Sensitive Data In Memory

Question

I'm working on a Java password manager and I currently have all of the user's data, after being decrypted from a file, sitting around in memory at all times and stored plainly as a String for displaying in the UI etc.

Is this a security risk in any way? I'm particularly concerned with someone "dumping" or reading the computer's memory in some way and finding a user's naked data.

I've considered keeping all sensitive pieces of data (the passwords) encrypted and only decrypting each piece as needed and destroying thereafter... but I'd rather not go through and change a lot of code on a superstition.

Calicut

Answer 1

If your adversary has the ability to run arbitrary code on your target machine (with the debug privileges required to dump a process image), you are all sorts of screwed.

If your adversary has the ability to read memory at a distance accurately (ie. TEMPEST), you are all sorts of screwed.

Protect the data in transit and in storage (on the wire and on the disk), but don't worry* about data in memory.

_{*Ok, there are classes of programs that DO need to worry. 99.99% of all applications don't, I'm betting yours doesn't.}

Appellate

So, essentially, if I were to make the change and keep all of the data encrypted, it would just make something already very hard/unlikely even harder. I can imagine finding the byte[] containing the AES key is much harder than finding plaintext. – Calicut

Not really in Java; it becomes a search for a byte[] object of a given size (as opposed to a String object) in the heap. But yeah, the kind of attacker you're concerned about is so vanishingly rare you'd be wasting your time trying to defend against them (and probably not succeeding). – Appellate

Couldn't agree more with you Kevin. – Weigel

Sadly some operating systems write "file tips" to any file on disk padding the blocks with old memory contents, This issue is very popular in the forensic computing area, and represent continuous security leaks that are hard to plug. – Archidiaconal

Kevin's code is the type that gets pwned by Heartbleed. – Tabular

You don't necessarily need debug privileges in order to extract a key/password from memory. Unless you do something like mlock, your sensitive data in RAM could be paged to the disk. Depending on the permissions set up on the swap files, those could be read by other processes. They could also be unintentionally archived in full-disk backups and disk clones, which enshrines the fuck-up for the ages – Wayzgoose

Answer 2

It is worth noting that the OS might decide to swap memory to disk, where it might remain for quite a while. Of course, reading the swap file requires strong priviledges, but who knows? The user's laptop might get stolen ...

Appalachia

Answer 3

Yes it certainly is, especially since you quite trivially can debug an application. Most code dealing with encryption and unsafe data use char arrays instead of strings. By using char arrays, you can overwrite the memory with sensitive details, limiting the lifetime of the sensitive data.

Blither

If you can debug a program, you can grab the ciphertext AND the key and generate the plaintext yourself. Debug privileges are practically impossible to defend against. – Appellate

Yes, you have a point there. But it does make a text search a little bit tricker. – Blither

@Xepoch: Well, if an attacker knows the victim's root password it's not my fault. – Calicut

@KavonFarvardin, I have not tried this lately, but I believe /proc/PID/mem also works as user-owned procs. – Syllabism

Answer 4

In theory, you cannot protect anything in memory completely. Some group out there managed to deep freeze the memory chips and read their contents 4 hours after the computer was turned off. Even without going to such lengths, a debugger and a breakpoint at just the right time will do the trick.

Practically though, just don't hold the plaintext in memory for longer than absolutely necessary. A determined enough attacker will get to it, but oh well.

Mince

Your comment on '4 hours' is wrong, that might be possible only when you freeze the RAM with nitrogen or so. – Hygrothermograph

I never said anything about room temperature :) The group managed it, ergo, the statement is technically correct. – Mince

your statement is misleading in this context, since the original poster did not say anything about sub-zero temperatures. Your may edit your post to specify these conditions though. – Hygrothermograph