Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [memory]

Computer memory refers to a physical device that is used to store sequences of instructions (programs) or data (program state information) on a temporary or permanent basis for use in a computer.

2
votes
1answer
117 views

Is faulty RAM a security risk?

If the RAM is only slightly faulty, so that the machine boots apparently normally, but sometimes crashes. Can the fault be leveraged somehow?
1
vote
1answer
67 views

Is it safe to deploy software without memory protections such as DEP/ASLR?

Several software packages on our SOE Windows machines come with DEP and ASLR memory protections off by default. More troubling is that these applications run as SYSTEM and load their own drivers. ...
2
votes
1answer
174 views

Is zeroing out values on the stack and arguments overkill?

I generally zero out memory the moment it's served its usefulness, but only with heap-allocated chunks. Is it a sin (or overkill) to do the same with arguments and stack values? Thanks in advance. ...
2
votes
0answers
95 views

Format String Vulnerability - Can't read an address from stdin with read() in C

I wanted to exploit this code using format string vulnerability: int jackpot; void fmt_str(void) { char buf[128]; puts("Give me a string to print"); read(0, buf, 128); printf(buf); ...
1
vote
2answers
162 views

Do Anti-Virus programs scan running processes?

If I have malicious software running, and I can see it in the Task Manager, is an AV program expected to scan the processes running and test if they are a virus/malware? Or, does AV have to: Detect ...
0
votes
0answers
35 views

Volatility: Dumping memory associated with a particular process

I'm trying figure out how I can dump the memory associated with a process. So far, I've managed to identify the PID's of the processes I'm interested in (along with their offset). However, I can't ...
0
votes
0answers
24 views

How could unlink be used to overwrite an arbitrary memory location?

I am so lost when it comes to memory management exploits. Hope someone can help! So here is the question: Linux memory management uses bins (double linked lists) to manage free chunks. The unlink ...
0
votes
1answer
33 views

How files are allocated to memory in NTFS? [closed]

If a file is deleted in memory which is using NTFS and after that, I copied a new file, then where is the new file is allocated in memory? Is the file allocated in the deleted memory space or it is ...
1
vote
4answers
143 views

Volatile memory only computer?

I was wondering, is it possible to create a fully volatile computer, with no permanent memory at all (not even in the BIOS), that will be loaded on each boot from a read only live CD? Such that in ...
0
votes
0answers
76 views

Store Credit Card data in memory for using with native payment SDKs (iOS, Android)

I am implementing a Credit Card processing in mobile apps for iOS (Swift) and Android (Kotlin) using native SDK (SAQ A EP compliance level) We thought about: disabling clipboard for CC field ...
1
vote
0answers
27 views

Is it safe for a service to share memory addresses with remote clients?

Supposing a remote service has the following data structures (using C++ as an example): struct Item { std::string name; struct {} whatever_else; }; std::map <std::string, Item *> ...
0
votes
1answer
141 views

read raw dump with WinDBG

Is it possible to convert a full raw dump memory and open it in WinDBG ? In order to inspect if they are no malwares, filter process who call particular API, dump each process in memory etc...
1
vote
1answer
177 views

Are there any observed Rowhammer attacks in the wild

Due to the latest news regarding Rowhammer and its applicability to ECC DRAM, I was wondering whether there are any Rowhammer attacks spotted in the wild. Given the various approaches to conduct a ...
2
votes
1answer
112 views

Does IOMMU protect against malware insertion through PCI Network card/Sound card DMA?

I've just read about this: https://www.tripwire.com/state-of-security/security-data-protection/backdoors-hardware-attacks-rakshasa-malware/ Asides from the question in the title, I'd also like to add ...
1
vote
2answers
108 views

How can memory problems lead to code execution exploits? [closed]

In reports on security exploits/vulnerabilities on desktop applications, I often read that memory problems lead to the execution of malicious code. For example, the description of Internet Explorer ...
0
votes
0answers
45 views

If you buy a used hard drive or CPU, how to guarantee it doesn't have anything installed or running on it [duplicate]

Say you buy a used hard drive, or a computer (wondering about both cases, something that is just a drive for storage, and something that is an actual running chip). I am not interested in whether or ...
2
votes
1answer
51 views

What should I do to develop a secure note taking app in Android 8.0?

One of the factors I considered was, having all the text encrypted and stored in the device memory. But we cannot avoid having raw unencrypted data on the RAM, when the application runs. Won't ...
3
votes
2answers
182 views

Private key management in memory

I'm a developer who's working on a networking protocol that includes encryption. It doesn't really matter, but just for the sake of context I'll mention that I'm using libsodium crypto library. Now ...
1
vote
0answers
50 views

What does it mean to “run a command in memory”? [closed]

If I open a terminal and use the following commands, are they "run in memory"? $ curl -s http://website.com/file.py | python - & $ command=$(curl -s http://website.com/file.py); $(echo $command |...
2
votes
0answers
280 views

How to extract browser login credentials from memory dump? [closed]

Does anyone know if there is a way to extract passwords for social networks like from a browser memory dump? I tried this tutorial without success. I used dumpit.exe tool to make a full dump of the ...
50
votes
3answers
5k views

What is the benefit of having a cryptographically secure hash algorithm in hashmaps?

I recently read the Rust language documentation and saw this: By default, HashMap uses a cryptographically secure hashing function that can provide resistance to Denial of Service (DoS) attacks. ...
0
votes
1answer
89 views

How to securely erase JavaScript parameters after use? [duplicate]

When I pass a password as a parameter to a function, I presume it will end up on a stack or heap. When this function returns I'd expect that my password is still in memory somewhere until it is ...
4
votes
1answer
239 views

If rowhammer only results in capacitor discharge, how can it flip 0 to 1?

In rowhammer, why will changing the voltage on one row cause the other row to open/close? Is it related to induction? How can it change bits from 0 to 1? I understand from 1 to 0 - voltage discharge, ...
5
votes
1answer
570 views

How does full memory encryption in newer processes protect against DMA attacks?

Upcoming Intel CPUs have TME, current AMD processors have SME. These are full-memory encryption techniques to protect against physical attacks such as cold boot attacks. Both support encrypting the ...
1
vote
2answers
528 views

How to remove or at least change password from browser memory dump file [duplicate]

I am working with JSP. So when a user submits a form, all the form fields say username and password gets stored in browser memory dump file in clear text. I even tried with JSP hidden fields, but ...
1
vote
0answers
39 views

How does cache partitioning prevent covert/side-channel attacks? [closed]

In a report on an open-source separation kernel (Muen kernel) I was reading, in the future work section, it says that cache coloring can be implemented to prevent covert/side-channel attacks. It is ...
1
vote
1answer
57 views

Incomplete Data In Format String Dump

I've been practicing format-string attacks lately and I thought I knew how it works but after hours of research I did not manage to get the expected results. I made a sample program which has a ...
1
vote
1answer
274 views

Javascript: remove sensitive data from memory

As stated in this article JavaScript values are allocated when things (objects, strings, etc.) are created and "automatically" freed when they are not used anymore. I recently took a heap ...
16
votes
3answers
3k views

Should crash dumps (e.g. from Breakpad, Windows) be encrypted and signed?

As a software developer, should my crash dumps (e.g. from Breakpad, Windows) be encrypted and signed? I provide the ability to export crash dumps so that I can pinpoint the problem when the user ...
2
votes
1answer
282 views

Cloning a system for forensic analysis

How can I clone a system without leaving any footprint? I want to acquire RAM and other physical hard drives so that after cloning all the work can be done in VM without disturbing the target machine. ...
2
votes
0answers
34 views

Access control to allocated buffer [closed]

I have a system which contains a process which allocates memory to other processes from its internal memory buffer , each process that needs memory allocation has to enroll with the allocating process ...
3
votes
1answer
54 views

Volatility.exe suggests two profiles for XP memory dump. Which one should I use?

Volatility suggests two profiles for XP memory dump. Which one should I use for further investigation? I am a beginner for the volatility.
1
vote
0answers
179 views

Decrypt to memory for editing

I am looking for a secure way to edit sensitive text data, using Git and Vim in the process. An ideal solution would be: clone the encrypted git repository into memory; decrypt into memory; do the ...
3
votes
2answers
172 views

Turing-completeness impact on system security

I always find in many papers discussing different kind of system security subject that the authors always trying to highlight the danger of some vulnerabilities by assuming an attacker, by exploiting ...
2
votes
0answers
260 views

Linux memory acquisition issues

I am reaching out for possible assistance regarding memory acquisition of a linux system. As of yet I have been unable to either acquire or inspect the memory dump with known tools. The following ...
3
votes
1answer
63 views

Exploit development - Will different devices with the same OS/Architecture have the same exact process memory (e.g. addresses) for a given binary?

Sometimes, when I develop an exploit that perfectly works on a given machine, it will fail on a different one, despite them having the same OS/Architecture and configurations (like language, which in ...
0
votes
1answer
73 views

Encrypt a file in the server and decrypt it in the client without risking the user accessing it?

How can I send an encrypted file from a server to a client, encrypt and use it in the client without risking the user to access it? I saw an answer where the server saved a file in its memory, and ...
3
votes
1answer
217 views

Is it possible data which was generated with JavaScript in Google Chrome could exist in my Mac'sRAM?

I generated a private key using this website: https://www.stellar.org/account-viewer/#!/ I was supposed to write down the private key but I didn't and I lost it. I have since unplugged the internet ...
5
votes
2answers
345 views

Spectre/Meltdown - Does memory deallocation erase the actual RAM contents?

The other day I've been thinking about Spectre and Meltdown and the ability of one process to access the memory of another. On my Linux system currently I have all JavaScript disabled to eliminate ...
11
votes
1answer
495 views

If I sell my printer, can the last printed pages be recovered? And how can I wipe it?

I have a Brother 5470-DW Printer. I want to sell it but wanted to make sure all the last prints can't be recovered. If I sold my printer could the last pages printed be recovered? How can I wipe all ...
11
votes
1answer
564 views

Why does this cache attack work?

I was recently reading the following paper about doing a cache attack in Javascript: https://arxiv.org/pdf/1502.07373v2.pdf But I was confused by how it could work. In the paper, an 8 MB buffer was ...
1
vote
1answer
283 views

How can a userspace linux process refer to a kernel address?

I would like help understanding a particular aspect of meltdown. My understanding is that the meltdown bug can be used for a userspace linux process to access kernel memory (indirectly, through a ...
8
votes
3answers
1k views

Why is accessing kernel memory a security risk?

A lot of the news regarding the Meltdown vulnerability is emphasizing that it allows programs to read memory that should be off limits to the user. While I understand that this should not happen, few ...
12
votes
0answers
2k views

DMA attacks despite IOMMU isolation

If you're already familiar with PCI behavior and Linux's handling of DMA buffers, skip to the third section for my actual question. Otherwise read on for a small summary of how PCI devices perform ...
1
vote
0answers
349 views

How can I decrypt my iphones nand flash memory if I have the pin but phone won't turn on? [closed]

Is there some sort of device I can plug my nand flash chip into and then input my pin and get my old notes and things back?
4
votes
1answer
960 views

How can you detect kernel exploits?

Is there something that all kernel exploits have in common? Sure, they all exploit the kernel, but I'm more interested in the underlying mechanisms or the result. At the moment my interest goes ...
2
votes
2answers
170 views

How safe is this scenario security wise

In a project I am working on, I needed to write some cron job scripts, which purpose is, to access some external API's, which have information that shouldn't be accessible by the public. The external ...
4
votes
2answers
457 views

Can data be stolen from RAM in use

The limits of my knowledge on the subject (on any subject) may render this a stupid question. Regardless; Could a malicious program theoretically steal data from primary memory (RAM)? Scenario: I ...
0
votes
1answer
74 views

What files yield the most useful information when an attacker leverages a memory vulnerability?

I'm trying to understand what information is left behind after an attacker exploits a vulnerable application leveraging a memory vulnerability (overflows, ROP, etc.). I wanted to know: What are ...
0
votes
2answers
144 views

Use explicit_bzero() to zero entire memory

Functions like bzero(), explicit_bzero() and ZeroMemory are designed to delete sensitive data from RAM (Like keys). Can I use explicit_bzero() to delete entire RAM (e.g. 2 GB RAM)? Is this a feasible ...