Suggestion: erase data posted to the Web

From: Andrew Daviel (advax_at_triumf.ca)
Date: 07/07/04

  • Next message: Hubbard, Dan: "Scob variant using IIS 6.0 or just upgrades ?" 
    Date: Wed, 7 Jul 2004 11:30:00 -0700 (PDT)
To: BUGTRAQ@SECURITYFOCUS.COM

    A recent New Scientist article referred to the fact that
    "sensitive data" may persist in computer memory, and be swapped to disk
    and persist after a power-down.

    http://www.newscientist.com/news/news.jsp?id=ns99995064

    I had observed a while ago that text such as credit card numbers entered
    into a form in Netscape could persist in RAM after the application exits,
    and this seems to be still true for Mozilla.

    As discussed earlier in Bugtraq ("When scrubbing secrets in memory doesn't
    work", 19 Nov 2002), in Linux/Unix the mlock() call can be used to
    discourage swapping (MmLockPagableSectionByHandle ? in Win32), while
    overwriting can be used to erase freed memory (as is done in Gnupg).

    It occurs to me that, while an unprivileged process cannot read system
    memory directly, that a simple allocation of a large chunk of memory might
    get data freed up or abandoned by previously running processes. Certain
    data, such as credit card numbers and SINs, have a predictable pattern
    that a regex such as
    /4530[\s]{0,1}[\d]{4}[\s]{0,1}[\d]{4}[\s]{0,1}[\d]{4}[\s]{0,1}[\d]{4}/
    might easily find.

    Given the now common practice of leaving computers powered on with
    "high-speed" internet access, and the recent appearance of trojans such as
    Bankhook.A and Pwsteal.Refest, I suggest that best practice be updated to
    include the erasure and protection of "sensitive data". This would include
    obvious things like passwords, certificates etc. and be extended to
    anything entered into an SSL-protected form in a Web browser. At some
    expense in CPU time, it might include all https displayed pages and any
    user-generated data such as word processor documents.

    One (probably very CPU-intensive, for some apps) way to enforce this
    behaviour for malloc'd memory would be to make free() do an erase
    operation as a system option. Creating "secure_free()" would be better. 

    -- 
Andrew Daviel, TRIUMF, Canada
Tel. +1 (604) 222-7376
security@triumf.ca
  • Next message: Hubbard, Dan: "Scob variant using IIS 6.0 or just upgrades ?"

    Relevant Pages

    • RE: Suggestion: erase data posted to the Web
      ... and sensitive data left on disk after having been paged out. ... > memory might get data freed up or abandoned by previously running ... What you need is a weighted threat model, ...
      (Bugtraq)
    • Re: Encrypting passwords stored in memory
      ... locking the memory using operating system features to prevent memory ... These techniques prevent sensitive data from being dumped on mass ... agains some attacks and portable. ... Security Modules) or TCPA/TPM ...
      (sci.crypt)
    • Re: data security erase of memory and swap?
      ... > My question for Linux is whether applications that pass sensitive data ... > leftover data in memory or swap. ... Your fallacy is that someone can access memory or swap. ...
      (comp.os.linux.development.system)
    • Re: Reply to Wolf
      ... "Memory" is a noun, and naive users of language therefore think it must ... you seem to be claiming that because human memory doesn't work ... like computer memory, we shouldn't call human memory memory. ... Conditioning is always "unconscious", even operant conditioning, ...
      (comp.ai.philosophy)
    • Serendipitous computer repair
      ... There was a thread not too long ago about computer memory; ... I had set that aside for when I want to bother to take ... boot up to Linux, and free reports about 56 MB of memory. ...
      (sci.electronics.design)