New Tool Reveals Internet Passwords 140
wiredmikey writes "A new password cracking tool released today instantly reveals cached passwords to websites in Microsoft Internet Explorer, and mailbox and identity passwords in all versions of Microsoft Outlook Express, Outlook, Windows Mail, and Windows Live Mail."
Prettier Tool, Old Exploit (Score:5, Insightful)
When you click "remember my password" the browser stores it in a semi-obfuscated way. Yes, it encrypts it but it must also put the key it uses to encrypt your password on your hard drive somewhere. Since your browser is not also a rootkit, any application you run on your box can access everything your browser can write. Therefore you need only spend the time to figure out where the encryption key is being stored and what kind of encryption the browser is employing to encrypt your password. When your mail client or chat client are remembering your passwords, it's no different. We could have a lengthy debate about whether 'remember your password' should be allowed but apparently the majority of users are okay with it considering the convenience it grants them. If they use the same machine to surf malicious websites, this makes it easier for malware to steal the passwords than a complex keylogging system
A few simple lines of code later and you too can write your own command line password discovery tool. Slap a seksi user interface on that and apparently you can sell it for $49.
Re:Prettier Tool, Old Exploit (Score:5, Informative)
Re:Prettier Tool, Old Exploit (Score:5, Funny)
Re:Prettier Tool, Old Exploit (Score:5, Funny)
Re: (Score:2)
WTF? I have the same password on my atmosphere shield!
Re: (Score:1)
Thank you for pressing the self destruct button.
Re:Prettier Tool, Old Exploit (Score:5, Interesting)
Which is why I didn't belabor it, or introduce it out of context. I was pointing out that Firefox's scheme is only as secure as the master password you choose. The particular bad password I chose for the Spaceballs reference on the hope that it might get a chuckle or trigger a brief moment of pleasant nostalgia, forgetting that on /., every joke must be beaten to death and explained, rehashed, insulted, re-explained by someone who thinks the insult came due to unfamiliarity, etc., until all traces of humor vanish. Oh well...
Hmm... This is an old story, so this probably won't receive any mods, but I have no idea what I'd mod it if I were moderating. Flamebait/Insightful/Funny/Interesting/Off-topic maybe? Mods, if you can coordinate to apply each of those once, it would be awesome (and I'd end up with overall neutral Karma!). :-)
Re: (Score:2)
You keep going on and on about people going on and on about something. That's funny.
Re: (Score:1, Offtopic)
Re: (Score:2)
Mr. Balmer?
Re: (Score:3, Funny)
Re: (Score:1, Redundant)
If I enter mine, all you'll get is asterisks. Watch: *******
Re:Prettier Tool, Old Exploit (Score:5, Funny)
http://bash.org/?244321 [bash.org].
Re: (Score:1)
Re: (Score:2, Funny)
Re: (Score:1, Insightful)
And this is what Windows does. The CryptProtectData API uses a key that is itself encrypted with (data derived from) the user's password. So you can only access the cached passwords if the user is logged on or you know the password.
Is that supposed to be PRAISING that boneheaded scheme?
Re:Prettier Tool, Old Exploit (Score:4, Interesting)
Well, the Windows scheme only protects your password from malicious software if you never log in at all; once you're logged in any program can pull the passwords, even if you never load the browser. Firefox can only give up master password protected passwords if you launch the browser and provide the master password. And an extension exists to configure the Firefox password manager to "forget" the master password (which is never actually stored, but you know what I mean) after a few minutes, limiting the window of vulnerability further.
Beyond that, if you've got truly malicious software actively running on your computer at all times (not just some website that gets brief read access through an exploit), you're hosed no matter what. Even if you never use a password manager, they can read the password as you type it into the browser; it might take more time than decrypting a password store and forwarding the data in bulk, but it's just as effective over the long haul. It's a trade off between window of vulnerability, scale of breach, and hassle. No manager at all is a hassle (to remember all usernames and passwords), but it's the most secure, since you can only lose one password at a time, with narrow windows of vulnerability. Password managers mean the scale of breach potential increases (you can lose them all at once). Firefox with a master password narrows the window of vulnerability relative to IE, and the extension that re-locks the store narrows it further, at the cost of needing to remember and type the password store password.
I consider it a reasonable trade-off, given that I'm not going to remember the user name and password for every site I visit. Even if I wanted to use the same one everywhere (and I don't, because then one site breach means I lose everything), differing username and password requirements make that impossible, and frankly, my memory isn't good enough to track login info for fifty odd websites, including a dozen I visit only once or twice a year.
Re: (Score:2)
Re: (Score:2)
My girlfriend does it first thing after installing Firefox on every machine she's ever owned (and she's not particularly computer savvy; she's a
Re: (Score:2)
You could also look at LastPass - http://lastpass.com/ [lastpass.com] - which works very well across Windows/Mac/Linux, Firefox, Chrome, Safari, etc, and on many mobile phones as well. Quite well designed and mature, and can be used offline though it's a browser addon, and syncs your password data to/from the cloud automatically, but also supports export to various formats if the cloud goes away. Now has a feature to manage non-browser passwords as well.
Re: (Score:2)
12345? That's amazing! I've got the same combination on my luggage...
Re: (Score:2)
Using this a browser can store what it needs in a secure way. Access to each and every item is controlled by ACLs that you can tweak to your heart's content.
Re: (Score:2)
Apple offers the Keychain APIs for secure storage of identity items as well. Using this a browser can store what it needs in a secure way. Access to each and every item is controlled by ACLs that you can tweak to your heart's content.
And we all know that with the excellent security synergy between users and application developers, the result of having freely tweakable security settings that default to moderate strength inevitably tends towards most users finding their own optimal balance of security and convenience that never leaves anyone at significant risk.
What, you haven't noticed that? I'm SHOCKED!
Snark aside: YES, Apple provides a strong toolkit and default behaviors (in Safari and elsewhere) that set a reasonably secure norm
Re: (Score:2)
Which is why I like Seamonkey's ability to secure the password store with a password of its own so that you're not simply relying on security through obscurity.
Re: (Score:2, Informative)
Except the first time you want to access the password store in each session, you present your password that "unlocks" the password store, then THAT password is persisted for the remainder of the session. So, either way, if you visit a malicious website the chances are your password store is in a vulnerable state (the password store is open for business, and the password is available somewhere). In both the Seamonkey/Firefox and Microsoft cases, the password store is vulnerable once it's logged in. The on
Re: (Score:3, Informative)
Re: (Score:2, Insightful)
Not to mention that for the open source browsers you can probably just look to see where it stores those keys. This is not a knock against the system, or even the approach, but just an observation.
Assuming the tool is just using the associated "Remember my password" functionality, then this is a non-story and people could get it without the tool. Heck, in Firefox, and I believe Chrome, you can view your stored passwords in plain text using the built-in password manager.
Re: (Score:2)
Firefox doesn't even attempt to hide it: Preferences -> Security -> Saved Passwords -> Show Passwords.
Re: (Score:3, Informative)
If you assign a master password that changes for you a bit; it won't show them without you entering the master password, twice IIRC.
Re: (Score:1, Interesting)
Perhaps this needs a rethink on filesystem security?
I'm thinking a desktop OS wherein each application is assigned a directory/folder on installation, and is only able to access its own folder a per user generic 'documents' folder, and a per user, application specific configuration folder. There'd be some costs to that - developers would have to compile against APIs and libraries rather than importing them in from the system at runtime. This would make individual programs larger and increase maintenance req
Re: (Score:2)
On OS X, the keychain is stored encrypted. When you log in, the keychain daemon runs and, if your keychain password matches your login password, decrypts the store into RAM. Individual passwords can only be accessed by other apps via RPC to this daemon. This RPC uses Mach ports, which allow the process on the other end to be identified. Access to individual passwords must be specifically granted (on a one-off or permanent basis) to apps, although any app can access all passwords that it created. If the
Re: Interface (Score:2)
I wanna see the Skeksi interface!
The Dark Crystal (1982)
http://www.imdb.com/title/tt0083791/plotsummary [imdb.com]
Re: (Score:2)
Re: (Score:1)
Re: (Score:1)
Slashvertisment if EVER I saw one. (Score:5, Interesting)
Check out http://www.nirsoft.net/utils/#password_utils [nirsoft.net] for password recovery tools, for free, that have been available for ages.
Re: (Score:2)
Re: (Score:2)
My point is valid and still stands. The tools I linked to are EXACTLY the same.
Re: (Score:2)
You definitely didn't RTFA, or understand the summary. It's a locally run program that reveals passwords for the sites you visit to the person who runs the program.
Re: (Score:1)
Nowhere in TFA it says anything about an expoit that reveals your password to a website you visit. It mentions that it reveals passwords that are cached. From the FTA:
The password breaker gives users the ability to instantly retrieve the login and password information to a variety of resources such as those routinely cached by Web browsers. The tool can quickly recover cached logins and passwords to Web sites, including pre-filled forms and auto-complete information stored in the Internet Explorer cache. In addition, the tool makes it possible to instantly replace or reset IE Content Advisor passwords.
Re: (Score:2)
Re: (Score:1)
The OP is actually agreeing with you, dude. Read again.
I agree, this is nothing new. Nirsoft tools are great, I've been using them for ages. Time to make a donation.
Re: (Score:1)
This exploit reveals your passwords to a website that you visit (although I have not RTFA), which is a bit different.
The slashvertized tool does not send passwords to a website. It reveals passwords to you when you run the tool locally. This is not news.
At the risk of putting this company out of business here's a 'cracker' for passwords stored by most browsers [blogspot.com].
New? I don't think so. (Score:3, Funny)
vs OS X keychain? (Score:2)
Is it also $49 safe? Thanks
Depends (Score:3, Interesting)
Anything that just stores passwords for automatic login, and doesn't require any user interaction, is not secure from something like this. Reason is if a program, like say Thunderbird, can get your e-mail password to hand off to the server, well then another program can too. It is stored in some easily reversible form. However, if the program itself needs a password to access the password store, then it should be secure provided a good password is used. The reason is that it uses that password to encrypt th
Re: (Score:2)
The default keychain file is the login keychain, typically opened on login by the user's login password (although the password for this keychain can instead be different from a user’s login password, adding security at the expense of some convenience).
...
The keychain file(s) stores a variety of data fields including a title, URL, notes and password. Only the password is encrypted and it is encrypted with Triple DES.
Title is Inaccurate (Score:5, Informative)
Re: (Score:2)
Re: (Score:2)
Actually, to be honest, when I first saw the headline, I thought to myself, "When asked to stop revealing people's passwords, the tool put his oakleys on, popped his collar, and then nah "Nah, bro," before walking away.
No that is incorrect (Score:2)
Windows passwords are stored using non-reversible encryption be default. For Vista and 7, they are stored only using the HTLMv2 hash by default, which is extremely secure. For XP passwords under 14 characters it does store the LM has as well by default, which can generally be cracked with only a little effort as it is not secure.
What this tool does is reveal saved passwords in programs. That is not hard to do. Any password you save for a remote system must, by definition, be stored using some sort of revers
Bah... (Score:1)
Re: (Score:1)
Re: (Score:2)
No. Your saved browser passwords are only secure if the browser provides (properly implemented) password protection for the saved passwords.
i.e. The passwords are encrypted with a key, which is encrypted with a password that the browser requires you to enter before it will allow access to your saved passwords.
Heh (Score:5, Interesting)
This reminds me of a tool I used back in the day called "Revelation". You loaded it up, clicked on the "target" icon, then clicked on a password field that was blocked with asterisks instead of displaying the password. The "hidden" password would appear in the "Revelation" box, allowing you to see what it was.
This was how I discovered the password for our dial-up internet back when I was in middle school in the mid-90's. My mom entered the password, and usually waited until it connected...but one time she slipped up, and left before it connected. I hit "cancel", and sure enough the password was still there, just blocked by asterisks. Thanks to "Revelation", I got it and was able to log in during the middle of the night, chatting it up on Yahoo and working on my Angelfire web page.
Ah, memories...
Re: (Score:2, Funny)
wtf? I almost have the exact same story...
Re: (Score:1)
Re: (Score:2)
My mother went for the low-tech solution to keeping my brother and I off the internet when she wasn't around - taking the power cord to the PC with her.
Suffice to say, they don't call them kettle cords for nothing ;)
Re: (Score:2)
Re: (Score:2)
It's been a long time, but I'm 99.9% sure that was it!
Re: (Score:1)
What kind of mutant alien monster are you??
Re: (Score:3, Informative)
The kind who had found his step-dad's "collection", and didn't need crappy mid-90's Internet video for his fapping ;-)
Re: (Score:2)
This reminds me of a tool I used back in the day called "Revelation". You loaded it up, clicked on the "target" icon, then clicked on a password field that was blocked with asterisks instead of displaying the password. The "hidden" password would appear in the "Revelation" box, allowing you to see what it was.
In that version of Windows, a password edit control just had a password style set on it and you could effectively disable that with some simple Windows API calls. Worse, you could just WM_GETTEXT and get the password out in plaintext without changing the style.
Re: (Score:2)
That's an odd way to misspell "masturbating furiously".
Re: (Score:1)
Years ago I once lost the password for my dial-up internet, and it was easier to make a 'modem tap' to recover it than it was to dig into the binaries and extract the encrypted password from the dialup networking glop I used back then. I just soldered on a third 'listen only' tap connector on my modem cable and intercepted the password as it was sent out to the modem.
Re: (Score:2)
<code>
#include "stdafx.h"
int ReadOtherProcess (HWND hwnd, void *address, void *buf, unsigned len)
{
unsigned long pid;
HANDLE process;
GetWindowThreadProcessId ( hwnd, &pid );
process = OpenProcess (PROCESS_VM_OPERATION|PROCESS_VM_READ|
Sigh. (Score:5, Interesting)
This isn't anything like Cain & Abel or 1000+ other tools did before for OVER TEN FSCKING YEARS. If slashdot ever posts "news" from sites like securityweek again I might cancel my newsletter subscription. Tip: security knowledge comes from security related blogs/forums (ie. hackers), not "news" websites which place more product placement than news.
Requesting delete because that VB.NET tool doesn't deserve the bandwidth it will cost.
Re: (Score:2)
Tip: A large number of stories on Slashdot are product placement. It has been this way since, to my recollection, the series of stories on They Might be Giants. It was probably going on before that and I just didn't recognize. Those seemed like the first slashvertisements that made no real effort to disguise themselves.
Slashdot is good for its user submitted content. There are still some really good, really informative discussions going on involving people who really know the subjects, that can't be found a
Re: (Score:1)
Requesting delete because that VB.NET tool doesn't deserve the bandwidth it will cost.
In their defense, the core logic is written in C#.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Passwords (Score:3, Funny)
And it's for this reason that I write all my passwords down on the back of my hand.
I've already addressed the problem of them washing off by using using permanent marker. And not bathing.
Re: (Score:2)
Which is this? (Score:5, Insightful)
Is this an alert or an advert? ;)
Re: (Score:2)
An Adlert?
Re: (Score:2)
Ask your doctor if Adlert is right for you.
Nice. I appreciated that.
Well, ok (Score:1)
in Microsoft Internet Explorer, mailbox and identity passwords in all versions of Microsoft Outlook Express, Outlook, Windows Mail and Windows Live Mail."
...But how does this effect me?
Re: (Score:2)
That would be an interesting question, if you didn't actually mean affect.
Re: (Score:3, Funny)
I think it effected his post.
Solve the problem (Score:2)
Re:Solve the problem (Score:5, Funny)
Firefox password security (Score:4, Informative)
Firefox offers an option to use a [user-supplied] master password to encrypt/decrypt password data. If a Firefox user enables that functionality, then Firefox would not [by my guess] be vulnerable to an exploit strategy such as the one employed by this cracking product (which relies on rule-based keys instead of a user-supplied key). Firefox passwords may, however, be vulnerable to other cracking strategies.
Here are some more details about how Firefox stores passwords. [luxsci.com]
Site seems to be down (Score:1)
I'm glad they finally figured this out. (Score:4, Funny)
Re: (Score:1)
I was beginning to think IE cache was unbreakable...
How does one break something that is already broken? Naw, just kidding.
Shocked (Score:1, Troll)
I am shocked, shocked to find a security flaw in Microsoft Internet Explorer.
New Tool Reveals Internet Passwords (Score:1)
all your password belong to us
PR (Score:1)
and it doesnt work with LINUX?!?!?! (Score:1)
I am outraged! Why doesn't this work on Linux?
Its always the same... people think that FOSS is not that important blablabla...
</tong-in-cheek>
"Remember my password" is inherently insecure. (Score:2)
Any "remember my password" feature in any app is inherently insecure.
Whenever I write such a feature, I encrypt the saved password, but I understand that this will only defeat wannabe crackers whose level of sophistication is limited to running strings on cache files. Any cracker worth their salt will reverse-engineer the encryption used by the app.
It's for this reason that I never enable "remember my password" where important passwords are involved.
1995 wants its news back (Score:2)
Yawn. LSA secrets aren't particularly.
Why not write stories about those who build things rather than give valuable Slashdot electrons to breaking stuff? Boring.
My wife needs a tool like this. (Score:2)