2

Say I wanted to encrypt some sensitive information with a symmetric algorithm using a program on a computer. Is it possible that a hacker could retrieve the data,salt, iteration, cipher, keysize while the program is generating ciphered data and after? If possible, how can I prevent this?

  • 1
    Use a computer that isn't thoroughly compromised? – Xander Apr 5 '14 at 23:33
0

Yes, it is possible for an attacker to gain access to your private and sensitive data during encryption or decryption.

This attack is known as memory sniffing attack. In my opinion this is very sophisticated attack. The attacker dump the machine memory (e.g. RAM, swap files, etc) and then analyze this data to retrieve sensitive data (e.g., password, cryptographic keys, etc)

When an attacker is executing this attack on your machine it simply means your machine is already compromised.

How to reduce the risk of this attack? In my opinion, it is all about secure coding practices. In short, make sure when you are implementing your encryption/decryption algorithm that you apply secure coding standard.

The following link contains a post that explain the memory sniffing attack and explain how to prevent/reduce this attack

You should read more about memory dump attack and secure coding. Several programming languages provide some guidelines and sometimes APIs to reduce the risk of memory dump attack. Here is another article.

  • Thank you very much any more articles you know of are much appreciated. – Nasal Spray Apr 6 '14 at 0:01
  • Well, you should in general read about security coding practice. Some platforms and programming languages provide API to reduce the risk of this attack. – Ubaidah Apr 6 '14 at 8:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.