[HN Gopher] An exploit can reveal your KeePass master password i...
___________________________________________________________________
An exploit can reveal your KeePass master password in plaintext
Author : el_hacker
Score : 26 points
Date : 2023-05-20 20:24 UTC (2 hours ago)
(HTM) web link (www.pcworld.com)
(TXT) w3m dump (www.pcworld.com)
| icecap12 wrote:
| First significant vuln for KeePass in awhile. Still a better
| threat model than cloud.
| el_hacker wrote:
| My password is a combination of creating a complex password and
| forgetting it + the 'Forgot password' button, Is anyone on the
| same ship?
| waboremo wrote:
| Congratulations you're using Magic Links.
| opan wrote:
| >KeePassXC... which are other password managers compatible with
| KeePass database files, are not affected according to vdohney.
|
| Great.
| psychphysic wrote:
| Although KeePassXC offers better process memory protection, it
| also can not help if you hibernate and the memory is written to
| disk.
|
| Hardware password managers exist and are not so inconvenient.
| mook wrote:
| Isn't it usually set to re-lock on screen lock (which
| typically happens before hibernate)?
| dotancohen wrote:
| Yes, that's the one I use anyway. Great integration with most
| Linux desktops - a keyboard shortcut brings the target window
| to the top and enters the username and password right into the
| proper fields.
| ajuc wrote:
| I think it's time to change the 90s-inspired security
| recommendations.
|
| I work from home. I feel much safer with my password written on a
| piece of paper than with a password manager. God forbid the
| password manager is cloud-enabled.
| TylerE wrote:
| That doesn't solve the problem of having 40 different
| passwords, at least half of which have to be changed on a
| regular basis, NIST guidelines be damned.
| alwaysbeconsing wrote:
| This is definitely reasonable if you like to use readable and
| easily-typed passwords (like Diceware/"correct horse battery
| staple"-style). A software password manager has an advantage
| for long, completely random, absolute gibberish passwords,
| because you don't even have to know what it is: you can just
| copy-paste or autofill it.
| ufo wrote:
| Another advantage of autofill is that it's more resistant to
| phishing attacks.
| 14 wrote:
| I have always felt the same. For me it is easy enough to have a
| little password book with everything written down. People often
| say what happens if there is a fire. I don't have an answer to
| that but I have made it over 4 decades and not once had a fire
| so I'm going to believe the odds are I will not ever have a
| fire and chance it. Most things are recoverable with my phone
| number these days anyways. A much greater risk would be someone
| gaining access to my phone
| dotancohen wrote:
| If you have a fire, you'll just do what my wife does with
| _every_ password field she needs to use. You'll press the
| "forgot password" button.
|
| God help her if she needs to log into her email after I'm
| dead.
| [deleted]
| daveoc64 wrote:
| Aren't you incredibly vulnerable to Credential Stuffing
| (https://en.wikipedia.org/wiki/Credential_stuffing)?
| waboremo wrote:
| You aren't avoiding this problem though, just like this exploit
| requires physical access to disk, someone with physical access
| to your piece of paper negates any benefits. Even worse when
| people are recommending keeping your passwords in your wallet,
| something people lose quite often and due to cash interest
| there's a high incentive to stealing.
| PeterisP wrote:
| The whole concept of "my password" is horribly insecure, as if
| you use the same password everywhere, there is a big risk that
| one of the sites leaks your password and then all your accounts
| are compromised. Whatever risks a cloud-enabled password
| manager has, reusing a single password is so much worse that
| those things aren't even comparable.
|
| Having all your passwords on a piece of paper could be safer
| than a password manager, but it's so inconvenient to store a
| hundred different random passwords this way that people simply
| won't do it and will reuse passwords. So if password managers
| get people out of the password reuse trap, they're a net gain
| in security, that far outweighs all the password manager risks.
| StrangeATractor wrote:
| I think Bruce Schneider recommended that most people should
| just keep their password in their wallet.
| jayknight wrote:
| Source: https://www.schneier.com/blog/archives/2005/06/write_
| down_yo...
|
| But he also wrote his own password manager:
| https://www.schneier.com/academic/passsafe/
| mtlynch wrote:
| I didn't find it so scary due to the fact that it requires the
| attacker to read process memory. But then they pointed out that
| if the process memory gets paged to disk, then an attacker can
| recover the password from disk, which is admittedly scarier.
|
| Still, it does require the attacker to either have root on your
| machine or physical access to your disk. If the attacker has root
| on your machine, it's game over anyway. You can mitigate the
| threat of recovering the password from your disk by using disk
| encryption.
|
| Even when I hear about KeePass vulnerabilities, they're always
| substantially less severe than the attacks we see on LastPass and
| other web-hosted password managers where an attacker can
| exfiltrate bulk credentials at once by compromising a server.
| somat wrote:
| Openbsd encrypts it's swap by default, you can jump through a
| couple of hoops and encrypt your swap on linux. on windows, i
| don't know, however, if you have an encrypted disk your
| pagefile(if on that encrypted disk) will also be encrypted.
| smcleod wrote:
| Mods: the title should be changed to make it clear it's the
| KeePass app for Windows, not the KeePass vault format as used by
| many applications. It is not an exploit Keypass which is the
| encrypted vault used by many applications - but a single client.
| dist-epoch wrote:
| The actual vulnerability:
|
| > KeePass 2.X uses a custom-developed text box for password
| entry, SecureTextBoxEx. This text box is not only used for the
| master password entry, but in other places in KeePass as well,
| like password edit boxes (so the attack can also be used to
| recover their contents).
|
| > The flaw exploited here is that for every character typed, a
| leftover string is created in memory. Because of how .NET works,
| it is nearly impossible to get rid of it once it gets created.
| For example, when "Password" is typed, it will result in these
| leftover strings: *a, **s, ***s, ****w, *****o, ******r,
| *******d. The POC application searches the dump for these
| patterns and offers a likely password character for each position
| in the password.
|
| https://github.com/vdohney/keepass-password-dumper
| gnabgib wrote:
| The source is
| https://www.bleepingcomputer.com/news/security/keepass-explo...
| (as referenced in the article). It goes into more technical
| detail, and skips the antivirus sales pitch.
___________________________________________________________________
(page generated 2023-05-20 23:01 UTC)