Data lifetime is a systems problem

ABSTRACT

As sensitive data lifetime (i.e. propagation and duration in memory) increases, so does the risk of exposure. Unfortunately, this issue has been largely overlooked in the design of most of today's operating systems, libraries, languages, etc. As a result, applications are likely to leave the sensitive data they handle (passwords, financial and military information, etc.) scattered widely over memory, leaked to disk, etc. and left there for an indeterminate period of time. This greatly increases the impact of a system compromise.Dealing with data lifetime issues is currently left to application developers, who largely overlook them. Security-aware developers who attempt to address them (e.g. cryptographic library writers) are stymied by the limitations of the operating systems, languages, etc. they rely on. We argue that data lifetime is a systems issue which must be recognized and addressed at all layers of the software stack.

REFERENCES

• 1: P. Broadwell, M. Harren, and N. Sastry. Scrash: A system for generating secure crash information. In Proceedings of the 11th USENIX Security Symposium, August 2003.
• 2: J. Chow, B. Pfaff, T. Garfinkel, K. Christopher, and M. Rosenblum. Understanding data lifetime via whole system simulation. In Proceedings of the 12th USENIX Security Symposium, 2004.
• 3: Simson L. Garfinkel , Abhi Shelat, Remembrance of Data Passed: A Study of Disk Sanitization Practices, IEEE Security and Privacy, v.1 n.1, p.17-27, January 2003 [doi>10.1109/MSECP.2003.1176992]
• 4: P. Gutmann. Secure deletion of data from magnetic and solid-state memory. In Proceedings of the 6th USENIX Security Symposium, July 1996.
• 5: P. Gutmann. Software leaves encryption keys, passwords lying around in memory. http://www.securityfocus.com/archive/82/297827/2002-10-27/2002-11-02/2, October 2002.
• 6: T. Hamilton. 'Error' sends bank files to eBay. Toronto Star, Sep. 15, 2003.
• 7: M. Howard. Some bad news and some good news. http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dncode%/html/secure10102002.asp, October 2002.
• 8: Microsoft Corporation. Address windowing extensions API. http://msdn.microsoft.com, February 2000.
• 9: Microsoft Corporation. VirtualLock. http://msdn.microsoft.com, January 2004.
• 10: Open Group. The single UNIX specification version 3, IEEE standard 1003.1-2001. WWW, 2001. http://www.unix-systems.org/single_unix_specification/.
• 11: N. Provos. Encrypting virtual memory. In Proceedings of the 10th USENIX Security Symposium, pages 35--44, August 2000.
• 12: R. Rogers. Exploiting the ftp pasv vulnerability. http://www.securityhorizon.com/whitepapers/hacking/PASV.html, October 1999.
• 13: U. Shankar, K. Talwar, J. S. Foster, and D. Wagner. Detecting format string vulnerabilities with type qualifiers. In Proc. 10th USENIX Security Symposium, August 2001.
• 14: David A. Solomon , Mark Russinovich, Inside Microsoft Windows 2000, Microsoft Press, Redmond, WA, 2000
• 15: US Department of Energy Computer Incident Advisory Capability. Office XP Error Reporting May Send Sensitive Documents to Microsoft. http://www.ciac.org/ciac/bulletins/m-005.shtml.