Hot answers tagged memory
193
You are touching a sore point...
Historically, computers were mainframes where a lot of distinct users launched sessions and process on the same physical machine. Unix-like systems (e.g. Linux), but also VMS and its relatives (and this family includes all Windows of the NT line, hence 2000, XP, Vista, 7, 8...), have been structured in order to support the ...
26
I think the OS do his jobs and avoid processes to access other's allocated memory. But I think this is somehow doable.
Yes, it is possible to access the memory of another process. On Windows, this amounts to having SE_DEBUG_PRIVILEGE and using ReadProcessMemory() to extract the information you want.
You can do the same thing from a Windows Driver, ...
15
There is always something in memory. Each bit contains either a 0 or a 1 at all times. If the same space in memory is used for two different purposes, the computer (the compiler or the runtime system) can't tell: purposes are a human concept, not a machine concept.
On most systems that you'd think of as computers nowadays (PCs, servers, mobile phones, ...
13
I work in the consumer electronics arena and security here is somewhat different than in the server environment. Here we have to assume that the product is in a hostile environment. So for subscriber management purposes keys are kept secure. The first line of defence is that the SoC has hidden registers that even the operating system can't actually access, ...
10
Let's trace the flow of the confidential data. In this analysis, it is understood that anything Alice can do, root can also do. Also an external observer “one level up” (e.g. with physical access to snoop on the disk bus, or in the hypervisor if the code is running in the virtual machine) might be able to access the data.
First, the data is loaded from a ...
10
What language/platform are you using?
If it's .NET, check out the PasswordBox control and the SecureString class.
The SecureString class represents a way to store the password in memory without making it accessible to anyone - even hackers who sneak peeks at your application's memory.
The PasswordBox control is a textbox that incorporates the ...
9
A core dump, either of the entire system, or single executable, is the entire contents of that processes' memory, or in the case of the system, everything's memory, written out to a file. There can be a lot of data in such a dump - here's an abbreviated form of the memory space of gvim, which I'm currently running:
pmap 19133
19133: gvim fsstate.py
...
9
Keeping information in RAM can enhance security, if done right and if the requirements allow it. I'm going to show two security architectures where keeping the data in RAM provides a security benefit. These are fairly specific scenarios; most of the time keeping data in RAM doesn't help.
Protection against file dump attacks
Consider a web application that ...
8
To protect against these threats, should we harden our home computer to protect against these threat?
That depends on the value of the information being processed on the system and who you intend to protect against. There are essentially two physical threats to your home systems:
Theft. Somebody opportunistically takes your computer system.
...
8
In a lot of programming languages, memory accesses are checked: by construction, regardless of how incompetent the programmer was and how deviant the data entered by an evil user may be, programs written in these languages cannot write data outside of their buffers, or overwrite pointers with integers or things like that. As real-life example, Java, ...
7
There is an element of truth to this one - an attack was discovered which took advantage of data remanence in RAM, allowing an attacker to grab data from the RAM in a machine. There was a very short timeframe (a matter of seconds or minutes) in which to do this, but it wasn't a hack of the PC as such.
Simple Wikipedia link to Cold Boot Attack here
And the ...
7
One approach is to use highly non-redundant key schedules. For instances, if you can recover any large piece of AES's expanded key schedule in memory you can run the expansion in reverse and recover the original input (which then allows you to generate all of the round keys, even if you were only able to recover the values from a single round, or even ...
7
I think this question is asking a bit more about what happens when you encrypt data on a device where that data was previously unencrypted. SSD units and HDD units suffer from different possible compromises related this. This is basically referred to (at least on the venerable Wikipedia) as data remanence. That article offers lots of information about the ...
7
First of all, there are two main users of memory dumps in security - forensics and exploit writing guys. Pen-testers, not so much - of course it depends on the pentest ;)
The usual way tools that dump memory work is by opening the memory pseudo-device and reading all the contents to a file.
For example with dd in windows you would do something like dd ...
7
I don't think you're going to find a type of RAM that is secure against cold boot attacks.
It may be possible to build application-layer defenses against this, by ensuring that all sensitive data stored in memory is stored in encrypted form. Then when you shut down, you simply need to securely overwrite the decryption key. However, this is likely to have ...
6
To answer you question about why you'd want to encrypt RAM and the threats posed to it:
Firstly RAM scrapers can read RAM memory for an attacker. Think about the sensitive data that used by computers: encryption keys, personal information, credit cards, and maybe even PIN numbers for Point of Sale devices. That data needs to be unencrypted to be used and if ...
6
I also would like to know if it would be theoretically possible (whilst obviously difficult) to translate an existing JIT compiler (e.g. .NET CLR) that produces code that automatically encrypts its user-mode memory.
This might be quite difficult for the OS to do on behalf of a program. The reason for this is that the virtual pages allocated by the ...
6
Because most manufacturers try and maximise retention at low current draw, their aim is the opposite of yours, so I think your only realistic way to do this if you have to is to add circuitry that forces an overwrite or a wipe when the case is opened.
That said - the conditions in which you can successfully carry out this attack are very limited. I would ...
6
They are feeling comforted by a false sense of security by obscurity
If someone gains root access to your machine then they can see all the contents of everything that any application can. Encryption won't help if the application has to be able to work with the plain text since the application will have to store the keys somewhere. Hiding those keys is ...
6
It's primairly a question of cost-benefit analysis on the hardware manufacturer's side, and a question of risk analysis on the behalf of OS vendors.
The x86 architecture has provided memory page access rights as far back as the 80386, but at that time such hardware enforcement would have been expensive to implement in the hardware, and wasn't seen as ...
6
If you google for forensic memory dump tools, one of the first ones to come up is the free Microsoft SysInternals tool, LiveKd. Helix is also free, and has greater functionality. Download the Helix ISO and have a good look at the tools available.
As far as complexity, all these tools provide a wide range of functionality. This shouldn't be confused with ...
6
In a perfect world, you are right: there should be no point in keeping data encrypted in RAM. The OS should keep strong separation between processes, clear RAM when it is reallocated to another process, and, if the attack model allows for an attacker stealing the device afterwards and doing some harddisk analysis, encrypt the swap (or use no swap at all, ...
6
ASLR is a hide-and-seek game: in case the attacker succeeds in overflowing a buffer and overwriting pointers, the OS loads the application code (the main executable and its DLL) in randomized locations, so as to make it harder for the attacker to actually hit a meaningful location. By construction, it works better when the playground is larger. The extended ...
5
I just found this article, http://www.blackhat.com/presentations/bh-usa-08/McGregor/BH_US_08_McGregor_Cold_Boot_Attacks.pdf while looking for something else, and it outlines several software-only solutions that seem viable (a couple of which have been touched on here already), although not foolproof.
store keys in memory regions that must be overwritten no ...
5
Encrypting RAM is about preventing unauthorized access to the RAM contents.
Under normal operating conditions, the Operating System maintains RAM access permissions and blocks applications from seeing memory from other applications; so we are talking about an attack context where the attacker plugs into the RAM "from the outside". It has been demonstrated ...
5
This bug is a buffer overflow -- the "reading" kind. A buffer overflow is where some code uses a buffer (a sequence of elements in memory) and accesses elements beyond the boundaries of the buffer (usually, it is called "overflow" when the access is past the last element, and "underflow" when it is before the first element).
Traditionally, the buffer ...
5
This is a few questions in one, but I think can be answered by the same info.
As many folks have said - this depends on what the data is, who you are, who the likely adversaries are, how risk averse you are etc. Large corporates tend to carry out formal risk assessments, but users don't - and I think they really should, as they could be badly impacted in ...
5
DDoS, or Distributed Denial of Service attacks are generally not meant to exploit a bug in code, but rather simply flood the host with packets, causing a denial of service either by saturating the connection to the box or by causing the machine to use all the CPU trying to process the amount of data coming in, the latter being more common on SSL (HTTPS) ...
5
In addition to all the software attacks exploiting OS vulnerabilities if an attacker has physical access to your machine they can potentially read your keys directly out of your memory.
How can the impact of cold boot attacks be minimized?
4
You need to do a cost / benefit analysis, with some risk analysis. The answers to your questions depend very much on that.
Careful use of whole disc encryption will protect against most of the things you mention. But if an attacker is determined enough they could just {beat you / threaten you with prison} until you hand over the key.
A person could spend ...
Only top voted, non community-wiki answers of a minimum length are eligible
