Neo23x0 / signature-base

YARA signature and IOC database for my scanners and tools
Other
2.49k stars 605 forks source link

Create vuln_keepass_brute_forceable.yar #269

Closed ruppde closed 1 year ago

ruppde commented 1 year ago

Detects KeePass .kdbx password stores, which could be brute forced to steal the credentials. With AES-KDF and less than 65536 iterations the cracking speed with a single GPU is 20k/s, for the old default of 6.000 iterations it's 200k/s. Best remediation is to change the key derivative function to Argon2d and delete all older versions of the .kdbx