3

I recently saw this new attack on KeePass (see here and the source code). I don't know how to use this attack (I'm a newbie to these things), so I want to know:

  1. How can this attack be used?
  2. What does this mean for personal computer users?

I understand that one question might be answered by an answer to the other, but any help understanding this would be appreciated.

Improve this question

2 Answers 2

Reset to default
3

As referenced in the github page you linked:

Allows for the extraction of KeePass 2.X key material from memory, as well as the backdooring and enumeration of the KeePass trigger system.

Towards the bottom of the page:

The KeeThief.ps1 PowerShell file contains Get-KeePassDatabaseKey, which loads/executes the KeeTheft assembly in memory to extract KeePass material from an KeePass.exe process with an open database.

The KeePassConfig.ps1 file contains method to enumerate KeePass config files on a system (Find-KeePassconfig), retrieve the set triggers for a KeePass.config.xml file (Get-KeePassConfigTrigger), add malicious KeePass triggers (Add-KeePassConfigTrigger), and remove KeePass triggers (Remove-KeePassConfigTrigger).

This idea of taking the password of a KeyPass database is not new. This utility fits the purpose of removing the protection around the active process when it is in an "unlocked" mode (commonly sitting idle before timeout, or in active use).

Improve this answer
0
3

The background is that no matter how security aware the programmer can be, if the platform has an evil admin (or evil processes with admin privileges) bad thing are to be expected.

What does it means for a user?

  • keep to best security rules to prevent your machine from being compromised (if it is it is no longer only yours).
  • limit the time when a KeePass database is in unlocked mode - said differently close it immediately after use.
Improve this answer

You must log in to answer this question.