Posted on 07/01/2010 2:02:19 PM PDT by Gomez
A Russian software company today released a password cracking tool that instantly reveals cached passwords to Web sites in Microsoft Internet Explorer, mailbox and identity passwords in all versions of Microsoft Outlook Express, Outlook, Windows Mail and Windows Live Mail.
Moscow based ElcomSoft, developer of the new password recovery tool, “Elcomsoft Internet Password Breaker,” says the product designed as tool to provide forensics, criminal investigators, security officers and government authorities with the ability to retrieve a variety of passwords stored on a PC.
With a price tag of just $49, it doesn’t seem as though investigators and government authorities are the real target market. These types of programs are by no means new, but this latest commercial software offering shows just how easily it is to gain access to such tools, even for non-technical users.
The password breaker gives users the ability to instantly retrieve the login and password information to a variety of resources such as those routinely cached by Web browsers. The tool can quickly recover cached logins and passwords to Web sites, including pre-filled forms and auto-complete information stored in the Internet Explorer cache. In addition, the tool makes it possible to instantly replace or reset IE Content Advisor passwords.
New features in Internet Explorer 7 and 8 include enhanced security for storing cached password information. The browsers encrypt the information with the URL of a Web site, making it impossible to access stored information without knowing the exact Web address of a resource. Elcomsoft Internet Password Breaker claims to work around this new security model by analyzing cached URL history and identifying Web sites last visited in order to retrieve login and password information stored for those Web sites.
The password cracking tool reveals passwords protecting access to email accounts, identities and Microsoft Outlook PST files. Supporting all versions of Microsoft Outlook, Outlook Express, Windows Mail and Windows Live Mail, Elcomsoft Internet Password Breaker can retrieve the original plain-text passwords protecting access to mail accounts, POP3, IMAP, SMTP and NNTP news passwords. In addition, Elcomsoft Internet Password Breaker reveals Microsoft Passport passwords stored by Windows Live Mail, user identity passwords, and passwords protecting PST files created by Microsoft Outlook up to version 2010.
Elcomsoft Internet Password Breaker automatically identifies all supported products and user identities, locates all available accounts and PST files, and reveals stored password information.
With tools like these available to the masses, individuals and enterprises need to further consider full disk encryption solutions and additional security measures.
for 50 dollars, all your passwords are belong to us ping
Moscow could have kept those 11 spies at home and just spent the $49 to get this software /s
Time to encrypt your hard drives.
Choose either a hardware or software encryption technique, but encrypt at your next chance.
So, what happens if you always delete/clear your cache?
And/or use a different browser, like say....Firefox?
Wonder how long the WH has had it?.
“Moscow could have kept those 11 spies at home and just spent the $49 to get this software”
The US has GM.
Russia has excess spies.
They are both primarily job programs.
If you use Firefox they don’t need to crack it, your passwords can be seen in clear text (Tools- options, security, stored passwords, show passwords). More fun still your passwords and other stored text (like say your CC numbers) are stored somewhere in your profile stuff, so anybody on the machine just has to copy the Mozilla folder from your Application Data and they’ve got all your magic conveniences.
I like FF a lot, but they actually have a pretty massive security hole.
And everyone told me I was paranoid! I have never used the internet for any on-line transactions. But then again, I have never used an ATM!
The FF problem isn’t an issue with the internet per se, somebody would have to access your machine. But it’s worth keeping in mind if you’re doing anything on a machine that isn’t yours (like at work).
>> And everyone told me I was paranoid! I have never used the internet for any on-line transactions.
Personally. I get around it by staying broke.
No money to spend, no money to steal... :-)
bfl
Great!
For those who are interested, there are two basic ways to encrypt your hard drive. The fastest, but more expensive, is through hardware encryption. This is most practically done with the purchase of a hard drive. Companies like Hitachi have encrypted hard drives for portable computers, but others make such drives that work in desktop systems, too. Examples of these are:
http://www.datalockerdrive.com/
http://www.seagate.com/www/en-us/products/self-encrypting-drives/
However, for most people, two basic options are available for quick, cheap use, but they slow down your system a bit. These hard drive software encryption options are TrueCrypt (an open source, well-respected, free for all package) and Microsoft’s Bitlocker (free with Vista and Windows 7 Ultimate).
Bitlocker would be the most transparent and likely easiest to implement, but only if you already have and Ultimate on your system (you could upgrade, of course, too). However, the vast majority of people think that TrueCrypt has the best, most thorough implementation for users, and it’s completely free.
More on these here:
TrueCrypt
http://www.truecrypt.org/
Microsoft’s Bitlocker
http://www.microsoft.com/whdc/system/platform/hwsecurity/default.mspx
Better not be calling me a liar. You can verify it yourself, make a new login on your machine, copy your Mozilla over from Application Data (which is a hidden folder by default, but we should all know about Windows’ “hidden” folders) to the new account, login to the machine with the new account, come to FR, and check out how you’re logged in just like it was your old Windows login.
We were getting a network shuffle at work, so everybody was getting new machine accounts, when I copied the folder I figured all I’d get was my bookmark list and various UI/ usability tweaks. I was pretty surprised to find it moved the keys to my FF universe, convenient so long as I’m the only one on the machine, scary if somebody else get’s in there.
How can that be if I store none on the computer? Second,, my online banking is done on a small laptop that is ONLY used for banking, even then, only as guest, not administrator. Never used for surfing or email,
i use ff and believe it or not my ebay acct was hacked
how do i fix this massive security hole in FF
any suggestions? changeing passwords is obviously not the answer
What are the odds that after loading this program, the only passwords lost are those of the users.
This probably isn’t how your e-bay got hacked, unless your e-bay info is on a machine somebody else can access. You can’t fix this hole though, short of not using FF, this is a basic design flaw in the product, all your stored data is somewhere in that folder and it’s not keyed to your Windows login so if it gets copied to another login (or machine, I’ve used this for machine and OS changes too, really it’s kind of handy in a scary way) then all the info goes across.
This is what you get when you pollute your computer with feeble Microsoft crapware. I’m happily 100% Microsoft-free.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.