1

If I don't have Administrator or root privileges on a Desktop machine and I am running a password manager, can I see the memory contents of that password manager, or higher permissions needed?

So I am running a process ("foobar" user, not root) and I want to view the whole content of the memory of the password manager (ex.: the password that unlocks it).

  • Typically you don't need administrator permissions. What you might need (and which may or may not help with the specific scenario you are describing) is an inspect memory or similar privilege. An administrator account often has that, but there are many other ways to get that specific privilege without getting all the others that come with administrator access. – a CVn Aug 17 '17 at 8:58
  • Is this similar to serverfault.com/questions/173999/… ? – Purefan Aug 17 '17 at 9:02
1

Yes, you can read the memory of processes you own.

On Windows you need to open a handle to the process with PROCESS_VM_READ rights, and you can use ReadProcessMemory to read that process's memory (unsurprisingly). You must be running under a context with the appropriate security token to match a rule in the DACL (access control list) of the process, or be granted a privilege which allows global process access (e.g. SeDebugPrivilege).

On Linux you can read /proc/$pid/mem if you are the owner of that process or root.

This is entirely by design. The processes exist under your security context, so therefore you have access to them. If you run malicious code under that same security context, it has access to everything you do.

There is, however, a saving grace from such a scenario under a modern Windows system - integrity levels. Processes can be split into different integrity levels describing their trustworthiness. A low integrity process is restricted from a lot of operations, including interprocess access to high integrity processes. The boundary between low integrity and high integrity is often managed via User Access Control (UAC) elevation prompts and the secure desktop. KeePass, for example, utilises this so that a browser exploit gaining code execution in a low integrity process cannot gain direct access to the KeePass process. While UAC itself is not considered a security boundary, integrity levels are.

Many password managers also attempt to make master key and password decryption from memory dumps difficult. On Windows the CryptProtectMemory API can be used to encrypt data in memory using a key stored in the Local Security Authority subsystem (LSASS) which is protected by the operating system, thus requiring administrative privileges (SYSTEM, in fact) to discover the key.

Linux with the grsecurity patches has some restrictions on access to /proc which may also provide some security benefits in these types of scenarios, although I am not well versed enough in the grsec options or Linux internals to know exactly how these work and what exactly they prevent.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.