Kaspersky Password Manager's random password generator was about as random as your wall clock
- Reference: 1625604577
- News link: https://www.theregister.co.uk/2021/07/06/kaspersky_password_manager/
- Source link:
In March 2019, security biz Kaspersky Lab [1]shipped an update to KPM, promising that the application could identify weak passwords and generate strong replacements. Three months later, a team from security consultancy Donjon found that KPM didn't manage either task particularly well – the software used a pseudo-random number generator (PRNG) that was insufficiently random to create strong passwords.
From that time until the last few months of 2020, KPM was suggesting passwords that could be easily cracked, without flagging the weak passwords for users.
I was going to laugh off this Kaspersky password manager bug, but it is *amazing*. In the sense that I’ve never seen so many broken things in one simple piece of code. [2]https://t.co/OYn7pJUm7z — Matthew Green (@matthew_d_green) [3]July 6, 2021
"The password generator included in Kaspersky Password Manager had several problems," the Donjon research team explained in a [4]blog post on Tuesday.
"The most critical one is that it used a PRNG not suited for cryptographic purposes. Its single source of entropy was the current time. All the passwords it created could be bruteforced in seconds."
[5]
Using the current system time as the random seed value, Donjon explains, means that KPM will generate identical passwords at any given time anywhere in the world. But KPM's interface includes a one-second animation of rapidly shifting random characters that obscures the moment the actual password gets generated. This made the problem harder to spot.
[6]
[7]
Nonetheless, the lack of randomness meant that for any given password character set, the possible passwords created over time are limited enough they can be brute-forced in a few minutes. And if the creation time of an account is known – something commonly displayed in online forums, according to Donjon – that range of possibilities becomes much smaller and reduces the time required for bruteforce attacks to a matter of seconds.
"The consequences are obviously bad: every password could be bruteforced," the Donjon team wrote. "For example, there are 315619200 seconds between 2010 and 2021, so KPM could generate at most 315619200 passwords for a given charset. Bruteforcing them takes a few minutes."
[8]Titan-ic disaster: Bluetooth blunder sinks Google's 2FA keys, free replacements offered
[9]Dear Planet Earth: Patch Webmin now – zero-day exploit emerges for potential hijack hole in server control panel
[10]Pull your Western Digital My Book Live NAS off the internet now if you value your files
[11]With WPA3, Wi-Fi will be secure this time, really, wireless bods promise
A series of fixes – because the initial Windows patch didn't work properly – were rolled out to the web, Windows, Android, and iOS between October and December 2019. And in October 2020, Kaspersky released KPM 9.0.2 Patch M, which included a notification to users that certain weak passwords need to be regenerated.
The issue was assigned CVE-2020-27020 and Kaspersky published [12]an advisory in April, 2021.
[13]
"Kaspersky has fixed a security issue in Kaspersky Password Manager, which potentially allowed an attacker to find out passwords generated by the tool," a company spokesperson said in an email to The Register .
"This issue was only possible in the unlikely event that the attacker knew the user’s account information and the exact time a password had been generated. It would also require the target to lower their password complexity settings."
The company's spokesperson advised that all users install the applicable updates. ®
Get our [14]Tech Resources
[1] https://www.kaspersky.com/about/press-releases/2019_kaspersky-password-manager
[2] https://t.co/OYn7pJUm7z
[3] https://twitter.com/matthew_d_green/status/1412411435842519049?ref_src=twsrc%5Etfw
[4] https://donjon.ledger.com/kaspersky-password-manager/
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YOTSb5dzqVGDJ3mpwPtXlAAAANA&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YOTSb5dzqVGDJ3mpwPtXlAAAANA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YOTSb5dzqVGDJ3mpwPtXlAAAANA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2019/05/15/google_titan_bluetooth_key_security_flaw/
[9] https://www.theregister.com/2019/08/19/webmin_project_zero_day_patch/
[10] https://www.theregister.com/2021/06/25/western_digital_nas_wiped/
[11] https://www.theregister.com/2018/01/09/wi_fi_wpa3/
[12] https://support.kaspersky.com/general/vulnerability.aspx?el=12430#270421
[13] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YOTSb5dzqVGDJ3mpwPtXlAAAANA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[14] https://whitepapers.theregister.com/
Re: If you value your security get a hardware random number generator -- or two
"I'm actually surprised that we don't have them built into the architecture of every computer..."
We do. amd64 has RDRAND. Arm implementations with TrustZone have a TRNG built in. There are other implementations as well. Many have even been "independently audited".
"given the systematic weakening of encryption (the "accidental" choice of weak elliptic curve parameters in sample code, for example) without a lot of testing we'd neer know if the thing hadn't been compromsed either in the design or somewhere in the firmware."
Firmware isn't in play here. Microcode would be, in many implementations. But this is exactly why no one trusts this type of implementation: it's too easy for malicious actors to alter just one thing and compromise millions of machines, and the semiconductor manufacturers' insistence on secrecy makes the delivered implementation unauditable. Especially if the implementer is Intel who most people reasonably believe accommodate NSA backdoor requests. Your "TrueRNG" could easily have similar weaknesses; even if the onboard entropy source is truly random, the commodity microcontroller presenting the USB interface could easily be vulnerable in any number of ways. Unfortunately, short of building things yourself, by hand, from discrete transistors, there's really no way to trust something for this purpose.
Re: If you value your security get a hardware random number generator -- or two
Why do you trust trust TrueRNG? How can I trust your reply?
I don't understand
How do brute force password crackers work?
If I get my phone password wrong a few times it takes a photo of me and wipes itself. Other systems typically lock after a few goes.
Is it that some systems just let you keep trying.
What am I missing?
Re: I don't understand
In the case of your phone, the simplest way to brute force it would be to make a bit-accurate copy of the encrypted data, put it in a VM and apply as many password variants as needed to crack it.
More advanced phones may have a trusted cryptography module built in which complicates the above process, but in essence these can still be cracked; it just takes a bit more time.
If you value your security get a hardware random number generator -- or two
Although the RNG algoritm used in our computers is, well, pretty random its really not secure for situations where you really need it to be secure -- at best its going to be some kind of pseudo random number generator seeded with some number derived from a source like the time between two keypresses (or just the time).
Quite respectable hardware random number generators are cheap, the one I have ("TrueRNG") cost about $50 and is a USB dongle. They work on a well known principle -- differencing two random noise streams (I beleive it was the mechanism used in the original ERNIE). I'm actually surprised that we don't have them built into the architecture of every computer but then given the systematic weakening of encryption (the "accidental" choice of weak elliptic curve parameters in sample code, for example) without a lot of testing we'd neer know if the thing hadn't been compromsed either in the design or somewhere in the firmware.