6

Plenty of "passwords in memory" and "keepass" related (old) topics in here, but most of them are about how to harden key protection ; plus it seems protection mechanisms by Keepass have evolved for the last couple of years.

In 2021, as KeePass is running and unlocked, I understand the master key is stored in the RAM (obfuscated though). So the only moment you are vulnerable is when your KeePass is kept unlocked for the day and someone could have some kind of control over your device, preferably on a remote session (RDP, C2, TeamViewer, etc.) or physically (unprotected Windows 10 session as I understand you can't easily dump the RAM from USB/FW ports anymore while session is locked).

Question 1: is the above still right on this day?

Question 2: while KeePass is opened and the RAM just dumped, has it become really difficult* to find the master key since KeePass states it's been obfuscated? *By difficult I mean 2 types of scenarios:

  1. for a national agency
  2. for a very good lonely hacker with limited financial means.
Improve this question
7
  • 3
    If a national agency has access to your laptop, they probably also have access to you and thus can use "enhanced interrogation" to extract the key not from the laptop, but from you.
    – user163495
    Feb 15, 2021 at 9:52
  • Interestingly, the concept of plausible deniability never worked against a proper "enhanced interrogation"
    – usr-local-ΕΨΗΕΛΩΝ
    Feb 15, 2021 at 10:25
  • 1
    @MechMK1 "Enhanced Interrogation" is not always a feasible approach, and sometimes it is not even possible (as in the case of remote access only).
    – nobody
    Feb 15, 2021 at 10:32
  • 1
    @nobody That is true. But then again, password managers aren't designed to mitigate against this kind of threat. They're designed to mitigate against using Spring2021 as password, and against companies who think storing passwords as MF5 hash or plain text is a great idea. Good luck cracking a 64-char random password.
    – user163495
    Feb 15, 2021 at 10:43
  • 1
    @MechMK1 You're absolutely right. <nitpick>They don't protect against passwords stored in plaintext though.</nitpick>
    – nobody
    Feb 15, 2021 at 10:47

2 Answers 2

Reset to default
10

Question 1: is the above still right on this day?

That is the only time the key can be extracted from memory. But if someone has the level of access to access memory, they can compromise your system in other ways, and then grab your keys the next time you log in.

has it become really difficult to find the master key since KeePass states it's been obfuscated?

The problem with obfuscation, or security by obscurity in general, is that only one person has to figure out how your system works and then the system is easy game for everyone.

In the particular case of KeePass, this is demonstrated by the existence of KeeThief. One person (or a group) reverse engineered the obfuscation, and now state-sponsored and lone hackers alike can extract KeePass keys from memory. However, since KeePass protects the keys with DPAPI, the keys cannot be extracted from an isolated memory dump alone. Instead you would have to be able to execute code on the same device (under the same user account) to decrypt the keys.

Improve this answer
1

Sounds like there is a new vulnerability to retrieve the Master Password from memory:

Apart from the first password character, it is mostly able to recover the password in plaintext. No code execution on the target system is required, just a memory dump. It doesn't matter where the memory comes from - can be the process dump, swap file (pagefile.sys), hibernation file (hiberfil.sys) or RAM dump of the entire system. It doesn't matter whether or not the workspace is locked. It is also possible to dump the password from RAM after KeePass is no longer running, although the chance of that working goes down with the time it's been since then.

So to answer the question, since a PoC is available it's easy to perform, it's not limited to national agencies, and it also works the DB is locked or even after the processed was killed. Just a memory dump is required.

Improve this answer
1
  • Do note that I would define the vulnerability in that the password can be extracted, not just the derivated master obfuscated in memory
    – Ángel
    May 17 at 22:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .