4 ms·
Storing a passphrase (or unlocked private key) in memory is storing it electronically. Once the attacker has root, they can dump the memory and access this inf
by joeyh 14y ago
Storing a passphrase (or unlocked private key) in memory is storing it electronically.
Once the attacker has root, they can dump the memory and access this information. The attacker claims to have gigabytes of data, which could well include a memory image (or swap partition image, if the program that stored this in memory didn't lock the memory to prevent it being swapped out).
- joeyh 14y agoAttacker claims to have done so in this irc log: http://pastebin.com/7WXRDyAg http://pastebin.com/7WXRDyAg > 07:52 < HTP> the CCrypter class of the linode application context was accessable from outside the wwwroot using undocumented ColdFusion methods. i was fully able to decrypt the ccs using the in-memory privkey that they supplied the password for. > 07:53 < HTP> coldfusion runs as a single process, and its memory can be accessed using the ColdFusion wrapper