‘Memsad’ software rot threatens to leak your digital secrets

guest · Apr 5, 2019

‘Memsad’ software rot threatens to leak your digital secrets
April 2, 2019
https://the-parallax.com/2019/04/02/memsad-threatens-digital-secrets/

The first vulnerability stems from compilers’ failure to always instruct software to clear mission-critical data from the computer’s memory. Researchers have known about this vulnerability for more than 30 years. But without an easily reproducible way to extract the data, not much has been done to address the problem.

The second vulnerability, van Sprundel’s research shows, is more likely to appear when mission-critical data is present in memory. It can be exploited to extract the data from the computer’s memory, exposing passwords, keys, and tokens we use to protect our data.

“[Memsad] is literally everywhere. It’s in the stuff that everybody uses,” he says. “If we can’t get it right, what hope is there for mere mortals?”
Van Sprundel considers memsad a major problem in software security because it causes leaks of some of the most critical safety mechanisms in use today: encrypted passwords, authentication keys, and session tokens.
Click to expand...

“Compiler optimization and cryptography, at the present time, are mutually exclusive. It doesn’t work,” he says. “We need to have a new way of marking a buffer or temporary storage as sensitive.”

Dan Kaminsky, a security researcher known for his work finding a fundamental security flaw in DNS [...] He says he worries that the complexity of the memsad problem will require equally complex solutions. And he compares potential solutions to sandboxing, or attempting to wall off, the vulnerabilities.
Click to expand...

Log in or Sign up

‘Memsad’ software rot threatens to leak your digital secrets

guest Guest

Log in or Sign up

‘Memsad’ software rot threatens to leak your digital secrets

guest Guest

Useful Searches