#Kaspersky password manager fixes easily bruteforced generator
#Kaspersky password manager fixes easily bruteforced password
#Kaspersky password manager fixes easily bruteforced free

#Kaspersky password manager fixes easily bruteforced generator

'Password generator was not completely cryptographically strong and potentially allowed an attacker to predict generated passwords in some cases,' read the alert. Kaspersky also published a security advisory detailing the flaw in April of 2021.

#Kaspersky password manager fixes easily bruteforced password

'It would also require the target to lower their password complexity settings.' 'This issue was only possible in the unlikely event that the attacker knew the user's account information and the exact time a password had been generated,' wrote a company spokesperson. When reached for comment, Kaspersky confirmed - but downplayed - the problem identified by Bédrune. 'All the passwords it created could be bruteforced in seconds,' writes Bédrune.īédrune's team submitted the vulnerability to Kaspersky through HackerOne's bug bounty program in June of 2019, and Ledger's blog post says Kaspersky notified potentially affected users in October of 2020.

Knowing when the password was generated, even approximately, would therefore give a hacker vital information in an attempt to crack a victim's account.

While that sounds super technical, it essentially boils down to KPM using the time as the basis for its pseudo random number generator. Unfortunately, according to security researcher Jean-Baptiste Bédrune, a bad coding decision meant that the passwords it generated weren't truly random and as a result were relatively easy to brute force - a hacking technique using specialized tools to try hundreds of thousands (or millions) of password combinations in an attempt to guess the right one.īédrune, who is a security researcher for the cryptocurrency hard-wallet company Ledger, writes that when generating a supposedly random password, KPM used the current time as its 'single source of entropy.'

#Kaspersky password manager fixes easily bruteforced free

The Kaspersky Password Manager (KPM), a free tool used to generate and manage online passwords, has long been a popular alternative to the likes of LastPass or 1Password. Either ZDNet is falsely overstating the scope of a relatively minor problem or Kaspersky is straight lying about a horrific vulnerability.Password managers are a vital line of defense in the battle for internet security - which makes it all the more painful when they shit the bed. Bruteforcing them takes a few minutes.”īédrune added due to sites often showing account creation time, that would leave KPM users vulnerable to a bruteforce attack of around 100 possible passwords. “For example, there are 315619200 seconds between 20, so KPM could generate at most 315619200 passwords for a given charset. “The consequences are obviously bad: every password could be bruteforced,” he said. “It means every instance of Kaspersky Password Manager in the world will generate the exact same password at a given second,” Jean-Baptiste Bédrune said.īecause the program has an animation that takes longer than a second when a password is created, Bédrune said it could be why this issue was not discovered.

The big mistake made by KPM though was using the current system time in seconds as the seed into a Mersenne Twister pseudorandom number generator.

It would also require the target to lower their password complexity settings. This issue was only possible in the unlikely event that the attacker knew the user’s account information and the exact time a password had been generated. Kaspersky has fixed a security issue in Kaspersky Password Manager, which potentially allowed an attacker to find out passwords generated by the tool.