11

Oracle's org.identityconnectors.common.security.GuardedString states this in its documentation:

The GuardedString class alleviates [the problem that string data is kept in memory as clear text] by storing the characters in memory in an encrypted form. The encryption key will be a randomly-generated key.

Does this protect against a heap or memory dump? At first glance, it seems trivial to locate the randomly-generated key in memory, and to use it to decrypt the sensitive data.

Improve this question

1 Answer 1

Reset to default
10

Some deeper look into the actual implementation will help an attacker understand the data structure of a memory dump, and from what I found in EncryptorImpl there has been put no effort into obfuscating the key storage mechanism to prolong the time needed for reverse-engineering the secret. So no, this is not an effective measure against exposure of memory.

Let me provide a better usage scenario for this class: As the key variable is private, at least it's very unlikely a developer would find his way around responding with the key by accident to an attacker (e.g. due to a bug in the control flow of a web service request handler), so there is some use for this class in ensuring the code can only help decrypting by actually decrypting in the background instead of handing out a key. After the program is stopped / taken offline, an attacker won't be able to decrypt secrets anymore, and all decryption that happened until then (when the attacker was using the program as a kind of oracle) had a chance to be logged, which can be relevant in a post-mortem analysis to figure out what data has been compromised.

Improve this answer
3
  • 5
    Worth adding: This is Java's equivalent of .Net's SecureString. The .Net team now acknowledges that SecureString is not as good as advertised ("really should be called LessInsecureString"), and it is not supported in .Net core.
    – TheGreatContini
    Commented Apr 3, 2017 at 21:38
  • 1
    Yeah, I've been saying for years the dotnet(fw) SecureString should have been called "KindaSecureString" :) To alleviate that false sense of security (pun intended).
    – granadaCoder
    Commented Oct 2, 2020 at 11:33
  • @Anton. The provided link appears to be dead. Consider updating it if you get a chance.
    – granadaCoder
    Commented Oct 2, 2020 at 11:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .