guglhair.blogg.se

1. Kaspersky password manager problems cracked#
2. Kaspersky password manager problems generator#
3. Kaspersky password manager problems update#
4. Kaspersky password manager problems android#

Kaspersky password manager problems update#

In October 2020, Kaspersky Lab released KPM 9.0.2 Patch M, notifying users to update some weak passwords to stronger ones. This issue has been assigned the ID CVE-2020-27020, which the company reported on in an April 2021 post .

Kaspersky password manager problems android#

“The consequences were definitely bad: any password could be cracked. For example, between 20, 315619200 seconds have elapsed, so KPM can generate a maximum of 315619200 passwords for a given character set. It took only a few minutes to sort through them, ”says the Ledger Donjon report.īetween October and December 2019, the developers submitted a number of patches for KPM (since the original patch for Windows did not work correctly), and as a result, the problem was fixed on Windows, Android and iOS.

Kaspersky password manager problems cracked#

The time-based passwords were very limited and could be cracked in minutes, the researchers said. So, if the attacker knew the time of creating a specific account (which is not difficult at all to see on any forum), the range of probabilities was greatly reduced, as well as the time required for brute-force, which could take only a few seconds. Using the system time as a random seed meant that KPM generated the same passwords if users in different parts of the world clicked on the create password button at the same time and did not change the default settings. At the same time, the KPM interface displayed an animation of rapidly changing random characters, which hid the actual moment of password generation and made it difficult to identify the problem. The fact is that KPM was created to generate 12-digit passwords by default, although it allowed users to personalize their passwords by changing settings, including password length, uppercase and lowercase letters, numbers, and special characters. Researchers at Ledger Donjon say that by striving to create passwords that are as different as possible from passwords generated by the people themselves, the application has become predictable.

Kaspersky password manager problems generator#

“The password generator in Kaspersky Password Manager had several problems. Most critical was that he used a pseudo-random number generator that was unusable for cryptographic purposes. The only source of entropy in it was the current system time, and all the passwords that it created could be found in a matter of seconds, ”the experts say. Last year, the developers of Kaspersky Password Manager (KPM) asked users to update their passwords to stronger ones. Now the specialists of Ledger Donjon (the information security division of the Ledger company, which develops crypto wallets), talked about why this happened, and what problems they discovered in KPM some time ago.Įxperts remind that in March 2019, Kaspersky Lab released an update for KPM, promising that now the application will be able to identify weak passwords and generate more reliable replacements for them. Three months later, the Ledger Donjon team found that KPM was not doing very well with this, as it used a pseudo-random number generator that did not produce enough random results to generate strong passwords. In particular, the characters in the passwords were generated and placed in a not entirely random way.