27

In a perfect world, you are right: there should be no point in keeping data encrypted in RAM. The OS should keep strong separation between processes, clear RAM when it is reallocated to another process, and, if the attack model allows for an attacker stealing the device afterwards and doing some harddisk analysis, encrypt the swap (or use no swap at all, ...


24

I was curious of this myself once, and wrote a small program under linux that malloc'ed all available memory and dumped it to disk. It turned out that it was all zeroed out before it was handed to my application. Later, I also checked the kernel code, and could confirm it was the kernel who did it. -- I think it makes perfectly sense that it is the OS ...


23

In Linux, processes is able to read another process memory when any of the following conditions applies: The process had root permission or it can read /proc/$PID/mem or /dev/mem, by default /proc/$PID/mem and /dev/mem are only accessible by root Parent process can fork()/clone() in such a way that allows it to read some or all memory of its child processes ...


19

Don't worry about it. If an attacker can replace system libraries that are being used by your application, then you have been totally compromised and can't trust anything in your app. It's not a situation you can really protect against.


9

The attack you describe doesn't work on Windows. Starving the page-zeroing thread doesn't prevent zeroing, it only delays it. The existence of the page-zeroing background task is a performance optimization. Basically, a naive memory manager with a privacy guarantee works like this: reserve a page from the freed list zero it make it available to ...


8

Without adding any additional hardware, is RAM encryption possible? Sure. You can encrypt whatever you like in RAM, just like you encrypt everything else. The more interesting quesstion is "where are the keys". You can just leave the keys in RAM as well or give them to the OS which will also store them in RAM. You can apply some of the fancy techniques ...


8

Modern operating systems work with virtual memory management so that by default it is not possible for user-space / user-mode processes to directly access other processes memory. But in Windows (don't know if this apply to Linux, too) there are interfaces that allow standard users to access the process memory of other processes running with the same ...


7

My understanding of your question is that you control the application which will access the device but not the device's OS itself. In such a case you will not have the capacity to ensure that what is read from the hardware is correct, except if that information is signed by the hardware and you can check the signature elsewhere (not on the device itself). ...


6

Memory can become visible to other processes by: being available once the original process using it has returned it to the OS. Memory isn't cleared and a successive process could perform a malloc() and retrieve info belonging to a previously running process (note chapter 8 of Linux Device Drivers - particularly the footnote on the first page) pages being ...


5

It is absolutely possible to read the memory of another process but this is only possible with administrative privileges and of course the OS won't allow any process to access any space of the memory that isn't assigned to that process. For Administrative users this is of course possible. In Windows for example this functionality is implemented by default ...


5

DDoS, or Distributed Denial of Service attacks are generally not meant to exploit a bug in code, but rather simply flood the host with packets, causing a denial of service either by saturating the connection to the box or by causing the machine to use all the CPU trying to process the amount of data coming in, the latter being more common on SSL (HTTPS) ...


5

No, it is not possible. The hypervisor controls everything your VM does. The isolation between your VM and other people's VMs relies on the hypervisor. If the hypervisor maps the memory of your VM for its own use, or if it allows other VMs to map it, your VM won't know about it, because of the same isolation mechanisms that don't allow other VMs to access ...


4

According to “Extending the use of RO and NX”, the Linux kernel applies DEP on architectures that supports it (such as arm and amd64, but not 32-bit x86) since kernel version 2.6.38 (I don't know if RHEL/CentOS have applied a similar patch to their kernel — a lot of the work on DEP originated from Red Hat). The W^X principle is mostly followed, but not ...


4

As @Lucas says in his answer, and as it says in the article the OP linked to: So, how does it work? Elcomsoft Forensic Disk Decryptor acquires the necessary decryption keys by analyzing memory dumps and/or hibernation files obtained from the target PC. You’ll thus need to get a memory dump from a running PC (locked or unlocked) with encrypted ...


4

Virtual machines work as sand boxes to keep bad things in, not bad things out. If the host is compromised, so are the containers running within it as the virtual machine has to call out to the host for many actions and the host has full awareness and control over the system running within it.


4

Absolutely, particularly if you are using RAM as non-persistent storage in which case you can encrypt it like any disk, file or directory after partitioning it off and mounting it in namespace. However, executable program data needs to exist as 'plaintext' in memory at some point so it is ineffective to try and protect kernel and program memory in this ...


4

The four ring system was designed by Intel for anyone to use, and Microsoft chose a scheme to simplify development work and provide a faster OS at the cost of some security. As far as Microsoft is concerned, they haven't been phased out, so much as they were never used to begin with. Microsoft didn't ask Intel to make a two ring system; Intel provided a four ...


3

Microsoft (among many others) uses somewhat confusing terminology at times. In this case, "drive" is used in the sense of "drive letter". This is distinct from a "disk", which is a physical storage device. A drive's data may be stored on a physical partition, but the storage location for a "drive" is most properly called a "volume". It might be one partition,...


3

If you want secure access to hardware the only way to do it is a kernel space application (usually known as a driver) which is the "right" way to do it anyway.


3

It's true and it's also very logical. If you want to encrypt something like a disk, then you need your encryption key to be stored in your memory. This is the same as what happens with for instance, single signon. Now think about it, if you hibernate your computer, which has full disk encryption, where is the hibernation file stored? On your encrypted hard ...


3

If an attacker has root access to a machine, they can read all memory, perform debug operations, reverse engineer your java bytecode, etc. There's no practical way to prevent an attacker from obtaining a secret key that's hidden in RAM somewhere. Ultimately, somewhere you're going to store the class files in a running JVM. If an attacker has physical ...


3

That sensational title is, unsurprisingly, missing a qualification: “decrypting BitLocker, PGP, and TrueCrypt disks in real-time” on misconfigured systems. If you have encrypted data on a system, and you want that data to be protected against the theft of the device while it is hibernating, then you must encrypt the hibernation file (or disable hibernation ...


3

We're dealing with the consequences of Von Neumann architecture - the shared memory space for data and code. It has advantages, but as you point out, it has security problems as well, including that attack methodology. If we were starting from scratch, I think there's no reason such a CPU couldn't be built - but many programs, from anti-virus to DRM to ...


2

In C, when you are finished using memory on the heap, you free() it which makes it available for use elsewhere. free() doesn't clear/wipe the memory to all zeros, so the next caller who asks for that memory will get the memory with its sensitive contents still intact unless you explicitly zero it before calling free(). Programs also often implement their own ...


2

“Systems that are configured to allow booting to other operating systems” encompass two situations: A computer with dual boot between two operating systems (e.g. Windows 2003 and Windows 8, or Windows 2003 and Linux) where the two operating systems have different user databases, and in particular different groups of people have administrative access. An ...


2

There are some issues that are specific to the Java world that you have to consider. It is a normal practice that one makes heap dumps of the JVM if a technical issue rises. I'm dealing with an app that even has a dedicated UI for that. This might be incredibly valuable e.g. for finding memory leaks. And sure - yeah - the sensitive information goes into the ...


2

Technically, an operating system could recycle pages from processes that had the same security context, because any information the new process could gather from that would also be accessible to the process directly. This is however completely impractical, because the security context of a process may change over time, and when privileges are dropped (which ...


2

No. Many attacks rely on the address of a library routine, and don't care where the executable is loaded. Pretty much any fixed address can be exploited.


1

Most OSes has to be certified to be used for certain purposes/in certain organisations. Most of them use the Common Criteria framework to different assurance levels and some levels require the OS to clear a page before handing it to another process. An indirect reference to this requirement, which states: One reason zero-initialized pages are required is ...


1

Yes, it's possible, but you need to protect the entire computer, rather than a single folder. It's also a lot harder than you think, and probably not necessary. Network attacks: Do your development on a system that is not, has never, and will never be directly connected to a network. Remove any wireless or bluetooth adapters from the system to prevent ...


Only top voted, non community-wiki answers of a minimum length are eligible