If you’ve been using Kaspersky Password Manager (KPM) on your iPhone for a while, you may need to generate some new passwords. A security researcher has discovered two flaws that could result in an attacker having to try as few as 100 passwords to find yours …
The flaws were present for passwords generated up to October 2019.
ZDNet reports that there were two problems. The main one was that the app used the time as a seed.
The big mistake made by KPM though was using the current system time in seconds as the seed into a Mersenne Twister pseudorandom number generator.
“It means every instance of Kaspersky Password Manager in the world will generate the exact same password at a given second,” Jean-Baptiste Bédrune said.
Because the program has an animation that takes longer than a second when a password is created, Bédrune said it could be why this issue was not discovered.
“The consequences are obviously bad: every password could be bruteforced,” he said.
“For example, there are 315619200 seconds between 2010 and 2021, so KPM could generate at most 315619200 passwords for a given charset. Bruteforcing them takes a few minutes.”
Bédrune added due to sites often showing account creation time, that would leave KPM users vulnerable to a bruteforce attack of around 100 possible passwords.
(Ironically, a bug in the code ended up introducing an additional variable that mitigated the problem in some cases.)
A second flaw was less likely to be an issue in practice, as it only helped an attacker who knew you used KPM. To defeat dictionary attacks, KPM generated passwords that use letter groupings not found in words – like qz or zr. The problem is, if an attacker knows you use KPM, they can instead mount a brute-force attack with these combinations, which can actually take less time than a standard dictionary attack.
Kaspersky has acknowledged the problems, and said that new logic is now applied. But if you were using KPM before October 2019, you’ll want to change your passwords.
FTC: We use income earning auto affiliate links. More.
