“For example, there are 315619200 seconds between 20, so KPM could generate at most 315619200 passwords for a given charset. “The consequences are obviously bad: every password could be bruteforced,” he said. “It means every instance of Kaspersky Password Manager in the world will generate the exact same password at a given second,” Jean-Baptiste Bédrune said.īecause the program has an animation that takes longer than a second when a password is created, Bédrune said it could be why this issue was not discovered. The big mistake made by KPM though was using the current system time in seconds as the seed into a Mersenne Twister pseudorandom number generator.

The main one was that the app used the time as a seed. ZDNet reports that there were two problems.

The flaws were present for passwords generated up to October 2019. To make the process of receiving updates easier, our home products support automatic updates.” We recommend that our users install the latest updates. The company has issued a fix to the product and has incorporated a mechanism that notifies users if a specific password generated by the tool could be vulnerable and needs changing. It would also require the target to lower their password complexity settings. This issue was only possible in the unlikely event that the attacker knew the user’s account information and the exact time a password had been generated. “Kaspersky has fixed a security issue in Kaspersky Password Manager, which potentially allowed an attacker to find out passwords generated by the tool.

Update: Kaspersky has shared an official statement on the flaws: A security researcher has discovered two flaws that could result in an attacker having to try as few as 100 passwords to find yours … If you’ve been using Kaspersky Password Manager (KPM) on your iPhone for a while, you may need to generate some new passwords.

Kaspersky manager