CVE-2013-5114: 
LastPass vulnerability analysis and mitigation

CVE-2013-5114 affects LastPass Android application versions prior to 2.5.1. The vulnerability allows attackers to bypass the secure wipe feature of the application. This security issue was discovered and reported by security researcher Chris Riley, with the initial disclosure made in September 2013 (Security Blog).

The vulnerability exists due to improper implementation of the secure container feature in LastPass Android application. The issue stems from the android:allBackup being set to True in the AndroidManifest, allowing attackers to perform backup and restore operations via ADB on non-rooted devices with USB debugging enabled. By manipulating the reprompt_tries value in the backup configuration file, an attacker could bypass the 5 PIN attempts limit before wipe feature (Security Blog).

An attacker with physical access to an Android device running a vulnerable version of LastPass can bypass the secure wipe feature that's meant to protect sensitive data after multiple failed PIN attempts. This could allow unauthorized access to stored passwords and maintain persistent access to the victim's LastPass account until the master password is changed (Security Blog).

The vulnerability requires physical access to the device with USB debugging enabled. The attack can be executed within 30 seconds, allowing an attacker to backup the LastPass data, modify it, and restore it to bypass security features. The exploit has been demonstrated to work in real-world conditions (Security Blog).

Users should upgrade to LastPass Android version 2.5.1 or later, which addresses this vulnerability by disabling the allowBackup feature. Additionally, users should ensure USB debugging is disabled when not needed and maintain physical security of their devices (Security Blog).