lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <000401c2a566$458beb00$1400020a@chaser>
From: kurt at seifried.org (Kurt Seifried)
Subject: Re: [VulnWatch] Password Disclosure in Cryptainer

Uhh, you do not strictly need physical access. Simple scenarios:

Remote administrative access, does a memory dump.

Laptop or desktop system that supports suspend mode, when in suspend the
contents of memory are written to the harddrive. When brought out of suspend
this data is "deleted" (i.e. the space is marked as free), an attacker could
potentially find the password somewhere on the HD.

System crash in WIndows NT/2000/XP where the person has configured it to
write a memory dump, the attacker could trigger this system crash (and the
resulting memory dump). How many people actually bother to delete emory
dumps after a crash? I thought so.

Data deletion/wiping/protection is a LOT harder then most people think. A
powerpoint of the talk I gave at Hivercon is available at:

http://www.hivercon.com/hc02/talk-seifried.htm

Quite a few technical remote attack scenarios. To say nothing of Legal based
local attacks.

My advice: use a product with a good security track record like PGP and not
these "no-name/generic" apps that 9 times out of 10 are broken beyond
belief.

Kurt Seifried, kurt@...fried.org
A15B BEE5 B391 B9AD B0EF
AEB0 AD63 0B4E AD56 E574
http://seifried.org/security/


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ