07-08-2021 , 08:33 AM
https://www.securityweek.com/kaspersky-p...ute-forced Kaspersky Password Manager Generated Passwords That Could Quickly Be Brute-Forced
By Ionut Arghire on July 07, 2021 A vulnerability in the Kaspersky Password Manager resulted in the created passwords being weak enough to allow an attacker to brute-force them in seconds, a security researcher claims.
Developed by Russian security firm Kaspersky, the Kaspersky Password Manager (KPM) allows users not only to securely store passwords and documents, but also to generate passwords when needed.
All of the sensitive data stored in KPM’s vault is protected by a master password. The application is available for Windows, macOS, Android and iOS, and the sensitive data can also be accessed through the web.
The issue with the application, Ledger security researcher Jean-Baptiste Bédrune discovered roughly two years ago, was that its secure password generation mechanism was weak, allowing for created passwords to be brute-forced within seconds.
KPM was designed to generate 12-character passwords by default, but allows users to personalize their passwords by modifying settings in the KPM interface, such as password length, and the use of uppercase and lowercase letters, digits, and special characters.
The problem with KPM, Ledger’s researcher explains, is also what differentiated it from other password managers out there: in an attempt to create passwords that are as far away as possible from those generated by humans, the application became predictable.
The passwords appeared to have been created so as to prevent cracking from commonly used password crackers. The employed algorithm, however, allowed an attacker who knew that the passwords were generated using KPM to create the most probable passwords generated by the utility, Bédrune says.
“We can conclude that the generation algorithm in itself is not that bad: it will resist against standard tools. However, if an attacker knows a person uses KPM, he will be able to break his password much more easily than a fully random password,” the researcher says.
Tracked as CVE-2020-27020, the vulnerability is related to the use of a pseudorandom number generator (PRNG) that was not cryptographically secure. The desktop app used the Mersenne Twister PRNG, while the web version used the Math.random() function, none of which are suitable for generating cryptographically secure material.
What the researcher discovered was that the application would use the system time as the seed to generate every password, meaning that “every instance of Kaspersky Password Manager in the world will generate the exact same password at a given second.”
“The consequences are obviously bad: every password could be bruteforced. For example, there are 315619200 seconds between 2010 and 2021, so KPM could generate at most 315619200 passwords for a given charset. Bruteforcing them takes a few minutes,” Bédrune says.
Kaspersky started releasing patches in 2019, but it only published an advisory in April 2021.
“Password generator was not completely cryptographically strong and potentially allowed an attacker to predict generated passwords in some cases. An attacker would need to know some additional information (for example, time of password generation),” the company said in its advisory. “All public versions of Kaspersky Password Manager liable to this issue now have a new logic of password generation and a passwords update alert for cases when a generated password is probably not strong enough.”
Users are advised to update to Kaspersky Password Manager for Windows 9.0.2 Patch F, Kaspersky Password Manager for Android 9.2.14.872, and Kaspersky Password Manager for iOS 9.2.14.31 as soon as possible. The password manager also supports automatic updates.
By Ionut Arghire on July 07, 2021 A vulnerability in the Kaspersky Password Manager resulted in the created passwords being weak enough to allow an attacker to brute-force them in seconds, a security researcher claims.
Developed by Russian security firm Kaspersky, the Kaspersky Password Manager (KPM) allows users not only to securely store passwords and documents, but also to generate passwords when needed.
All of the sensitive data stored in KPM’s vault is protected by a master password. The application is available for Windows, macOS, Android and iOS, and the sensitive data can also be accessed through the web.
The issue with the application, Ledger security researcher Jean-Baptiste Bédrune discovered roughly two years ago, was that its secure password generation mechanism was weak, allowing for created passwords to be brute-forced within seconds.
KPM was designed to generate 12-character passwords by default, but allows users to personalize their passwords by modifying settings in the KPM interface, such as password length, and the use of uppercase and lowercase letters, digits, and special characters.
The problem with KPM, Ledger’s researcher explains, is also what differentiated it from other password managers out there: in an attempt to create passwords that are as far away as possible from those generated by humans, the application became predictable.
The passwords appeared to have been created so as to prevent cracking from commonly used password crackers. The employed algorithm, however, allowed an attacker who knew that the passwords were generated using KPM to create the most probable passwords generated by the utility, Bédrune says.
“We can conclude that the generation algorithm in itself is not that bad: it will resist against standard tools. However, if an attacker knows a person uses KPM, he will be able to break his password much more easily than a fully random password,” the researcher says.
Tracked as CVE-2020-27020, the vulnerability is related to the use of a pseudorandom number generator (PRNG) that was not cryptographically secure. The desktop app used the Mersenne Twister PRNG, while the web version used the Math.random() function, none of which are suitable for generating cryptographically secure material.
What the researcher discovered was that the application would use the system time as the seed to generate every password, meaning that “every instance of Kaspersky Password Manager in the world will generate the exact same password at a given second.”
“The consequences are obviously bad: every password could be bruteforced. For example, there are 315619200 seconds between 2010 and 2021, so KPM could generate at most 315619200 passwords for a given charset. Bruteforcing them takes a few minutes,” Bédrune says.
Kaspersky started releasing patches in 2019, but it only published an advisory in April 2021.
“Password generator was not completely cryptographically strong and potentially allowed an attacker to predict generated passwords in some cases. An attacker would need to know some additional information (for example, time of password generation),” the company said in its advisory. “All public versions of Kaspersky Password Manager liable to this issue now have a new logic of password generation and a passwords update alert for cases when a generated password is probably not strong enough.”
Users are advised to update to Kaspersky Password Manager for Windows 9.0.2 Patch F, Kaspersky Password Manager for Android 9.2.14.872, and Kaspersky Password Manager for iOS 9.2.14.31 as soon as possible. The password manager also supports automatic updates.