16

I use Process Hacker as a replacement for Window's Task Manager on my computer.

While looking at the various information available about a selected process, I found the Memory tab. I figured this was a just list of memory locations in use by the selected process, however I noticed the Strings button which searches for strings in memory and was very surprised to find that when searching for strings in memory locations used by KeePassX entries, usernames and passwords show in plain text.

How is it possible for Process Hacker - running with "Limited" elevation (as reported by itself) - to access the memory of another process? I assumed processes could only access memory assigned to them by the operating system and that accessing another process's memory would cause an access violation error.

Process Hacker's optional service has not been installed.

Improve this question
4
  • 2
    What version of Windows, KeePassX, and Process Hacker?
    – Jesse K
    May 30, 2017 at 20:51
  • 1
    Windows 10 Version 1703, Process Hacker 2.39.124 and KeePassX 0.4.4. I believe KeePassX does have some form of memory protection (at least in newer versions) and in my case everything was probably in memory because usually I have passwords and usernames set visible in the entry list. Regardless though, I thought there was supposed to be isolation for memory between processes which is what I am most interested in here. It seems like a huge security risk regardless of application if unprivileged processes can access each other's memory and I am interested in the technicalities behind this.
    – user149636
    May 30, 2017 at 21:00
  • 1
    Since this is a lousy answer, I'll keep it in the comments. It looks like encrypted memory streams were implemented in later versions [2.x] of KeePass, and may never have been implemented in the Windows version of KeePassX, so if you're running on Windows and are concerned, you may want to switch to KeePass.
    – Jesse K
    May 30, 2017 at 21:25
  • 1
    Thanks. I'm not sure where to go now or how big of a risk this is. Previously I blindly assumed that non-administrative processes could not access each other's memory in the first place because Windows would manage/allocate memory. I also use Linux and running KeePass under Mono is not the nicest experience unfortunately, especially when compared to KeePassX.
    – user149636
    May 30, 2017 at 21:35

1 Answer 1

Reset to default
9

Per its documentation, Process Hacker actually launches a kernel mode driver, KProcessHacker. A kernel mode driver does have access to all memory.

Sources:

https://github.com/processhacker2/processhacker2#kprocesshacker

https://docs.microsoft.com/en-us/windows-hardware/drivers/gettingstarted/user-mode-and-kernel-mode

Improve this answer
1
  • 2
    It turns out this was actually running even though I am certain I did not chose to install it as the installer specifically recommends against installing it (or perhaps I am confusing it with something else). Mystery solved I guess. I also checked the strings function in ProcessExplorer and I cannot find any sensitive strings. So I assume then that it is the case that processes cannot access each other's memory without a kernel mode driver or other 'ring 0' access?
    – user149636
    May 30, 2017 at 22:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .