Cracking a Password Manager
An intriguing tale of penetrating the security of the RoboForm password manager to retrieve a cryptocurrency wallet password.
Grand and Bruno invested considerable time unraveling the RoboForm software version used by Michael in 2013. They discovered a major flaw in the pseudo-random number generator utilized for password creation in that particular version and subsequent iterations until 2015. The flaw rendered the random number generator less random. RoboForm made a critical mistake by linking the randomly generated passwords to the date and time settings on the user’s computer. It synchronized the computer’s date and time and then created predictable passwords according to that information. With knowledge of the date and time along with other parameters, one could predict any password that had been generated on a specific date and time in the past.
If Michael had awareness of the day or approximate timeframe in 2013 when he created the password, and the specific parameters he used during that process (e.g., password length, inclusion of different types of characters such as upper and lower case letters, numbers, and special characters), this would significantly reduce the number of possible password variations. By manipulating the RoboForm functionality responsible for verifying the computer’s date and time settings to go back in time to a day within the 2013 timeframe when Michael created his password, they were able to retrieve the passwords that had been generated on those dates in 2013.
Profile picture of Bruce Schneier taken by Joe MacInnis.
About Author
