1Password urges Mac users to patch now to avoid having their data stolen

News
By published

1Password flaw could leave vaults exposed

1Password
(Image credit: 1Password)

1Password, one of the best password managers around right now, has urged Mac users to download a patch for their credential storage after a bug was discovered that allows attackers to crack open vaults.

1Password allows users to create password vaults within the app to separate their credentials between work and personal life for example.

Latest Videos From

Cracking the vault

The flaw was discovered by security teams from Robinhood, who decided to test the 1Password app for vulnerabilities. Specifically, the National Vulnerability Database describes the flaw as allowing “local attackers to exfiltrate vault items because XPC inter-process communication validation is insufficient.”

In an advisory, the company stated, “To exploit the issue, an attacker must run malicious software on a computer specifically targeting 1Password for Mac. An attacker is able to misuse missing macOS-specific inter-process validations to hijack or impersonate a trusted 1Password integration such as the 1Password browser extension or CLI.”

“This would permit the malicious software to exfiltrate vault items, as well as obtain derived values used to sign in to 1Password, specifically the account unlock key and “SRP-𝑥”.”

The only way to exploit this flaw, an attacker would have to trick the users into installing a custom made program on the target machine, but so far there is no evidence that this has been done in the wild.

1Password states that around 150,000 businesses rely on 1Password to store important credentials, but it is unclear how many of these use macOS devices. Windows users are not affected by this vulnerability.

More from TechRadar Pro

Benedict Collins
Benedict Collins
Senior Writer, Security

Benedict is a Senior Security Writer at TechRadar Pro, where he has specialized in covering the intersection of geopolitics, cyber-warfare, and business security.

Benedict provides detailed analysis on state-sponsored threat actors, APT groups, and the protection of critical national infrastructure, with his reporting bridging the gap between technical threat intelligence and B2B security strategy.

Benedict holds an MA (Distinction) in Security, Intelligence, and Diplomacy from the University of Buckingham Centre for Security and Intelligence Studies (BUCSIS), with his specialization providing him with a robust academic framework for deconstructing complex international conflicts and intelligence operations, and the ability to translate intricate security data into actionable insights.