Apple App Store Security Fail: The Fake LastPass Story

Fake LastPass App on Apple App Store: How to Protect Your Credentials 
 
This episode discusses the recent discovery of a fake LastPass application, named "LassPass Password Manager", on the Apple App Store. The fraudulent app mimicked the branding and user interface of the real LastPass app. We'll explore how this fake app bypassed Apple's security review process, what you can do to avoid falling victim to similar scams, and the importance of app attestation. What Happened?

• A fake password management app called "LassPass Password Manager" appeared on the Apple App Store.
• The app was created by a developer named Parvati Patel.
• It imitated the original LastPass logo and user interface.
• The purpose of the app was likely to steal credentials, including ID numbers, passwords, and crypto seed phrases.
• The fake app was removed from the Apple App Store on February 8.

How Did This Happen?

• The fake app used a similar name and logo to the real LastPass app, with only minor differences that may have been enough to evade automated detection.
• The developer account appeared legitimate at first glance, but may have been compromised or used intentionally for malicious purposes.
• Manual review oversight: Misspellings and a mismatched developer name were overlooked.
• The app included a "PRO" subscription model.

How to Avoid Typosquatting and Fake Apps:

• Click the app URL on the original author’s website. LastPass has links to the original app on their website.
• Pay more attention to social proof. Look at metrics like date added, number of downloads, version history, and reviews.
• Check the app details. Look for typos, incomplete app descriptions, grammatical blunders, and the use of a business name as the app developer.

App Attestation as a Solution:

• App attestation validates the integrity and authenticity of individual applications.
• It verifies that the app's runtime environment hasn't been tampered with.
• Solutions like Approov issue cryptographic tokens to verified apps, ensuring only genuine apps can interact with backend APIs.
• App attestation offers a proactive approach to enhance mobile app security and protect APIs from being exploited by fraudulent apps.
• It can be integrated with platform-specific tools like iOS App Attest and Google Play Integrity.

Links:

• Galactic Advisors: https://www.galacticadvisors.com
• Fraudulent App: https://apps.apple.com/us/app/lasspass-password-manager/id6473945355
• Legitimate LastPass App: https://apps.apple.com/us/app/lastpass-password-manager/id324613447
• Approov: https://approov.io

Keywords: LastPass, fake app, Apple App Store, LassPass, password manager, security, typosquatting, phishing, app attestation, Approov, Parvati Patel, malware, mobile security, data theft, cyber security, credentials, API security.