From owner-freebsd-hackers Thu Aug 20 16:00:51 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id QAA14608 for freebsd-hackers-outgoing; Thu, 20 Aug 1998 16:00:51 -0700 (PDT) (envelope-from owner-freebsd-hackers@FreeBSD.ORG) Received: from dingo.cdrom.com (ppp-c0f.dialup.hilink.com.au [203.2.144.39]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id QAA14594 for ; Thu, 20 Aug 1998 16:00:45 -0700 (PDT) (envelope-from mike@dingo.cdrom.com) Received: from dingo.cdrom.com (localhost [127.0.0.1]) by dingo.cdrom.com (8.9.1/8.8.8) with ESMTP id PAA00613; Thu, 20 Aug 1998 15:58:28 GMT (envelope-from mike@dingo.cdrom.com) Message-Id: <199808201558.PAA00613@dingo.cdrom.com> X-Mailer: exmh version 2.0.2 2/24/98 To: Matthew Hagerty cc: freebsd-hackers@FreeBSD.ORG Subject: Re: Trapping memory In-reply-to: Your message of "Thu, 20 Aug 1998 10:11:50 -0400." <3.0.3.32.19980820101150.006c0da8@wolfepub.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Date: Thu, 20 Aug 1998 15:58:26 +0000 From: Mike Smith Sender: owner-freebsd-hackers@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG > Is there some way to trap or detect when some other program is trying to > read memory used by another program? You could implement a kernel extension to provide this support. > For example, I have an encryption/decryption daemon that holds its key in > memory. I have been told that there is really no way to protect the memory > used by the daemon in the case of a root compromise. However, if I could > somehow detect another program trying to access my daemon's memory space, > then I could have the daemon dump the key and shutdown. > > Any insight would be greatly appreciated. A root compromise would be able to defeat the detection mechanism. You could increase the difficulty of recovering the key slightly by obfuscating its storage, but protecting it completely would require kernel modifications which could be reversed/removed/faked around by a sufficiently persistent attacker. -- \\ Sometimes you're ahead, \\ Mike Smith \\ sometimes you're behind. \\ mike@smith.net.au \\ The race is long, and in the \\ msmith@freebsd.org \\ end it's only with yourself. \\ msmith@cdrom.com To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-hackers" in the body of the message