{"id":40589,"date":"2021-04-24T10:36:25","date_gmt":"2021-04-24T10:36:25","guid":{"rendered":"http:\/\/304f286c-24cc-44b9-b037-ae5262d5da1a"},"modified":"2021-04-24T10:36:25","modified_gmt":"2021-04-24T10:36:25","slug":"enterprises-need-to-change-passwords-following-clickstudios-passwordstate-attack","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/enterprises-need-to-change-passwords-following-clickstudios-passwordstate-attack\/","title":{"rendered":"Enterprises need to change passwords following ClickStudios, Passwordstate attack"},"content":{"rendered":"

ClickStudios has told its global customer base to start changing passwords following a breach that resulted in a supply chain attack.<\/p>\n

The Australian software company, which makes the Passwordstate password manager, suffered a breach between April 20 and April 22. CSIS Security Group<\/a>, which dealt with the breach, posted the attack details. ClickStudios outlined the attack in an advisory.<\/a> The company said:<\/p>\n

\n

Initial analysis indicates that a bad actor using sophisticated techniques compromised the In-Place Upgrade functionality. The initial compromise was made to the upgrade director located on Click Studios website www.clickstudios.com.au. The upgrade director points the In-Place Upgrade to the appropriate version of software located on the Content Distribution Network. The compromise existed for approximately 28 hours before it was closed down. Only customers that performed In-Place Upgrades between the times stated above are believed to be affected. Manual Upgrades of Passwordstate are not compromised. Affected customers password records may have been harvested.  <\/p>\n<\/blockquote>\n

The supply chain attack was initiated via an update of the Passwordstate app.<\/p>\n

In a post, CSIS said its researchers found the attack during an investigation. “As recommended by ClickStudios, if you are using Passwordstate, please reset all the stored passwords, and especially VPNs, Firewall, Switches, local accounts or any server passwords etc,” said CSIS, which dubbed this incident\/malware “Moserpass”. <\/p>\n

ClickStudios’ letter to customers was posted on Twitter<\/a> via Polish news site Niebezpiecznik (via The Record<\/a>).<\/p>\n

Aside from the obvious hassle of changing enterprise passwords on Friday and the weekend, Passwordstate touches multiple key areas of a company including:<\/p>\n