsequently, the attacker had to launch a malware module to steal these specific credentials.
This security flaw posed a serious risk to user information security. However, thanks to Kaspersky's swift response, the vulnerability was promptly addressed, and a new update was released to protect users.
Some recommended measures for KPM users include:
Check for Updates: Regularly update Kaspersky Password Manager and enable automatic updates to receive the latest security patches.
Exercise Caution: Be cautious of links and files from unknown sources. Always remain vigilant against phishing attempts and immediately change KPM passwords if any suspicious activity is detected.
Additional Security Layers: KPM users should utilize primary authentication methods as an additional security layer. This adds an extra step of security when accessing accounts.
Strong Passwords: Create strong, unique passwords with KPM and change them regularly.
Utilize Antivirus Software: Use Kaspersky's security products to protect your computer against malicious software.
Despite Kaspersky Password Manager's commitment to security and user privacy, it's important for users to also be cautious in safeguarding their security. Keeping up with updates and practicing mindful internet usage are important steps in enhancing online security.
Scenario
This security flaw could potentially compromise auto-filled credentials from a memory dump when the KPM extension for Google Chrome is utilized. Certain conditions were necessary for the successful exploitation of this vulnerability:
Attack Scenario: An attacker needed to deceive a user into accessing a login page with saved credentials, which the KPM extension would autofill.
Exploitation: The attacker then had to execute a malware module to extract these specific credentials from the memory dump.
References: