4 ms·

But users are constantly providing the master password to use the application normally. The only complaint is that after first providing the master password to

But users are constantly providing the master password to use the application normally. The only complaint is that after first providing the master password to cause the application to decrypt the document, the application decrypts the document, and if someone has modified the application to do other stuff after decrypting the document, it does that stuff. They're proposing that the author change the application so that it pops up a dialog whenever the KeePass application is directed to export the decrypted document. I'm not a KeePass dev, but with a bit of search and pattern recognition, it looks like this export feature is implemented in KeePass-2.53-Source\KeePass\DataExchange\ExportUtil.cs: public static bool Export(PwExportInfo pwExportInfo, FileFormatProvider fileFormat, IOConnectionInfo iocOutput, IStatusLogger slLogger) { PwDatabase pd = pwExportInfo.ContextDatabase; ... // [IF CONFIG FILE DOESN'T ALLOW EXPORTING WITHOUT KEY] if(!AppPolicy.Current.ExportNoKey && (pd != null)) { // [THEN ASK FOR IT AGAIN] if(!KeyUtil.ReAskKey(pd, true)) return false; } ... Stream s = (bFileReq ? IOConnection.OpenWrite(iocOutput) : null); try { bResult = fileFormat.Export(pwExportInfo, s, slLogger); } finally { if(s != null) s.Close(); } } They're complaining that an evil maid attack can turn off `AppPolicy.Current.ExportNoKey` and set it up to export the document silently. They want it to read: public static bool Export(PwExportInfo pwExportInfo, FileFormatProvider fileFormat, IOConnectionInfo iocOutput, IStatusLogger slLogger) { PwDatabase pd = pwExportInfo.ContextDatabase; ... // [ALWAYS ASK FOR MASTER PASSWORD AGAIN BEFORE EXPORTING] if(!KeyUtil.ReAskKey(pd, true)) return false; ... Stream s = (bFileReq ? IOConnection.OpenWrite(iocOutput) : null); try { bResult = fileFormat.Export(pwExportInfo, s, slLogger); } finally { if(s != null) s.Close(); } } They've even gone so far as to ask the author to create a "KeePass Essentials" version, which removes the export feature, plugins, and configuration files entirely: https://sourceforge.net/p/keepass/feature-requests/2704/#b3cb https://sourceforge.net/p/keepass/feature-requests/2704/#b3c... But they ignore that with write access to the application directory, an attacker can just change the application to not show that dialog at all.

detaro 4y ago
Application directory and Application Settings directory are not the same thing, usually. (Indeed usually on Windows and Linux, the former isn't writeable to the user account without elevating privileges, the latter is)
- wcoenen 4y ago
  I checked where the relevant files are when installing KeePass 2 for windows. There is a global configuration file at "C:\Program Files\KeePass Password Safe 2\KeePass.config.xml" but by default, this one just contains a directive to use the user's configuration. This one also needs elevated privileges to edit. The user's configuration file is at "C:\Users\<username>\AppData\Roaming\KeePass\KeePass.config.xml" So if you want to avoid an attacker being able to change the user's configuration without elevation, then you can just change the security settings of that last file, e.g. by taking away the user write permission. However, the user is probably launching the KeePass executable via some sort of shortcut. For example, a pinned shortcut on the taskbar. This would also be a user file, at "C:\Users\<username>\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\KeePass 2.lnk" So if the attacker can modify the user's files, then they can probably also modify that shortcut, e.g. to point at a modified copy of keepass. This shows that the behavior of the "real" KeePass application is probably not very relevant here. It is difficult to defend against an attacker with that level of access.
aunlead 4y ago
> They're complaining that an evil maid attack can turn off `AppPolicy.Current.ExportNoKey` and set it up to export the document silently. If an evil maid has access to make such a change, wouldn't it be easier to just replace keepass.exe with custom version? The source is already available. Just call this function after successful login - ignoring XML configuration, "KeePass Essentials" version, etc.
H4ZB7 4y ago
business logic

detaro 4y ago

Application directory and Application Settings directory are not the same thing, usually. (Indeed usually on Windows and Linux, the former isn't writeable to the user account without elevating privileges, the latter is)

wcoenen 4y ago
I checked where the relevant files are when installing KeePass 2 for windows. There is a global configuration file at "C:\Program Files\KeePass Password Safe 2\KeePass.config.xml" but by default, this one just contains a directive to use the user's configuration. This one also needs elevated privileges to edit. The user's configuration file is at "C:\Users\<username>\AppData\Roaming\KeePass\KeePass.config.xml" So if you want to avoid an attacker being able to change the user's configuration without elevation, then you can just change the security settings of that last file, e.g. by taking away the user write permission. However, the user is probably launching the KeePass executable via some sort of shortcut. For example, a pinned shortcut on the taskbar. This would also be a user file, at "C:\Users\<username>\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\KeePass 2.lnk" So if the attacker can modify the user's files, then they can probably also modify that shortcut, e.g. to point at a modified copy of keepass. This shows that the behavior of the "real" KeePass application is probably not very relevant here. It is difficult to defend against an attacker with that level of access.

aunlead 4y ago

> They're complaining that an evil maid attack can turn off `AppPolicy.Current.ExportNoKey` and set it up to export the document silently. If an evil maid has access to make such a change, wouldn't it be easier to just replace keepass.exe with custom version? The source is already available. Just call this function after successful login - ignoring XML configuration, "KeePass Essentials" version, etc.

H4ZB7 4y ago

business logic