6

Plenty of "passwords in memory" and "keepass" related (old) topics in here, but most of them are about how to harden key protection ; plus it seems protection mechanisms by Keepass have evolved for the last couple of years.

In 2021, as KeePass is running and unlocked, I understand the master key is stored in the RAM (obfuscated though). So the only moment you are vulnerable is when your KeePass is kept unlocked for the day and someone could have some kind of control over your device, preferably on a remote session (RDP, C2, TeamViewer, etc.) or physically (unprotected Windows 10 session as I understand you can't easily dump the RAM from USB/FW ports anymore while session is locked).

Question 1: is the above still right on this day?

Question 2: while KeePass is opened and the RAM just dumped, has it become really difficult* to find the master key since KeePass states it's been obfuscated? *By difficult I mean 2 types of scenarios:

  1. for a national agency
  2. for a very good lonely hacker with limited financial means.
7
  • 3
    If a national agency has access to your laptop, they probably also have access to you and thus can use "enhanced interrogation" to extract the key not from the laptop, but from you.
    – user163495
    Feb 15, 2021 at 9:52
  • Interestingly, the concept of plausible deniability never worked against a proper "enhanced interrogation" Feb 15, 2021 at 10:25
  • 1
    @MechMK1 "Enhanced Interrogation" is not always a feasible approach, and sometimes it is not even possible (as in the case of remote access only).
    – nobody
    Feb 15, 2021 at 10:32
  • 1
    @nobody That is true. But then again, password managers aren't designed to mitigate against this kind of threat. They're designed to mitigate against using Spring2021 as password, and against companies who think storing passwords as MF5 hash or plain text is a great idea. Good luck cracking a 64-char random password.
    – user163495
    Feb 15, 2021 at 10:43
  • 1
    @MechMK1 You're absolutely right. <nitpick>They don't protect against passwords stored in plaintext though.</nitpick>
    – nobody
    Feb 15, 2021 at 10:47

1 Answer 1

10

Question 1: is the above still right on this day?

That is the only time the key can be extracted from memory. But if someone has the level of access to access memory, they can compromise your system in other ways, and then grab your keys the next time you log in.

has it become really difficult to find the master key since KeePass states it's been obfuscated?

The problem with obfuscation, or security by obscurity in general, is that only one person has to figure out how your system works and then the system is easy game for everyone.

In the particular case of KeePass, this is demonstrated by the existence of KeeThief. One person (or a group) reverse engineered the obfuscation, and now state-sponsored and lone hackers alike can extract KeePass keys from memory. However, since KeePass protects the keys with DPAPI, the keys cannot be extracted from an isolated memory dump alone. Instead you would have to be able to execute code on the same device (under the same user account) to decrypt the keys.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.