Oracle's org.identityconnectors.common.security.GuardedString states this in its documentation:

The GuardedString class alleviates [the problem that string data is kept in memory as clear text] by storing the characters in memory in an encrypted form. The encryption key will be a randomly-generated key.

Does this protect against a heap or memory dump? At first glance, it seems trivial to locate the randomly-generated key in memory, and to use it to decrypt the sensitive data.

up vote 4 down vote accepted

Some deeper look into the actual implementation will help an attacker understand the data structure of a memory dump, and from what I found in EncryptorImpl there has been put no effort into obfuscating the key storage mechanism to prolong the time needed for reverse-engineering the secret. So no, this is not an effective measure against exposure of memory.

Let me provide a better usage scenario for this class: As the key variable is private, at least it's very unlikely a developer would find his way around responding with the key by accident to an attacker (e.g. due to a bug in the control flow of a web service request handler), so there is some use for this class in ensuring the code can only help decrypting by actually decrypting in the background instead of handing out a key. After the program is stopped / taken offline, an attacker won't be able to decrypt secrets anymore, and all decryption that happened until then (when the attacker was using the program as a kind of oracle) had a chance to be logged, which can be relevant in a post-mortem analysis to figure out what data has been compromised.

  • 1
    Worth adding: This is Java's equivalent of .Net's SecureString. The .Net team now acknowledges that SecureString is not as good as advertised ("really should be called LessInsecureString"), and it is not supported in .Net core. – TheGreatContini Apr 3 '17 at 21:38

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.