5

I know data-remanence is a concern on hard drives, but is it a concern on RAM? For example, once a program completes, is its data still available on RAM, just as data on a hard drive remains after being deleted?

Edit: In this case, I am not as worried about data that could possibly remain after the computer is shut down. I am moreover thinking about a situation where a hacker compromises a system that is still running, and is able to access the memory. Does the data remain in RAM long after the program that was using it is terminated?

11

It can be.

Generally speaking, programs while running don't tend to wipe out their data (they do, after all, tend to need it), and any process with the ability to access other programs' allocated RAM can, in fact, read it. This is how, for example, the recent spate of big box store hacks were able to leak so much credit card data -- the attacks were carried about by rogue programs that scoured the running POS machine's RAM and copied anything that looked like card data. [I can't at the moment find a source to back this one up, I'll keep looking and edit it in later.]

Once a program terminates, the data that was in its RAM may remain around indefinitely if no other process gets allocated those same addresses and overwrites it with its own data. On modern operating systems this again requires the ability to read RAM not allocated to the process doing the reading1, and even then is unreliable at best, especially on modern systems that are constantly doing all kinds of things.

Both of these can be mitigated, if not outright prevented, by never allowing untrusted processes to run with root/administrator privileges: limited users simply do not have the ability, barring holes in the OS's security model, to access this RAM.

And, of course, there's our good friend the "cold boot attack", where encryption keys etc. are read from RAM after the machine has been powered down. This requires physical access to the machine, a boot disk (or specialized hardware), and quick timing (as data remains resident in RAM for only a short time after it's powered down).

As a quick footnote, the risks of data remanence on hard drives are rather overblown: Once data's been overwritten, it's gone. The "Gutmann 35-pass method", for example, is not only a fundamental misunderstanding of Dr. Gutmann's research, but wholly unnecessary -- a single pass with any data -- ones, zeros, random noise, kitty pictures -- is all that's really necessary. If it's not overwritten, however -- if it's merely deleted -- then it does hang around, though. Data remanence on RAM is similarly an often-overstated risk, though just like hard drives it can and does leak information if you're not careful.


1 The reason is that modern operating systems actually take the time to wipe out RAM before allocating it to a new process, specifically to avoid leaking potentially sensitive data to processes that start up and then read uninitialized data (which in the past is how such leaks were carried out).

  • 1
    Props, I never really considered the practicality of such data-recovery. – Desthro Dec 4 '14 at 19:42
  • 2
    It's worth mentioning that the Windows kernel, at least, has a worker thread dedicated to zeroing freed pages so that it can satisfy future allocations without delay. source1, source2 – Andrew Medico Dec 4 '14 at 22:21
  • Your second paragraph I find a bit hard to follow. I segmentation fault will occur if a process tries to read memory not belonging to it, the memory management unit would see to that. Are you saying sometimes there can be a bug and a fault doesn't occur and it can be read? – Celeritas Dec 5 '14 at 3:04
  • @Celeritas Sometimes there can be a bug, yes. There are, however, ways around the segfault; it's been a long time since I've coded at that low a level, and I no longer remember the specifics, but a process with sufficient privileges can read memory allocated to other processes without provoking a segfault. This is how, for example, many debuggers work, as well as a key tool in modding games that are not generally moddable involves doing the same thing -- basically grabbing dumps of the game's RAM so would-be modders can hack it. – Kromey Dec 5 '14 at 7:14
  • 1
    @Celeritas It works for me. I guess if you can't see it, you'll just have to trust me that it totally validates everything I've said, and also proves incontrovertibly that apples are the far superior fruit! Or I can just copy/paste the link here without formatting in the hopes that this will work for you: codeproject.com/Articles/670373/… – Kromey Dec 5 '14 at 22:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.