Attacks on KeePass
Can a malware that infected your local computer compromise a KeePass database stored locally by any way?
If you don't open it, they can only snatch the database file and try to brute-force the password (not easy) – unless, of course, they manage to obtain the master password in some other way.
If you do open the file, they can try to obtain the master password when you are typing it in to unlock the database. There's been at least one piece of malware that did just that.
Furthermore, it is possible for malware to inject itself into the KeePass process and extract the passwords stored in the database. A proof-of-concept piece of malware that does this was released in 2015.
Why use a password manager?
If yes, what's the point for KeePass to have so strong security mechanisms if it cannot resist to this scenario?
Well, defending against all other possible scenario's in which your passwords can become compromised of course! Because, what's the alternative to a password manager? Writing down passwords in a notebook? Re-using the same password for multiple accounts because you can't remember hundreds of passwords? Coming up with some 'clever' password creation scheme that results in different, but entirely predictable passwords for every account?
Yes, it's theoretically possible to gain access to your password database in these ways, but because of the protections KeePass offers, it's only possible to compromise your passwords in these ways. (Okay, there's another way.)
But there are plenty of ways your passwords won't be compromised, such as:
- A nosy colleague looking in the notebook with your passwords;
- The file your passwords are in being included in a backup and stored somewhere insecure;
- Somebody looking over your shoulder when you enter the password;
- Somebody accessing your computer you forgot to lock when you went away;
- A generic piece of spyware dumping your browser password database, or stealing the file with your passwords;
- Malware intercepting web browsing traffic before it gets encrypted (assuming you're using HTTPS) and stealing your login details from there;
- Hardware keyloggers (although they can steal the master password, an attacker would still need to obtain the password database using other means);
- The editor you're using to save your passwords crashing and the crash dump with your passwords getting sent to the developer;
- Somebody booting up your PC from USB or CD and taking your password file;
- Somebody stealing your computer and taking your password file
- You reusing your password on multiple websites because you can't remember 1,219 different passwords, and one of these websites getting hacked
- … et cetera.
If you keep your DB in local, isn't this scenario the main threat that exists?
No. I'm positive that, of the scenario's above, there's multiple that are far more likely to occur than malware going specifically after KeePass. Risk #1 is probably re-using a password across websites and that site getting compromised. (For example, there are currently 3,805,757,030 breached accounts listed in Have I been pwned?.)
Although, as KeePass' developer agrees, there's ultimately no way to stop against attacks specifically targeting KeePass, it is certainly possible to raise the bar for an attacker. For example, there's a feature to defend against keyloggers obtaining the master password when unlocking the database, a feature for locking your password database when you're not using it et cetera.
It's worth investigating if you want to enable some of these features, but I'd not recommend just turning on some or all of these without thinking; there's a non-negligible impact on usability, and the potential benefits might be small, depending on what you're up against. Mind that an attacker won't necessarily have to get your password from KeePass, but can also choose to attack the program that you're entering the password in.
A password manager won't defend you against everything… because it can't. To quote Law #1 from the Ten Immutable Laws Of Security,
If a bad guy can persuade you to run his program on your computer, it's not your computer anymore.
The things a password manager does defend against, however, still mean that using one is a very good idea.