bassrest.blogg.se

1. Kaspersky password manager flaw generated bruteforced how to#
2. Kaspersky password manager flaw generated bruteforced generator#
3. Kaspersky password manager flaw generated bruteforced full#

I call it “magic pixie dust thinking” and you would be surprised just how much of it there is. The hash might give you a 256bit string output… But you are only ever going to get the same eight 256bit strings… So no more secure at the output than at the input at all. So imagine your input is one of the first eight letters of the alphabet or digits. The way most hashes and crypto functions used to do a similar job are used they are in fact nothing more than “simple substitution ciphers”… For some reason I’ve never been able to get to the bottom of there is “magic thinking” about hash/crypto algorithms some how generating “entropy” they don’t and can not by definition even though they can up complexity. I’ve seen so much of this nonsense I actually think that the ICTsec industry is facing an existential threat, because it does not learn from past mistakes, just relives them over and over and over. Nobody then actually checks and several years later…Ĭall it a failure of the “creative commons” or “Cut-n-Paste coding”… The intern not having a clue looks up the problem on the Internet and “Cuts-n-Pastes” some example from someone who is equally as cluless.

Kaspersky password manager flaw generated bruteforced full#

The internet is full of such “pearls of wisdom”, and if you do not know any better, which obviously many don’t… You end up with “Blaim the Intern Syndrome”, where what someone who should know better but obviously does not gives what they think is a simple task to the “summer intern”. See the fatal assumption with the last one using MD5? Now look and see how many of the examples use “Date”? It’s only a little over a year and a half old so you would think should be fairly uptodate security wise, and know about “known security faults” going back to the late 1970’s if not further right?…

Just hours apart, I find out about similar defects in two different passcode generators. I must occasionally patch-up my PW generating script for the silliness du jour… Of course, not all sites have identical password requirements, and a password generated for one may not work for the other. (lower and upper case, number, special character, a rune, and two symbols from the Cabal). I recently tried to register for a certain site, and was appalled to discover that some wise-ass programmer managed to disable copy-and-paste and browser-supplied password managers, while still insisting on “complicated” patterns, which must therefore be entered by hand. I would have added a few bits of “entropy” to the seed (which would only have to be guessed once for a given user), increasing the search space, while still making an informed brute-force approach entirely manageable.Īll major OSes provide (semi-)decent RNGs (*nix: /dev/random Win: CryptGenRandom, Android: SecureRandom, etc., etc.), which even though they require some leap of faith in trusting their suppliers, are certainly a far cry from using TOD in seconds as a seed. Tags: Password Safe, passwords, random numbers, vulnerabilitiesĪpplying Hanlon’s razor (“never attribute to malice that which is adequately explained by stupidity”), I would rule out a backdoor, as identical passwords would be generated for different users.Ī properly implemented backdoor wouldn’t be as obvious and weak as this one. I also recommend my own password manager: Password Safe.ĮDITED TO ADD: Commentary from Matthew Green. More generally: generating random numbers is hard. Stupid programming mistake, or intentional backdoor? We don’t know. The product has been updated and its newest versions aren’t affected by this issue. It also provides a proof of concept to test if your version is vulnerable.

Kaspersky password manager flaw generated bruteforced how to#

This article explains how to securely generate passwords, why Kaspersky Password Manager failed, and how to exploit this flaw. All the passwords it created could be bruteforced in seconds.

Its single source of entropy was the current time. The most critical one is that it used a PRNG not suited for cryptographic purposes.

Kaspersky password manager flaw generated bruteforced generator#

The password generator included in Kaspersky Password Manager had several problems. Vulnerability in the Kaspersky Password ManagerĪ vulnerability (just patched) in the random number generator used in the Kaspersky Password Manager resulted in easily guessable passwords: