12 votes

What is the most secure way of transferring a secret between 2 processes running on the same system?

If your threat model includes "malicious processes running as the same user as the legitimate process that needs the key", you need to go back to the drawing board and redesign. It is not possible to ...
CBHacking's user avatar
  • 48.4k
6 votes
Accepted

Is it possible for unprivileged user to modify/inject into other user's (root) process?

This is far from being a simple task thanks to memory protection techniques. In the old times of MS-DOS, Windows 9x and equivalent home computing systems, the memory was indeed equally shared amongst ...
WhiteWinterWolf's user avatar
6 votes
Accepted

Do Anti-Virus programs scan running processes?

AV's wont continously scan for running processes as it is an expensive operation. It is better to use WMI for process launch notifications. As far as in-memory detection is concerned, AVs usually ...
Ashutosh Raina's user avatar
6 votes
Accepted

How to dump the memory of a given process with Volatility 3?

To dump the whole memory (not only binary itself) of the given process in Volatility 3 you need to use windows.memmap.Memmap plugin with --pid and --dump options as explained here. For example: vol.py ...
Oleg Kazakov's user avatar
6 votes

Does a compromised device always show an alien process running?

No. Scenario 1: A rootkit is running, which could hide any malicious processes which are running. Scenario 2: One of the 'usual' processes which you referred to could have been compromised, and you ...
Dan Landberg's user avatar
  • 3,322
5 votes

IT Security Process Vs People

But how do you dis-entangle "Process" from "People" because people implement the process? People come and go - but if there is a good Process, and reasonable documentation of that process, then the ...
gowenfawr's user avatar
  • 72.9k
5 votes
Accepted

Is it possible to extract encryption keys from software executing on your own system?

You don't say that you're dealing with malware, but I will assume you are. If the application is doing encryption, then of course it has the key. The fundamental approaches are to either analyze the ...
Mike Ounsworth's user avatar
4 votes

Why are PID suffixed temporary files a vulnerability

The issue is that the attacker can create a symlink before a vulnerable program can. For example, you could write a script that watches the process list, and as soon as a program with the right name ...
Lie Ryan's user avatar
  • 31.4k
4 votes
Accepted

Secure TCP traffic for inter process communication

If you want to restrict inter process communication on a machine, I'd suggest doing away with TCP and instead uses Unix domain socket. Unix domain socket can be used exactly the same way as TCP (it's ...
Lie Ryan's user avatar
  • 31.4k
4 votes
Accepted

accessing ELF in memory (Unix/Linux)

You can read the copy of the ELF (PT_LOAD) segments loaded in memory through process_vm_ready() and such. You can patch the read-only ELF segments using ptrace PTRACE_POKETEXT. This is used to insert ...
ysdx's user avatar
  • 1,521
3 votes

How attaching to a process with a debugger can compromise system's security?

Your note that it's a "different user's process" is the key here. If the malicious process is limited to that user's context, then attaching a debugger (which usually requires deep permissions) gives ...
schroeder's user avatar
  • 129k
3 votes
Accepted

SSL Pinning: Managing changes in the pinned certification on client side

You can pin more than one certificate, and you should pin at least 2. If somehow you lose access to one certificate, you can use the second. With only one certificate, nobody that connected to your ...
ThoriumBR's user avatar
  • 54.1k
3 votes

Securing a process from local users

As long as the user is not a local administrator on the machine they should not have permission to kill any processes run as other users (including domain administrators). However unless you have an ...
Hector's user avatar
  • 10.9k
3 votes

Should a user be able to reset his password if his email address has not been verified yet?

The correct sign up procedure is as follow: Alices signs up with a new password and an email address (x@y) the account is created as blocked until email address validation Alices tries to login and ...
Serge Ballesta's user avatar
3 votes

Can results from DAST (Dynamic Application Security Testing) tools be false positive?

DAST can absolutely have false positives. It depends on the tool that you are using, but there are some that can give you hundreds of false positives. For example, a tool might check for SQL ...
Brian Williams's user avatar
3 votes

Can results from DAST (Dynamic Application Security Testing) tools be false positive?

Oh yeah, I literally just finished triaging through a report full of false positives (I raised one legitimate ticket out of a 20 page DAST report). And by that I mean that, like @BrianWilliams' ...
Mike Ounsworth's user avatar
3 votes
Accepted

Prevent a process from reading my process list

In General You can not do this easily as a user. Windows provides an API which does not require elevated privileges to get this list of running processes: https://docs.microsoft.com/en-us/windows/...
Josiah's user avatar
  • 241
3 votes
Accepted

How can a bad process obtain root by waiting for a user to run a command as sudo?

You're right that sudo only grants elevated privileges to the command you run with it. What the commenter is referring to is that running processes in a Linux desktop session can watch the keystrokes ...
ArkaneMoose's user avatar
3 votes
Accepted

Why does Windows allow non-parent processes to read/write the memory of a process?

The Windows (and, for that matter, Linux) security model generally holds that everything a user (in the "login account" sense) does is done at the same trust level. In other words, any two processes ...
CBHacking's user avatar
  • 48.4k
3 votes

Why does Windows allow non-parent processes to read/write the memory of a process?

Traditionally, it was possible in Linux to read the memory of your own processes, too. Please note that being able to attach other processes is very useful when debugging, either directly for your ...
Ángel's user avatar
  • 18.8k
3 votes
Accepted

Child processes vs microservices for communication between components

Pipes are a local form of communication. It would make no sense to encrypt them. Anything that can spy on traffic on a pipe could also spy on the processes themselves. Anonymous pipes are pretty safe ...
Gilles 'SO- stop being evil''s user avatar
2 votes

Identify Malicious/Suscipicous Processes from Process List

There are many heuristics by which you can find what all processes are malicious or not. I'll explain this with some examples: Malware tends to use common exe names to hide from detection tools. In ...
Ashutosh Raina's user avatar
2 votes
Accepted

How does metasploit persistence work?

From the source code of the meterpreter persistence script, the delay parameter is passed to the VBS executable that is created. When you check the VBS creation code, you can see that it runs ...
schroeder's user avatar
  • 129k
2 votes

What remote forensic technique could be used to discover a malware running via process injection

I would definitely use Process Mon from Sys Internals as well. Link: Process Monitor Download Page I would also look into AutoRuns as well from the same site. If by chance the malware is persistent, ...
Tyler Gallenbeck's user avatar
2 votes
Accepted

How attaching to a process with a debugger can compromise system's security?

If you scroll down the page of the provided msdn link under the See Also heading there's a link to Debugger Security which states: The ability to debug another process gives you extremely broad ...
user2320464's user avatar
  • 1,852
2 votes

Secure TCP traffic for inter process communication

Listening on localhost traffic is possible on Windows and Linux as well. In Linux tcpdump -i lo. You should consider at least encoding with special algorithm your communication and also consider ...
Opaida's user avatar
  • 323
2 votes

Process Hollowing and Kernel

That would most likely be the Virtual address descriptor (VAD). More information about Process Hollowing techniques can be found at https://cysinfo.com/detecting-deceptive-hollowing-techniques/
exp101t's user avatar
  • 21
2 votes

Securing a process from local users

Barring any exploits, there are two different scenarios here. If the process is owned by a different user account (e.g. it's owned by the local system account): One needs to be a member of the local ...
Justine Krejcha's user avatar
2 votes

What hardware can a user-mode process access?

I am not entirely sure of this, so please feel free to correct me. I read up on how user space device drivers on linux work in this article: Device drivers in user space. As far as I can tell they ...
John Smith's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible