Swap file may contain sensitive data

Question

Is it possible that the swap file will contain chunks of data by a file you have accessed, and could this be detected during a forensics analysis?

How could you prevent this situation ?

Is using deep freeze or similar software a valid solution ?

Answer 1

Yes, swap files can contain sensitive data.

On Windows you can configure the page file (swap file) to be cleared at shutdown this way:

1. Start regedit32.exe
2. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management
3. Set the data value of ClearPageFileAtShutdown to 1
4. If the value does not exist, create it with the type REG_DWORD and set it to 1
5. Restart

I don't know for sure if this is a secure deletion of the swap data, but from the fact that it adds minutes to the shutdown process and from the text on Microsoft page about ClearPageFileAtShutdown:

Some third-party programs can temporarily store unencrypted (plain-text) passwords or other sensitive information in memory. Although clearing the paging file is not a suitable substitute for physical security of a computer, you might want to do this to increase the security of data on a computer while Windows is not running. "

I would think the data is securely wiped.

On Linux you can manually wipe the swap partition:

1. Display swap details: swapon -s
2. Unmount the swap partition: swapoff -a
3. Overwrite it with zeros: dd if=/dev/zero of=/dev/sdaX bs=1024
4. Get the UUID of your old swap partition from /etc/fstab
5. Create a new swap partition with that UUID: mkswap /dev/sdaX -U <old_uuid> 1024
6. Mount it for usage: swapon -a

Better wiping tools are provided by the Secure-Delete package which comes with the following commands:

• srm (Secure remove) – used for deleting files or directories currently on your hard disk.
• smem (Secure memory wiper) – used to wipe traces of data from your computer’s memory (RAM).
• sfill (Secure free space wiper) – used to wipe all traces of data from the free space on your disk.
• sswap (Secure swap wiper) – used to wipe all traces of data from your swap partition.

Sswap is designed to delete data which may lie still on your swapspace in a secure manner which can not be recovered by thiefs, law enforcement or other threats.The wipe algorithm is based on the paper “Secure Deletion of Data from Magnetic and Solid-State Memory” presented at the 6th Usenix Security Symposium by Peter Gutmann, one of the leading civilian cryptographers.

Answer 2

Is it possible that the swap file will contain chunks of data by a file you have accessed, and could this be detected during a forensics analysis?

Yes, it is. Moreover, you may be able to read some passwords, encryption keys and other sensitive/private data.

How could you prevent this situation ?

You can disallow memory swapping for particular virtual address space in a process by using some OS-specific calls:

• Unix-based OS
  • MLOCK
• Windows
  • VirtualLock

Other modern operating systems will provide similar functionality. However, data is not generally removed from physical memory (such as RAM) when you shutdown your PC, and it still could be retrieved using a cold-boot attack.

Answer 3

Using Linux, you could ensure that sensible tools like PGP won't be swapped, by using protected memory.

But you have to configure you pre-hibernation script to kill all such sensible tools and umount all crypted filesystems!

Answer 4

If you're coding, many "unmanaged" languages support (require) the ability to delete dynamically-allocated memory. If you want to be really sure, you can usually also set the value of said memory to all zeroes, or to something not useful to an attacker (random data, "All work and no play...", etc).

In managed-memory runtimes such as the JVM or CLR, you do not have this control; the garbage collector checks whether the executing code still has any references to the object, and if not, it schedules it for collection. The marking process, and the resulting memory-freeing and heap-reorganization, happens when the runtime thinks it might be a good time to clean up, not when you know that something should get cleaned up. In these environments, there is usually a structure provided specifically to handle sensitive data.

In .NET, the primary type for these things is called SecureString, and it has several advantages over the basic System.String:

• SecureString is mutable, unlike String which, though a reference type, is treated as immutable; every time a string variable is assigned to, a new String objectis created on the heap, meaning that when you're working with sensitive data, many dfferent copies of said data may exist on the heap at once. SecureString handles all manipulations of itself within a single memory space on the heap.
• The data kept in the SecureString is encrypted at all times, so even if it is left lying around, the attacker would also need access to the key container stored in protected unmanaged memory.

• The object is derived from a basic class family that identifies it as having a "critical finalizer"; as long as the CLR has a say in the matter, the finalizer, which in SecureString's case removes all sensitive data from memory, will execute when the object goes out of scope.

• The user can synchronously erase the SecureString's data state by calling Clear(). This also happens if the user uses the built-in IDisposable interface, or if not cleaned up by the user, when the object is finalized by the garbage collector, but the user is encouraged to use Clear() or Dispose() to clean up memory at exactly the moment the user is sure they'll not need it again.

In all cases, sensitive data should be kept as plaintext in memory for the least possible time before removal. If it can be kept encrypted most of the time, and only decrypted into plaintext when needed (as SecureString allows for), that's great.

Answer 5

Almost anything that goes through RAM can end up in the swap space. (The main exception is kernel memory, which cannot be swapped on most operating systems. Some operating systems allow applications to request unswappable memory, but this is in itself a security problem, as an application could then hog the physical memory.)

Therefore, if your system manipulates confidential data and there is a risk that an attacker will get access to its storage (e.g. by stealing the computer), you must protect your swap space by encrypting it (and not with a key that's stored on the system, of course).

A safe way to encrypt your swap is to use a random key. Some operating systems have an option to automatically set this up at installation time (e.g. Debian). This has the downside that you can't use the swap space to hibernate.

If you want both to be able to hibernate and to retain confidentiality against attackers who may steal your storage media, encrypt the swap space with a key derived from a strong password, or with a key stored in an external device (such as a smart card) that you don't leave on the system. You'll need to be physically present to enter the key when the system boots.