16

Is it possible that the swap file will contain chunks of data by a file you have accessed, and could this be detected during a forensics analysis?

How could you prevent this situation ?

Is using deep freeze or similar software a valid solution ?

6 Answers 6

11

Yes, swap files can contain sensitive data.

On Windows you can configure the page file (swap file) to be cleared at shutdown this way:

  1. Start regedit32.exe
  2. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management
  3. Set the data value of ClearPageFileAtShutdown to 1
  4. If the value does not exist, create it with the type REG_DWORD and set it to 1
  5. Restart

I don't know for sure if this is a secure deletion of the swap data, but from the fact that it adds minutes to the shutdown process and from the text on Microsoft page about ClearPageFileAtShutdown:

Some third-party programs can temporarily store unencrypted (plain-text) passwords or other sensitive information in memory. Although clearing the paging file is not a suitable substitute for physical security of a computer, you might want to do this to increase the security of data on a computer while Windows is not running. "

I would think the data is securely wiped.

On Linux you can manually wipe the swap partition:

  1. Display swap details: swapon -s
  2. Unmount the swap partition: swapoff -a
  3. Overwrite it with zeros: dd if=/dev/zero of=/dev/sdaX bs=1024
  4. Get the UUID of your old swap partition from /etc/fstab
  5. Create a new swap partition with that UUID: mkswap /dev/sdaX -U <old_uuid> 1024
  6. Mount it for usage: swapon -a

Better wiping tools are provided by the Secure-Delete package which comes with the following commands:

  • srm (Secure remove) – used for deleting files or directories currently on your hard disk.
  • smem (Secure memory wiper) – used to wipe traces of data from your computer’s memory (RAM).
  • sfill (Secure free space wiper) – used to wipe all traces of data from the free space on your disk.
  • sswap (Secure swap wiper) – used to wipe all traces of data from your swap partition.

Sswap is designed to delete data which may lie still on your swapspace in a secure manner which can not be recovered by thiefs, law enforcement or other threats.The wipe algorithm is based on the paper “Secure Deletion of Data from Magnetic and Solid-State Memory” presented at the 6th Usenix Security Symposium by Peter Gutmann, one of the leading civilian cryptographers.

7
  • 1
    asta cautam, mersi frumos :)
    – opc0de
    Jan 19, 2013 at 19:00
  • 3
    @ephrack Encrypt the swap space (which is a lot better than wiping it, since wiping doesn't work if the system is not shut down cleanly). Most distributions set this up automatically if you encrypt some data partitions during the initial system installation. Jan 21, 2013 at 18:12
  • 1
    Lets say I set up Debian with encrypted LVMs (standard setup) would that mean this is set up?
    – efr4k
    Jan 22, 2013 at 21:32
  • 1
    Is there a way to request that pages containing your secure data never be swapped out at all, though? Not for just generally sensitive data, but for the parts storing actual cryptographic keys and such. Mar 3, 2014 at 20:35
  • 2
    VirtualLock on Windows msdn.microsoft.com/en-us/library/aa366895%28VS.85%29.aspx Locks the specified region of the process's virtual address space into physical memory, ensuring that subsequent access to the region will not incur a page fault. mlock and family on Unix tutorialspoint.com/unix_system_calls/mlock.htm Mar 5, 2014 at 9:54
8

Is it possible that the swap file will contain chunks of data by a file you have accessed, and could this be detected during a forensics analysis?

Yes, it is. Moreover, you may be able to read some passwords, encryption keys and other sensitive/private data.

How could you prevent this situation ?

You can disallow memory swapping for particular virtual address space in a process by using some OS-specific calls:

Other modern operating systems will provide similar functionality. However, data is not generally removed from physical memory (such as RAM) when you shutdown your PC, and it still could be retrieved using a cold-boot attack.

3

If you're coding, many "unmanaged" languages support (require) the ability to delete dynamically-allocated memory. If you want to be really sure, you can usually also set the value of said memory to all zeroes, or to something not useful to an attacker (random data, "All work and no play...", etc).

In managed-memory runtimes such as the JVM or CLR, you do not have this control; the garbage collector checks whether the executing code still has any references to the object, and if not, it schedules it for collection. The marking process, and the resulting memory-freeing and heap-reorganization, happens when the runtime thinks it might be a good time to clean up, not when you know that something should get cleaned up. In these environments, there is usually a structure provided specifically to handle sensitive data.

In .NET, the primary type for these things is called SecureString, and it has several advantages over the basic System.String:

  • SecureString is mutable, unlike String which, though a reference type, is treated as immutable; every time a string variable is assigned to, a new String objectis created on the heap, meaning that when you're working with sensitive data, many dfferent copies of said data may exist on the heap at once. SecureString handles all manipulations of itself within a single memory space on the heap.
  • The data kept in the SecureString is encrypted at all times, so even if it is left lying around, the attacker would also need access to the key container stored in protected unmanaged memory.
  • The object is derived from a basic class family that identifies it as having a "critical finalizer"; as long as the CLR has a say in the matter, the finalizer, which in SecureString's case removes all sensitive data from memory, will execute when the object goes out of scope.

  • The user can synchronously erase the SecureString's data state by calling Clear(). This also happens if the user uses the built-in IDisposable interface, or if not cleaned up by the user, when the object is finalized by the garbage collector, but the user is encouraged to use Clear() or Dispose() to clean up memory at exactly the moment the user is sure they'll not need it again.

In all cases, sensitive data should be kept as plaintext in memory for the least possible time before removal. If it can be kept encrypted most of the time, and only decrypted into plaintext when needed (as SecureString allows for), that's great.

2

Using Linux, you could ensure that sensible tools like PGP won't be swapped, by using protected memory.

But you have to configure you pre-hibernation script to kill all such sensible tools and umount all crypted filesystems!

1
  • I am using both Windows and Linux , any idea for the Windows platform ?
    – opc0de
    Jan 19, 2013 at 18:55
1

Almost anything that goes through RAM can end up in the swap space. (The main exception is kernel memory, which cannot be swapped on most operating systems. Some operating systems allow applications to request unswappable memory, but this is in itself a security problem, as an application could then hog the physical memory.)

Therefore, if your system manipulates confidential data and there is a risk that an attacker will get access to its storage (e.g. by stealing the computer), you must protect your swap space by encrypting it (and not with a key that's stored on the system, of course).

A safe way to encrypt your swap is to use a random key. Some operating systems have an option to automatically set this up at installation time (e.g. Debian). This has the downside that you can't use the swap space to hibernate.

If you want both to be able to hibernate and to retain confidentiality against attackers who may steal your storage media, encrypt the swap space with a key derived from a strong password, or with a key stored in an external device (such as a smart card) that you don't leave on the system. You'll need to be physically present to enter the key when the system boots.

0

It is my understanding that encrypting only the swap partition can cause issues if you suspend/hibernate your laptop. This has to do with the fact that the encryption key is not available to unlock the swap partition when resuming the laptop.

Because I have an old laptop with only two gigs of memory, and an Intel Centrino Duo processor I run Lubuntu 16.04.1 and do not encrypt the installation on the HDD. I have however, set a HDD password at boot time in the BIOS. Any sensitive information I keep on this laptop is in a veracrypt volume which has a very long passphrase.

I use the following procedure to wipe my swap partition on this laptop when taking it out of the house in case it is stolen. Not likely considering its age, but better safe than sorry.

To determine the swap file name:

  1. from the fstab:

    swapon -a
    eg.  /dev/hda5
    
  2. If you have an LVM volume (I setup my hard drive using LVM):

    swapon --show
    

    For example:

    NAME      TYPE      SIZE USED PRIO
    /dev/dm-1 partition   2G   0B   -1
    

To wipe the swap partition:

  1. sudo swapoff /dev/dm-1
  2. sudo dd if=/dev/zero of=/dev/dm-1 or sudo dd if=/dev/urandom of=/dev/dm-1
  3. sudo mkswap /dev/dm-1
  4. sudo swapon /dev/dm-1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .