4 ms·

Well, WRT to malware, KeePass can somewhat mitigate generalized threats. Say, in-memory encryption to protect against memory dumps, using a secure desktop [1]

Well, WRT to malware, KeePass can somewhat mitigate generalized threats. Say, in-memory encryption to protect against memory dumps, using a secure desktop [1] for the master password, and typing obfuscation during auto-type to protect against keyloggers. Well, keyloggers that aren't written with KeePass in mind, at least. Both of those would give it a modest edge over plain text in an encrypted container. [1] http://keepass.info/help/base/security.html#secdesktop http://keepass.info/help/base/security.html#secdesktop This said, both secure desktops and auto-type obfuscation are turned off by default...

ultramancool 11y ago
The whole "secure desktops" thing is a bit of an oxymoron too. If you can gain admin privileges you can steal any desktop and session token you want and keylog it. I've used that trick before to keylog winlogon's "secure" desktop, so surely KeePass would be similarly vulnerable? Additionally a quick patch or in memory modification of KeePass.exe would easily bypass any protection like this, lookup the KeeFarce tool to see an example. I'd hardly call this an "edge" over plain text files in an encrypted container, considering it does nothing to actually prevent exploitation but simply provides a form of security through obscurity. Ultimately once a system is infected, all you can do are half-measures and will wind up worthless against even a mildly sophisticated attacker. Unless you run the software in a separate machine, you're dead in the water and it's pointless to discuss what happens post-infection when anything is really possible.
- briHass 11y ago
  Well, KeePass.exe is signed, which prevents the malware replacing/modifying the exe. I personally run it as Admin and lock my keyfile down to admin accounts, which prevents against an un-elevated user process from stealing anything of value. I guess if the malware get's admin access I'm hosed, but that's pretty much game over anyway.
  - ultramancool 11y ago
    > Well, KeePass.exe is signed, which prevents the malware replacing/modifying the exe Windows doesn't require executable to be signed, strip the signature from the PE file and unless the user verifies it they're still dead in the water. Not good enough? Okay, install a new certificate for code signing the patched PE file and sign it yourself. As for user isolation, it's a great idea but you could take advantage of this isolation with the filesystem method too simply by making the files only readable by an administrator and running a text editor or search tool as an admin so I'd still say this is not an advantage over the encrypted disk image method. EDIT: Cleaned up.

ultramancool 11y ago

The whole "secure desktops" thing is a bit of an oxymoron too. If you can gain admin privileges you can steal any desktop and session token you want and keylog it. I've used that trick before to keylog winlogon's "secure" desktop, so surely KeePass would be similarly vulnerable? Additionally a quick patch or in memory modification of KeePass.exe would easily bypass any protection like this, lookup the KeeFarce tool to see an example. I'd hardly call this an "edge" over plain text files in an encrypted container, considering it does nothing to actually prevent exploitation but simply provides a form of security through obscurity. Ultimately once a system is infected, all you can do are half-measures and will wind up worthless against even a mildly sophisticated attacker. Unless you run the software in a separate machine, you're dead in the water and it's pointless to discuss what happens post-infection when anything is really possible.

briHass 11y ago
Well, KeePass.exe is signed, which prevents the malware replacing/modifying the exe. I personally run it as Admin and lock my keyfile down to admin accounts, which prevents against an un-elevated user process from stealing anything of value. I guess if the malware get's admin access I'm hosed, but that's pretty much game over anyway.
- ultramancool 11y ago
  > Well, KeePass.exe is signed, which prevents the malware replacing/modifying the exe Windows doesn't require executable to be signed, strip the signature from the PE file and unless the user verifies it they're still dead in the water. Not good enough? Okay, install a new certificate for code signing the patched PE file and sign it yourself. As for user isolation, it's a great idea but you could take advantage of this isolation with the filesystem method too simply by making the files only readable by an administrator and running a text editor or search tool as an admin so I'd still say this is not an advantage over the encrypted disk image method. EDIT: Cleaned up.