22

I'm working on a Java password manager and I currently have all of the user's data, after being decrypted from a file, sitting around in memory at all times and stored plainly as a String for displaying in the UI etc.

Is this a security risk in any way? I'm particularly concerned with someone "dumping" or reading the computer's memory in some way and finding a user's naked data.

I've considered keeping all sensitive pieces of data (the passwords) encrypted and only decrypting each piece as needed and destroying thereafter... but I'd rather not go through and change a lot of code on a superstition.

jscs
  • 63,694
  • 13
  • 151
  • 195
defectivehalt
  • 2,462
  • 3
  • 21
  • 22

4 Answers4

27

If your adversary has the ability to run arbitrary code on your target machine (with the debug privileges required to dump a process image), you are all sorts of screwed.

If your adversary has the ability to read memory at a distance accurately (ie. TEMPEST), you are all sorts of screwed.

Protect the data in transit and in storage (on the wire and on the disk), but don't worry* about data in memory.

*Ok, there are classes of programs that DO need to worry. 99.99% of all applications don't, I'm betting yours doesn't.

Kevin Montrose
  • 22,191
  • 9
  • 88
  • 137
  • So, essentially, if I were to make the change and keep all of the data encrypted, it would just make something already very hard/unlikely even harder. I can imagine finding the byte[] containing the AES key is _much_ harder than finding plaintext. – defectivehalt Jan 06 '10 at 21:57
  • 3
    Not really in Java; it becomes a search for a byte[] object of a given size (as opposed to a String object) in the heap. But yeah, the kind of attacker you're concerned about is so vanishingly rare you'd be wasting your time trying to defend against them (and probably not succeeding). – Kevin Montrose Jan 06 '10 at 22:06
  • Couldn't agree more with you Kevin. – Tower Jan 07 '10 at 11:37
  • Sadly some operating systems write "file tips" to any file on disk padding the blocks with old memory contents, This issue is very popular in the forensic computing area, and represent continuous security leaks that are hard to plug. – Tim Williscroft Nov 27 '12 at 07:28
  • 3
    Kevin's code is the type that gets pwned by Heartbleed. – mheyman Apr 15 '14 at 18:09
  • You don't necessarily need debug privileges in order to extract a key/password from memory. Unless you do something like `mlock`, your sensitive data in RAM could be paged to the disk. Depending on the permissions set up on the swap files, those could be read by other processes. They could also be unintentionally archived in full-disk backups and disk clones, which enshrines the fuck-up for the ages – Alexander Jul 11 '17 at 14:43
6

It is worth noting that the OS might decide to swap memory to disk, where it might remain for quite a while. Of course, reading the swap file requires strong priviledges, but who knows? The user's laptop might get stolen ...

meriton
  • 68,356
  • 14
  • 108
  • 175
5

Yes it certainly is, especially since you quite trivially can debug an application. Most code dealing with encryption and unsafe data use char arrays instead of strings. By using char arrays, you can overwrite the memory with sensitive details, limiting the lifetime of the sensitive data.

Alexander Torstling
  • 18,552
  • 7
  • 62
  • 74
5

In theory, you cannot protect anything in memory completely. Some group out there managed to deep freeze the memory chips and read their contents 4 hours after the computer was turned off. Even without going to such lengths, a debugger and a breakpoint at just the right time will do the trick.

Practically though, just don't hold the plaintext in memory for longer than absolutely necessary. A determined enough attacker will get to it, but oh well.

Seva Alekseyev
  • 59,826
  • 25
  • 160
  • 281
  • Your comment on '4 hours' is wrong, that might be possible only when you [freeze](https://www.usenix.org/legacy/event/sec08/tech/full_papers/halderman/halderman.pdf) the RAM with nitrogen or so. – Yaroslav Nikitenko Jan 06 '17 at 15:56
  • I never said anything about room temperature :) The group managed it, ergo, the statement is technically correct. – Seva Alekseyev Jan 06 '17 at 16:17
  • your statement is misleading in this context, since the original poster did not say anything about sub-zero temperatures. Your may edit your post to specify these conditions though. – Yaroslav Nikitenko Jan 07 '17 at 16:07