PC Wizard and its able to detect passwords?

martin57

Hi all,

I download pc wizard, was recommended on a computer mag and its a great program for showing up all your system info, got it from the developers website.

http://www.cpuid.com/softwares/pc-wizard.html

Seems a perfectly legit program but one little thing bothered me, it can even detect passwords on your pc such as yout hotamil account password and your router passwrods.

Would any of you be concerned about this as otherwise it seems a great program giving all kinds of info about your computer system?

thanks
Martin57

fwor

In what way would it concern you?

If you bear in mind that you have downloaded a program from the internet and allowed it to run with unrestricted privileges on your computer, you have to accept that it can do pretty much anything the developers want to, whether you like it or not.

Instead of telling you about passwords, the developers could equally well have decided to send copies of your user names and passwords to a remote website and you would (probably) be none the wiser.

As you've already run the software, you have already accepted that it is trustworthy (or at least you have accepted that you are prepared to run the risk that it is not).

For the record, I've used PC Wizard many times, but I did do a fair bit of research before I used it for the first time.

asbokid

martin57 wrote: »

Hi all,

I download pc wizard, was recommended on a computer mag and its a great program for showing up all your system info, got it from the developers website.

http://www.cpuid.com/softwares/pc-wizard.html

Seems a perfectly legit program but one little thing bothered me, it can even detect passwords on your pc such as yout hotamil account password and your router passwrods.

Would any of you be concerned about this as otherwise it seems a great program giving all kinds of info about your computer system?

thanks
Martin57

Where are the passwords stored? are they stored in cleartext, or did you grant the application access to the cleartext?

martin57

Thanks for replies and advice . Before I installed it I did do a google search for reviews of pc wizard and came up with the following,

http://download.cnet.com/PC-Wizard-2010/3000-2094_4-10793737.html

I am usually very careful about what I install on the computer but nevertheless I was very surprised when I pressed the password section on pc wizard and it came up with the right passwords for hotmail and my router.

Zone alarm asked for permission to access the trusted zone and I granted it. It seems to be a very good program but just a little shocked about the password thing. The passwords are stored on the configuaration section of pc wizard with a lot of other items. You press the little key there and your passwords appear.

martin57

closed

If you let IE save passwords, any program can lift them with the right code, in the same way that IE does.

GunJack

it's like a super-charged version of the old favorite cpu-z, and as such an alternative to speccy and SIW.

poppy10_2

martin57 wrote: »

I am usually very careful about what I install on the computer but nevertheless I was very surprised when I pressed the password section on pc wizard and it came up with the right passwords for hotmail and my router.

Why are you so surprised? The passwords are stored on your computer. You installed this program on your computer and allowed it admin privileges so it could access all the data on your computer. And then it showed you the passwords. Where's the big shock?
There are similar utilities available for Google Chrome and Firefox. The passwords are stored on your computer, any program with local access and admin privileges can access the data.

As a side note, if you are worried about security at all, you shouldn't be using Internet Explorer, let alone allowing it save your passwords.

asbokid

martin57 wrote: »

Thanks for replies and advice . Before I installed it I did do a google search for reviews of pc wizard and came up with the following,

http://download.cnet.com/PC-Wizard-2010/3000-2094_4-10793737.html

I am usually very careful about what I install on the computer but nevertheless I was very surprised when I pressed the password section on pc wizard and it came up with the right passwords for hotmail and my router.

Zone alarm asked for permission to access the trusted zone and I granted it. It seems to be a very good program but just a little shocked about the password thing. The passwords are stored on the configuaration section of pc wizard with a lot of other items. You press the little key there and your passwords appear.

martin57

You shouldn't be blaming PC Wizard. It has simply shown you the weaknesses in your system. If anything, your vent should be directed at the application developers (e.g. micro$oft and the mozilla and chrome teams) who can't be bothered to encrypt your passwords properly. There's no excuse for that.

No surprise that Microsoft has completely messed up the cryptosystem for Windows. Remember the "_NSAKEY" scandal? Google it.. Microsoft scoffed, sniggered and dismissed critics as "conspiracy theorists" - which is the time-worn parlance of all corporations and governments who have been caught with their pants down.

So never mind the crypto-weakness in browser applications, the Microsoft Windows user account passwords aren't adequately protected either..

Windows NT uses two algorithms: LM which is based on a simple DES encryption, and NT, based upon the MD4 hashing function.

LM as the weaker and vulnerable one, is not supported by default by the latest Windows Vista and Windows 7; however, you can still enable it. Cracking the majority of such passwords normally takes just a few minutes.

The NT hash is free from the disadvantages, common to the LM hash. But the current trend of increasing the computing power of modern computers, especially when using GPU, possibly, will make this standard too vulnerable to potential attackers.

MD4 hashes are readily crackable in minutes/hours using nothing more than brute force. There is an algorithm (SL3) used by Nokia that relies on a cryptographic hash to sim lock its latest phones. Hackers have invested tens of thousands of bucks building GPGPU-based hash collision systems to be able to unlock those phones. Using exactly the same parallel processing hardware, cracking Windows passwords is childsplay.

Pictured below is a real-life password cracking system in India. The cluster consists of the latest dual GPGPU AMD Radeon HD 5970 cores.

There are 208 GPUs in total.. 26 machines, dual GPU core PCIe cards with 4 cards in each of machine ($600 for each card). They are cracking SHA-1 hashes to unlock those Nokia phones. That's just the parallel processing power that cash-strapped phone hackers can afford. Imagine what an intelligence agency+compliant corporation can buy!

http://blog.zorinaq.com/