Yara Rule - Keepass .kdbx 비밀번호 저장소를 감지하여 자격 증명을 훔치도록 강요 할 수 있습니다.AES-KDF 및 65536 미만의 반복을 사용하면 단일 GPU의 균열 속도는 20k/s이며, 기존 기본값은 6.000 반복의 경우 200k/s입니다.최상의 치료제는 주요 파생 함수를 Argon2d로 변경하고 .kdbx의 모든 이전 버전을 삭제하는 것입니다.
Yara 정의.
Yara Rule - Detects KeePass .kdbx password stores, which could be brute forced to steal the credentials. With AES-KDF and less than 65536 iterations the cracking speed with a single GPU is 20k/s, for the old default of 6.000 iterations it’s 200k/s. Best remediation is to change the key derivative function to Argon2d and delete all older versions of the .kdbx
Yara definition.
Author: Arnim Rupp (https://github.com/ruppde)
https://keepass.info/help/base/security.html#secdictprotect
date = "2023-07-20"
score = 60
$keepass_magic = { 03 D9 A2 9A 67 FB 4B B5 }```
[https://github.com/Neo23x0/signature-base/commit/0c875f03e6c49aa68da26786d93858eab0b1de12](https://github.com/Neo23x0/signature-base/commit/0c875f03e6c49aa68da26786d93858eab0b1de12)