Does 1.31.1.6733-bc0674160 Fix the Remote Code execution vulnerability that Lastpass's Developer saw

[geoffrothman]

Server Version#: 1.31.1.6733-bc0674160
Player Version#:

[BanzaiInstitute]

The story I saw implied Plex was responsible, saying that the LastPass developer also used it. If you have a link with more details, please share it. I’m not ready to crucify Plex yet.

[ChuckPa]

This is all I’m seeing:

LastPass: DevOps engineer hacked to steal password vault data in 2022 breach

Not sure where Plex is involved here but forwarded to security team.

[sfire38]

I think at this point it’s assumed he was hacked via his Plex server but there aren’t many details:

LastPass says employee’s home computer was hacked and corporate vault taken

[JohnAlex]

Plex Remote Code Execution Exploit used in Lastpass Breach?

https://arstechnica.com/information-technology/2023/02/lastpass-hackers-infected-employees-home-computer-and-stole-corporate-vault/ From the article "“This was accomplished by targeting the DevOps engineer’s home computer and exploiting a vulnerable third-party media software package, which enabled remote code execution capability and allowed the threat actor to implant keylogger malware,” “According to a person briefed on a private report from LastPass and spoke on the condition of anonymity,…

[ChuckPa]

@sfire38

I think at this point it’s assumed he was hacked via his Plex server but there aren’t many details:

Nothing shown to support that.

Please be very careful with assertions and assumptions. “ASSUME” is dangerous.

Makes an ASS of U and ME

From “Home Computer” to “Plex Server” is a bigger leap than I would take at this point.

[Gloppie]

This is where I first saw plex mentioned by name, but I’m not sleuthing this story…

I tried to point out buffer overflows in the past, and was not responded to.

[ChuckPa]

I remember this.

Interestingly, ArsTechnica heard from sources that the engineer’s computer was hacked through a vulnerability found in the Plex media platform. Twelve days after the LastPass attack, Plex confirmed that it had also suffered an attack that resulted in 15 million users’ passwords being stolen.

If you all remember correctly, that’s when operations

1. Made operations changes in the code and secured the vulnerability
2. Invalidated EVERYONE’s passwords
3. Made us all reclaim our servers again
4. Log in all our devices again

Is Plex the attack vector or another victim?

Let’s please be objective and not emotionally reactive.

[JohnAlex]

As mentioned in the duplicate thread on this topic though, the question is, is this a new event or the old one ?

I agree that this type of ‘news’ item (quoted below) needs to be approached with a high degree of scepticism especially as the source asked to be kept anonymous.

ArsTechnica heard from sources that the engineer’s computer was hacked through a vulnerability found in the Plex media platform.

[Gloppie]

Well, then how about an official response then about my email sent to security@plex.tv on 1/29/2022 about buffer overflows.

Might have less fuel for the boat if you can higher a well qualified security team.

[BigWheel]

Plex Remote Code Execution Exploit used in Lastpass Breach?

We have not been contacted by LastPass so we cannot speak to the specifics of their incident. We take security issues very seriously, and frequently work with external parties who report issues big or small using our guidelines and bug bounty program. When vulnerabilities are reported following responsible disclosure we address them swiftly and thoroughly, and we’ve never had a critical vulnerability published for which there wasn’t already a patched version released. And when we’ve had incident…

[Gloppie]

Were you responding to me? So, you didn’t get my email sent to security@plex.tv, or you were unable to send me mail? what? I don’t know if you’re comment on my thread hijacking @BigWheel , or… People can have more then one email address, right?

[BigWheel]

I have nothing to do with the security email box. I am only giving everyone in this topic a link to the information we have about the LP thing.

[Gloppie]

Can I pm you a message ID from my mail and you can contact security on my behalf for a response on why I was never contacted in my four mails to your company?

[BigWheel]

I can’t do anything about speeding up a response from them. I imagine they likely have received hundreds of emails about it and might just be taking a while to respond.

[Gloppie]

Date: Sat, 29 Jan 2022

Thats when I sent in my ignored bug bounty

[BigWheel]

You are welcome to message me but I make no promises I will be able to facilitate speeding up a response

[Gloppie]

a response from more then a year ago? ping @elan

[BigWheel]

@Gloppie I pinged some folks who said they would look into it.

[Gloppie]

I’ve still not received a response.