I ssh to my AWS instances via WinSCP and it has public-private key authentication, password authentication is disabled. All the sessions are saved on WinSCP, so I click on the IP of the machine and I get logged straight in without entering any information.

I am not considering the threats which require physical access of my laptop. But I am wondering if there are any known vulnerabilities or attack vectors specific to WinSCP which can leak private keys from my saved sessions?

Edit 1: The private key does not have a passphrase.

  • Say if the private key has a passphrase. And do you use an agent? – kubanczyk Mar 30 '18 at 8:57
  • @kubanczyk no it does not have a passphrase. I did not understand the 'agent' question. – one Mar 30 '18 at 9:09
  • What pretty vague. What do you mean by "leak private keys from my saved sessions"? How leak? At what point? – Martin Prikryl Mar 31 '18 at 7:01
  • @MartinPrikryl I meant if someone can get a hold of the private key – one Apr 1 '18 at 9:05
  • But when? How? Just by configuring the stored session? While logging in? Using what kind of access? – Martin Prikryl Apr 1 '18 at 9:39

WinSCP stored site contains only a path to your private key file and no more.

So it is unlikely it can cause any vulnerabilities at all, except maybe by making the file easier to be found on your machine. However, that’s irrelevant if you do not consider threats which require physical access to your machine.

| improve this answer | |
  • So the only way for the device to be infected by malware (which might retrieve the private key) is via physical access? – symcbean Jul 30 '18 at 15:08
  • @symcbean My answer only says that storing a path to stored site does not increase a risk (unless an attacker has a physical access). It does not say anywhere, that "only way for the device to be infected by malware is via physical access?". If you have additional questions, please consider posting a new question. – Martin Prikryl Jul 30 '18 at 15:48

Are there any known vulnerability or attack vector specific to WinSCP which can leak private keys from my saved sessions?

In your case, the private keys are stored on the local disk, the only impact of saving the session is that it makes it quicker for you to login. If malware was searching for keys, it would normally also scan the whole disk, looking for files that look like keys, so it is unlikely to impact if your keys will be stolen.

There may be 0-day attacks which allow for extracting the keys from memory, but these will be rare, stealing the keys from the disk would be more likely.

The private key does not have a passphrase.

You may want to add a password, not only for if someone gains physical access, but also to make it more difficult for malware to steal your key while it is stored on disk.

Higher levels of security

If you wanted to prevent the keys being stolen from the disk you would store them in a smartcard, so that they cannot be extracted, only used when the PIN is entered (and possibly also the user's presence is checked).

| improve this answer | |

I am not aware of any WinSCP specific. Generally, usage of public/private keypairs is encouraged over usage of passwords. Reasons are often similar to encouraging password managers over remembering passwords:

  • All your passwords should be unique and non-similar. (Appending service name to a password technically satisfies uniqueness, but it is not secure either, because attacker might easily guess other passwords after learning one.)
  • All your passwords should be strong.
  • You are likely to have many accounts. Remembering an unique strong password for each of them would be great in theory, but just few people have so good memory. So, using a password manager with some single strong master password might be better in practice.

On your concerns about local access: Even if you ensure no unauthorized person accesses your computer, consider your disposal process of your storage (HDD/SSD). Especially when it breaks, it might be troublesome to perform secure erase, but it might be feasible for attacker to extract some data. For this reason, I recommend some encryption of your secrets, including encryption of swap.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.