Kaspersky Password Manager is a product that securely stores passwords and documents into an encrypted vault, protected by a password. Two years ago, we looked at Kaspersky Password Manager (KPM), a password manager developed by Kaspersky. The product has been updated and its newest versions aren’t affected by this issue.
It also provides a proof of concept to test if your version is vulnerable. This article explains how to securely generate passwords, why Kaspersky Password Manager failed, and how to exploit this flaw. All the passwords it created could be bruteforced in seconds. Its single source of entropy was the current time. The most critical one is that it used a PRNG not suited for cryptographic purposes. The password generator included in Kaspersky Password Manager had several problems.
0 kommentar(er)
