In a scenario where a client is reading data from a server over SSL/TLS and then encrypts that data using a client-side symmetric key before saving it to the disk, how susceptible is the data to an in-memory attack (e.g., by tools like SSLsnoop)?

Would the client need to do anything extra (e.g., get the data encrypted from the server, irrespective of the SSL/TLS part) to secure the confidentiality of the communication?

Also, are mobile devices anyhow more vulnerable to such attacks?

1 Answer 1


Any attacker who gains sufficient privileges to inspect the memory of other process is an attacker who has full control over the machine -- at which point anything which happens in that machine can be known to the attacker. This is true of every machine and OS, including mobile devices; however, while multi-user servers with a Unix-like operating system are quite traditional, multi-user iPhones are quite rarer.

If the client can thus be hijacked, then there is no way out of it except making it so that the client never gets the cleartext data in the first place. But then, the client does not have access to the cleartext data, which reduces its functionality (e.g. it cannot show it to the user).

A reduced scenario is about virtual memory. When a computer has data in memory, that data may get copied into swap space by the OS, in an automated fashion. An attacker seizing the machine afterwards may thus get excerpts of sensitive data by looking at the swap space. If an application manages data which is exceptionally sensitive, it can ask the kernel never to write it to swap space; on Linux systems, this is done with mlock(). GnuPG does that, when it has private keys in memory.

A tempting alternative is to disable swap space altogether; modern computers have a lot of RAM, and use programming systems which don't interact well with virtual memory anyway (that's a known issue of garbage collectors). A computer with no swap space will, by definition, never let memory-based data be written to the disk; not that such a computer would not be able to go into prolonged disk-based hibernation mode.

It is worth noting that "mobile devices" (smartphones, tablets...), as a rule, don't have Virtual Memory, because their storage capacity is not up to it anyway. In that sense, mobile devices may be a better bet than traditional computers with "normal" configuration, when it comes to limiting data leaks through persistent storage.

  • Multi user iPhones are quite rare |D Thank you mister obvious ! I do love that sentence XD
    – Kiwy
    Jan 9, 2014 at 22:05
  • So, as far as the client is concerned, it makes no sense to have the data encrypted at the server before transferring it over SSL/TLS.
    – PNS
    Jan 9, 2014 at 22:31
  • @PNS Aside from basic precaution. Just because the lock on your house door is solid doesn't mean you shouldn't bother locking the safe.
    – Shadur
    Jan 12, 2014 at 11:19
  • @TomLeek, Another answer claims that swap space can't be disabled altogether.
    – Pacerier
    Feb 16, 2015 at 9:38
  • @Pacerier: simply terminology confusion. What I call "virtual memory" is what is known as "swap space" on Linux; but on Windows things are traditionally called differently. What matters here is data that is in RAM and then gets written to disk (as opposed to data which is conceptually in RAM but is read from disk when necessary).
    – Tom Leek
    Feb 25, 2015 at 1:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.