2

I ssh to my AWS instances via WinSCP and it has public-private key authentication, password authentication is disabled. All the sessions are saved on WinSCP, so I click on the IP of the machine and I get logged straight in without entering any information.

I am not considering the threats which require physical access of my laptop. But I am wondering if there are any known vulnerabilities or attack vectors specific to WinSCP which can leak private keys from my saved sessions?

Edit 1: The private key does not have a passphrase.

5
  • Say if the private key has a passphrase. And do you use an agent?
    – kubanczyk
    Mar 30, 2018 at 8:57
  • @kubanczyk no it does not have a passphrase. I did not understand the 'agent' question.
    – one
    Mar 30, 2018 at 9:09
  • What pretty vague. What do you mean by "leak private keys from my saved sessions"? How leak? At what point? Mar 31, 2018 at 7:01
  • @MartinPrikryl I meant if someone can get a hold of the private key
    – one
    Apr 1, 2018 at 9:05
  • But when? How? Just by configuring the stored session? While logging in? Using what kind of access? Apr 1, 2018 at 9:39

3 Answers 3

1

WinSCP stored site contains only a path to your private key file and no more.

So it is unlikely it can cause any vulnerabilities at all, except maybe by making the file easier to be found on your machine. However, that’s irrelevant if you do not consider threats which require physical access to your machine.

2
  • So the only way for the device to be infected by malware (which might retrieve the private key) is via physical access?
    – symcbean
    Jul 30, 2018 at 15:08
  • @symcbean My answer only says that storing a path to stored site does not increase a risk (unless an attacker has a physical access). It does not say anywhere, that "only way for the device to be infected by malware is via physical access?". If you have additional questions, please consider posting a new question. Jul 30, 2018 at 15:48
0

Are there any known vulnerability or attack vector specific to WinSCP which can leak private keys from my saved sessions?

In your case, the private keys are stored on the local disk, the only impact of saving the session is that it makes it quicker for you to login. If malware was searching for keys, it would normally also scan the whole disk, looking for files that look like keys, so it is unlikely to impact if your keys will be stolen.

There may be 0-day attacks which allow for extracting the keys from memory, but these will be rare, stealing the keys from the disk would be more likely.

The private key does not have a passphrase.

You may want to add a password, not only for if someone gains physical access, but also to make it more difficult for malware to steal your key while it is stored on disk.

Higher levels of security

If you wanted to prevent the keys being stolen from the disk you would store them in a smartcard, so that they cannot be extracted, only used when the PIN is entered (and possibly also the user's presence is checked).

-1

I am not aware of any WinSCP specific. Generally, usage of public/private keypairs is encouraged over usage of passwords. Reasons are often similar to encouraging password managers over remembering passwords:

  • All your passwords should be unique and non-similar. (Appending service name to a password technically satisfies uniqueness, but it is not secure either, because attacker might easily guess other passwords after learning one.)
  • All your passwords should be strong.
  • You are likely to have many accounts. Remembering an unique strong password for each of them would be great in theory, but just few people have so good memory. So, using a password manager with some single strong master password might be better in practice.

On your concerns about local access: Even if you ensure no unauthorized person accesses your computer, consider your disposal process of your storage (HDD/SSD). Especially when it breaks, it might be troublesome to perform secure erase, but it might be feasible for attacker to extract some data. For this reason, I recommend some encryption of your secrets, including encryption of swap.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .