bugtraq - Re: Suggestion: erase data posted to the Web

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20040708140050.GA23181@ecs.soton.ac.uk>
Date: Thu, 8 Jul 2004 15:00:50 +0100
From: Nick Lamb <njl98r@....soton.ac.uk>
To: BUGTRAQ@...urityfocus.com
Subject: Re: Suggestion: erase data posted to the Web

On Wed, Jul 07, 2004 at 11:30:00AM -0700, Andrew Daviel wrote:
> It occurs to me that, while an unprivileged process cannot read system
> memory directly, that a simple allocation of a large chunk of memory might
> get data freed up or abandoned by previously running processes. Certain
> data, such as credit card numbers and SINs, have a predictable pattern
> that a regex such as
> /4530[\s]{0,1}[\d]{4}[\s]{0,1}[\d]{4}[\s]{0,1}[\d]{4}[\s]{0,1}[\d]{4}/
> might easily find.

This won't work on a modern Unix (incl Mac OS X or Linux) or Windows, memory
made available to a process is cleared (usually with zeros, but sometimes
with some magic debug value for reasons that should be obvious to developers) 

Of course sometimes there are bugs, but that's the same with any security
critical behaviour in an operating system. If you find such a bug please
report it to your vendor and here on Bugtraq once you're sure.

Nick.

Content of type "application/pgp-signature" skipped