The cybersecurity company’s password manager had been using a built-in auto-generator with a particularly glaring flaw. They’ve patched it, but any Kaspersky Password Manager users should change their previously generated passwords ASAP. Here’s what went wrong.
The Flaw
The password generator works to create passwords by following a set “policy,” with settings that include password length, uppercase letters, lowercase letters, digits, and a custom set of special characters. They can be customized, but the default policy is a 12-character password. Here’s how Ledger Donjon, head of security research at Jean-Baptiste Bédrune, explained it in a blog post: The reason people didn’t notice that every password generated in the same second was the exact same is because the interface has a one-second animation that it plays, ensuring no one can generate two passwords in the same second. But it’s a big flaw. Any hacker who knows the trick can brute force any password: The number of seconds in the day is finite, and a hacker can run through all 315,619,200 passwords tied to the seconds of the decade between 2010 and 2021 in just a few minutes. And, if an online account publicly displays the date that it was created on, a hacker will need to run even fewer potential passwords before cracking a Kaspersky password.
Secure Passwords Are Essential
Kaspersky was alerted to the issue, and has rolled out a fix. But every password that has already been generated by a vulnerable version of the software is still easily crackable — a bit of a nightmare for everyone who’s using the service specifically to ensure their passwords can’t be cracked. If you use Kaspersky’s password manager, change your passwords now. And if you’re in the market for a password manager that will keep your online activity private, we’ve reviewed all the top options in depth over here — none of which have run into trouble with tying their random number generators to an easily cracked algorithm.
