Access Management , Fraud Management & Cybercrime , Fraud Risk Management

Click Studios Hacked, Exposing Users' Passwords

Malware Installed in Update Mechanism Enabled Data Exfiltration
Click Studios Hacked, Exposing Users' Passwords
The Click Studios' Passwordstate user interface (Source: Click Studios)

Attackers implanted malware into Click Studios' Passwordstate password manager update process, potentially exposing 29,000 users to exfiltration of passwords and other data, the company reports.

See Also: Live Webinar | Taking the Challenges Out of Identity Security

In an incident management advisory issued Saturday, Australia-based Click Studios says any customer who performed an "in-place upgrade" for its password manager software between 8:33 p.m. UTC April 20 and 12:30 a.m. UTC April 22 may have downloaded the malware. The company, however, says those who upgraded outside this time frame should be safe from malware infection.

"Affected customers' password records may have been harvested," the company says.

The infiltration of malware into software updates is an ongoing threat. For example, the SolarWinds supply chain attack involved attackers inserting a Trojan into an update of the Orion network monitoring tool.

Click Studios did not respond to a request for additional information, but it says it will provide updates.

Data Removed

The malware installed in Click Studios' update director, if downloaded, could pull an account's username and password along with the computer name, the user's name, domain name, current process name, current process ID, all running processes' names and IDs, all running services' names, display name and status and Passwordstate instance's proxy server address, the company says.

In addition, the title, username, description, genericfield1, genericfield2, genericfield3, notes, URL and password located in Passwordstate's "instance's password table" may have been compromised by the malware unless the customer selected to encrypt the genericfields, the company says.

Click Studios says the attack vector is not known, although it says the attackers apparently did not take advantage of weak or stolen credentials.

"At this stage, the number of affected customers appears to be very low. However, this may change as more customers supply the requested information," the company says.

Click Studios has about 29,000 customers and is used by about 370,000 security and IT professionals worldwide.

The company did not say when attackers installed the malware in the Passwordstate upgrade director. But it says it took its first action in response to the attack on April 21 when it implemented its incident management plan and began an investigation. Once the company confirmed the malware infection, it informed its customers by email the following day, Click Studios says.

The Malicious ZIP File

When accessed by a user, the upgrade director points the "in-place upgrade" to the appropriate software version located on Click Studios' content distribution network. Anyone who accessed the upgrade system during the 28 hours between when the malware was put in place and when it was removed may have downloaded the malicious, the company says.

This .zip file was a modified moserware.secretsplitter.dll, with a size of 65KB. It subsequently downloaded an additional file named file from the attackers' CDN network, started a new background thread, converted the to a .NET assembly only stored in memory and began processing, Click Studios says.

"The process extracted information about the computer system and selected Passwordstate data, which was then posted to the bad actors' CDN network," the company says.

Remediation Steps

Click Studios advises its customers to scan their systems for clues to see if they downloaded the malicious .zip file. If the customer finds a 65KB moserware.secretsplitter.dll in their c:inetpubpasswordstatebin directory, then the system is likely infected, Click Studios reports.

If this file is found, Click Studios advises the customer to take the following steps:

  • Download the advised hotfix file;
  • Use PowerShell to confirm the checksum of the hotfix file matches the details supplied;
  • Stop the Passwordstate service and internet information server;
  • Extract the hotfix to the specified folder;
  • Restart the Passwordstate service and internet information server.

Once these steps are complete, Passwordstate users must reset all passwords contained within the tool as these may have been posted to the attackers' CDN network, the company says.

About the Author

Doug Olenick

Doug Olenick

Former News Editor, ISMG

Olenick has covered the cybersecurity and computer technology sectors for more than 25 years. Prior to his stint as ISMG as news editor, Olenick was online editor for SC Media, where he covered every aspect of the cybersecurity industry and managed the brand's online presence. Earlier, he worked at TWICE - This Week in Consumer Electronics - for 15 years. He also has contributed to, TheStreet and Mainstreet.

Around the Network

Our website uses cookies. Cookies enable us to provide the best experience possible and help us understand how visitors use our website. By browsing, you agree to our use of cookies.