0

On .net we use SecureString class to keep our applications variables in memory, safely.

Microsoft says: Represents text that should be kept confidential. The text is encrypted for privacy when being used, and deleted from computer memory when no longer needed. This class cannot be inherited.

This class is in a library called mscorlib.dll I have doubts about security. Can someone replace this library with a corrupted one? A malware can corrupt this class to bypass its security and after that it can dump memory and access my variables in plain text. Is it a possible attack? If so, how can I protect my software against this attack?

2

SecureString doesn't protect you if you already have malware running with high privilege. It's not possible to do so, for SecureString or anything else. You can't protect your software from this kind of attack; if you can't trust your copy of mscorlib or anything else running in your process, you've already lost.

What SecureString does is ensure that if a machine is compromised in the future, any newly-installed malware can't recover historical SecureString content from previously-used storage. This might make life harder for the attacker in that they would have to sustain running without the infection being detected and removed, to pick up content as it is used, instead of dumping mass content in one go.

This is a marginal win at best. Depending on the application and its threat model, SecureString may be a worthwhile mitigation or it may offer little or no value.

  • So if I embed a clean copy of mscrolib.dll inside my application and extract this every startup, is it increase security a bit? And I want to make a research about this, is there a name for this kind of attacks? – Batuhan May 10 '15 at 17:34
  • No, that would be a waste of time. If an attacker is in a position to replace system files then they are running as an administrator and there is nothing you can do to protect any application at this point. – bobince May 12 '15 at 7:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.