Keep your memory dump shut: Unveiling data leaks in password managers
Fuente:
arXiv
Saved in:
| Main Authors: | , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2024
|
| Subjects: | |
| Online Access: | |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866929298189844480 |
|---|---|
| author | Chatzoglou, Efstratios Kampourakis, Vyron Tsiatsikas, Zisis Karopoulos, Georgios Kambourakis, Georgios |
| author_facet | Chatzoglou, Efstratios Kampourakis, Vyron Tsiatsikas, Zisis Karopoulos, Georgios Kambourakis, Georgios |
| contents | Password management has long been a persistently challenging task. This led to the introduction of password management software, which has been around for at least 25 years in various forms, including desktop and browser-based applications. This work assesses the ability of two dozen password managers, 12 desktop applications, and 12 browser-plugins, to effectively protect the confidentiality of secret credentials in six representative scenarios. Our analysis focuses on the period during which a Password Manager (PM) resides in the RAM. Despite the sensitive nature of these applications, our results show that across all scenarios, only three desktop PM applications and two browser plugins do not store plaintext passwords in the system memory. Oddly enough, at the time of writing, only two vendors recognized the exploit as a vulnerability, reserving CVE-2023-23349, while the rest chose to disregard or underrate the issue. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2404_00423 |
| institution | arXiv |
| publishDate | 2024 |
| record_format | arxiv |
| spellingShingle | Keep your memory dump shut: Unveiling data leaks in password managers Chatzoglou, Efstratios Kampourakis, Vyron Tsiatsikas, Zisis Karopoulos, Georgios Kambourakis, Georgios Cryptography and Security Password management has long been a persistently challenging task. This led to the introduction of password management software, which has been around for at least 25 years in various forms, including desktop and browser-based applications. This work assesses the ability of two dozen password managers, 12 desktop applications, and 12 browser-plugins, to effectively protect the confidentiality of secret credentials in six representative scenarios. Our analysis focuses on the period during which a Password Manager (PM) resides in the RAM. Despite the sensitive nature of these applications, our results show that across all scenarios, only three desktop PM applications and two browser plugins do not store plaintext passwords in the system memory. Oddly enough, at the time of writing, only two vendors recognized the exploit as a vulnerability, reserving CVE-2023-23349, while the rest chose to disregard or underrate the issue. |
| title | Keep your memory dump shut: Unveiling data leaks in password managers |
| topic | Cryptography and Security |
| url | https://arxiv.org/abs/2404.00423 |