5

Whenever sensitive data such as a password is used on a server it resides in memory for a short time. Given that security flaws like heartbleed exist which have the ability to 'bleed' memory for their contents what kind pre-emptive defences exist for these kinds of attacks prior to zero day?

Are there methods out there which wipe 'sensitive' memory after use so that for example a password does not linger (even freed) in an area of memory in which a possible buffer overflow could access?

1
  • But you can not do anything to data in use. So preventing such attacks are of limited scope
    – haseeb
    Nov 5 '15 at 10:48
7

The main problem with heartbleed was not that unused secret data where still in memory but that the memory contained secret data which were in use. These were data from parallel requests but more important it was the private key of the certificate which was needed to establish the SSL handshakes.

A typical technique used to protect against this kind of attacks is privilege separation. In case of an SSL handshake this could be using a HSM which can encrypt/sign but never makes the key accessible. It could be a process level separation employed for instance by OpenSSH. Or the critical computations could even be issued by another computer system controlled by a different party like done with Cloudflare Keyless SSL.

0

Absolutely. Wiping the memory of critical data has been common in C/C++ for decades. .NET even provides a SecureString class documented as:

Represents text that should be kept confidential, such as by deleting it from computer memory when no longer needed.

But the data generally needs to be in clear-text in memory at some point in time so no solution is perfect.

0

The method that very secure ftp uses is to handle string and buffer usage through an API. It's not exactly wiping the data (the option your question suggests), but it is one approach to the problem.

https://security.appspot.com/vsftpd/IMPLEMENTATION.txt

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.