13

I use Process Hacker as a replacement for Window's Task Manager on my computer.

While looking at the various information available about a selected process, I found the Memory tab. I figured this was a just list of memory locations in use by the selected process, however I noticed the Strings button which searches for strings in memory and was very surprised to find that when searching for strings in memory locations used by KeePassX entries, usernames and passwords show in plain text.

How is it possible for Process Hacker - running with "Limited" elevation (as reported by itself) - to access the memory of another process? I assumed processes could only access memory assigned to them by the operating system and that accessing another process's memory would cause an access violation error.

Process Hacker's optional service has not been installed.

  • 2
    What version of Windows, KeePassX, and Process Hacker? – Jesse K May 30 '17 at 20:51
  • Windows 10 Version 1703, Process Hacker 2.39.124 and KeePassX 0.4.4. I believe KeePassX does have some form of memory protection (at least in newer versions) and in my case everything was probably in memory because usually I have passwords and usernames set visible in the entry list. Regardless though, I thought there was supposed to be isolation for memory between processes which is what I am most interested in here. It seems like a huge security risk regardless of application if unprivileged processes can access each other's memory and I am interested in the technicalities behind this. – L Sponge May 30 '17 at 21:00
  • 1
    Since this is a lousy answer, I'll keep it in the comments. It looks like encrypted memory streams were implemented in later versions [2.x] of KeePass, and may never have been implemented in the Windows version of KeePassX, so if you're running on Windows and are concerned, you may want to switch to KeePass. – Jesse K May 30 '17 at 21:25
  • Thanks. I'm not sure where to go now or how big of a risk this is. Previously I blindly assumed that non-administrative processes could not access each other's memory in the first place because Windows would manage/allocate memory. I also use Linux and running KeePass under Mono is not the nicest experience unfortunately, especially when compared to KeePassX. – L Sponge May 30 '17 at 21:35
7

Per its documentation, Process Hacker actually launches a kernel mode driver, KProcessHacker. A kernel mode driver does have access to all memory.

Sources:

https://github.com/processhacker2/processhacker2#kprocesshacker

https://docs.microsoft.com/en-us/windows-hardware/drivers/gettingstarted/user-mode-and-kernel-mode

  • 1
    It turns out this was actually running even though I am certain I did not chose to install it as the installer specifically recommends against installing it (or perhaps I am confusing it with something else). Mystery solved I guess. I also checked the strings function in ProcessExplorer and I cannot find any sensitive strings. So I assume then that it is the case that processes cannot access each other's memory without a kernel mode driver or other 'ring 0' access? – L Sponge May 30 '17 at 22:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.