Tag Info

New answers tagged

6

Crash Course in Computer Architecture In an Intel x86 and x64 architectures there is something called the stack. This is essentially where everything to determine the execution path is stored. Parameters to functions, local variables, and return addresses are all stored on the stack. CPU registers keep track of where in the stack the program is ...


12

There are two things going on here: On x86 and x86-64 (and most other hardware), the stack grows from the top of memory downwards. Because of this, data used by a function (eg. the buffer you're overflowing) occurs at a lower address number than data used in calling the function (eg. the address to return to after the function is done, which you're trying ...


1

tl;dr: Cache based attacks to leak RAM are possible. I would be careful of having a VM that spends 100% of its CPU time doing cryptography with secret keys. An attacker can also slow your VM down, which might help a possible RAM-leaking attack. Also, beware of VM snapshots that capture your running RAM (most cloud services don't do that, though). (I know ...


0

There is a more simple solution to this, if you want to go all out with encryption i highly suggest you patch a Linux kernel with TRESOR. This makes it to where sensitive data moves to the CPU and never RAM. A guide on protection and how to use TRESOR can be found here. Two more thing's, Only out two Linux partitions on a hard drive if you want to be safe. ...


0

Your "periodic key purge" system is a great example of why you need to figure out who and what you're defending against before developing defensive measures. Who your 24-hour purge will defend against: A random attacker who happens to find your laptop after you've lost it, and takes their time before dumping RAM. Who it will not defend against: ...


3

Rather unsafe is a little exaggerated. It's secure enough for the vast majority of people trying to protect their data from offline attackers. If you are worried about a malware reading the encryption keys, you are worried about the wrong threat. A malware should be running with root privileges to read the content of the master keys on the memory, but a ...


0

The reason why it sounds like a good idea is that you will want to protect the data from being stolen while resident in memory. This is under the assumption that the data in the actual database is encrypted (as all PII should be) but sits un-encrypted in memory as it is processed. This would be quite difficult to do for a variety of reasons outlined by other ...



Top 50 recent answers are included