Security vulnerabilities and automated fixes for password hashing issues
1 post found
The Frida Android server used PBKDF2WithHmacSHA1And8BIT with only 128 iterations to derive secret keys for device attestation. This critically weak configuration made password brute-forcing trivial, allowing attackers who obtained the derived key to recover the original password in seconds. The fix upgraded to PBKDF2WithHmacSHA256 with 600,000 iterations, meeting modern cryptographic standards.