0

On .net we use SecureString class to keep our applications variables in memory, safely.

Microsoft says: Represents text that should be kept confidential. The text is encrypted for privacy when being used, and deleted from computer memory when no longer needed. This class cannot be inherited.

This class is in a library called mscorlib.dll I have doubts about security. Can someone replace this library with a corrupted one? A malware can corrupt this class to bypass its security and after that it can dump memory and access my variables in plain text. Is it a possible attack? If so, how can I protect my software against this attack?

1 Answer 1

2

SecureString doesn't protect you if you already have malware running with high privilege. It's not possible to do so, for SecureString or anything else. You can't protect your software from this kind of attack; if you can't trust your copy of mscorlib or anything else running in your process, you've already lost.

What SecureString does is ensure that if a machine is compromised in the future, any newly-installed malware can't recover historical SecureString content from previously-used storage. This might make life harder for the attacker in that they would have to sustain running without the infection being detected and removed, to pick up content as it is used, instead of dumping mass content in one go.

This is a marginal win at best. Depending on the application and its threat model, SecureString may be a worthwhile mitigation or it may offer little or no value.

2
  • So if I embed a clean copy of mscrolib.dll inside my application and extract this every startup, is it increase security a bit? And I want to make a research about this, is there a name for this kind of attacks?
    – Batuhan
    Commented May 10, 2015 at 17:34
  • No, that would be a waste of time. If an attacker is in a position to replace system files then they are running as an administrator and there is nothing you can do to protect any application at this point.
    – bobince
    Commented May 12, 2015 at 7:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .