New answers tagged

4

A quick search turned up the link below. They created a new technology called CredentialGuard, which isolates secrets in virtualized secure environments rather than storing everything in LSA like they used to. Mimikatz can no longer just dump lsass.exe process memory and parse the contents. They're still in some memory, strictly speaking, but not memory ...


3

According to the Windows Internals 5th Edition book, the 5-bit ASLR bias for heaps is "multiplied by 64KB to generate the final base address, starting at 0, giving a possible range of 0x00000000 to 0x001F0000 for the initial heap". As such, the initial heap for IE on Windows 7 will always be between 0x00000000 and 0x001F0000, with 32 possible locations. By ...


0

I have personally performed the Cold Boot Attack before, it definitely works. I mainly referred to the actual Princeton paper (google princeton cold boot)as well as the McGrew link I used dry ice instead, have to beware of condensation (use tissue to wipe) since the RAM is colder than surrounding air. The time frame in which to pull and plug in the RAM is ...


3

You do not need a passphrase for your RSA key. But if your key gets compromised (for example, because you carry the key on a thumb drive and you lose it), an attacker could immediately access the assets the key is protecting. Using a strong password will give you more time to change keys in case of a key compromise. Related question on Superuser: Do I ...


1

I'm talking about the type of exploits that you compile and that result in an executable that exploits a daemon (and not by passing specially crafted input through human input fields). They do so by passing specially crafted input through non-human input fields. A program that does something useful needs to interact with some other programs in some ...


3

While everyone else has suggested a hardware solution, I'll suggest a software solution (though I don't mean to imply that it's any better or worse than using an HSM - that you'll have to decide on your own based on your own needs). This solution is a kernel patch which encrypts processes. RamCrypt is a project which encrypts the majority of the memory of ...


1

It depends. Other posters suggest an HSM. This can be a good solution for a limited set of purposes where you temporarily need access to a key, it's erased from active memory after, and the key to the HSM itself isn't stored in memory long-term. It sounds like you need the secret to be active in memory all the time, and not stored in an HSM most of the ...


1

Fundamentally, there is nothing that can solve this issue in the absolute. You're running into the DRM problem, which is that you need plaintext access to some data on a system in order to fulfill some functionality, but you're also placing that system under the control of a party which is untrusted. The best you can do is make it incredibly difficult for ...


5

I answered a similar question here. For a normal hardware solution, a hardware security module (HSM) does this. For software, .NET offers the Secure String mechanism to encrypt and protect sensitive data in RAM. Other platforms may offer something similar. For an AWS solution, Amazon offers CloudHSM to do pretty much what you are asking for, I think. ...


1

I'm not sure if I get you right. But at some point the plain secret has to be in some sort of memory (most likely the RAM). If the attacker can read the memory at that point and if he is able to find the secret he can decrypt the data afterwards. I think theoretically there can't be a way (maybe with some special security module that contains your program ...


4

I don't know the specifics of the routine you were asked to amend, but I can tell you the following. When you allocate memory on the heap, even if you correctly de-allocate it, there is no guarantee that the contents of that memory is erased after you're done with it. On the stack it's the same deal - however because of the way the stack works - that ...



Top 50 recent answers are included