Forensically-Sound Analysis of Security Risks of Using Local Password Managers

Abstract

Abstract-Password managers address the usability challenge of authentication, i.e., to manage the effort in creating, memorising, and entering complex passwords for an end-user. Offering features such as creating strong passwords, managing increasing number of complex passwords, and auto-filling of passwords for variable contexts, their security is as critical as the assets being protected by the passwords. Previous security risk analyses have focused primarily on cloud-and browser-based password managers, whilst the security risks of local password managers were left under-explored. Taking a systematic forensic analysis approach, this paper reports on a case study of three popular local password managers: KeePass (v2.28), Password Safe (v3.35.1) and RoboForm (v7.9.12). It revealed risks that either the master password or the content of the password database could be found unencrypted in Temp folders, Page files or Recycle bin, even after applications had been closed. As a consequence, an attacker or a malware with access to the computer on which the password managers were running may be able to steal sensitive information, even though these password managers are meant to keep the databases encrypted and protected at all times. These findings point to directions to mitigate the identified risks.

Encouraging Password Manager Adoption by Meeting Adopter Self-Determination Needs

“…Password managers re-establish a reasonable balance between the security and usability of passwords, enjoying research attention [16,17,18,19]. Most of the existing research on password managers has focused on (1) technical aspects of these tools and mechanisms to improve their security and usability [16,17], (2) evaluating their security [18,19], or (3) designing for usability [20]. Less work has been carried out on password manager adoption.…”

Software Engineering Challenges for Investigating Cyber-Physical Incidents

“…For example, in the context of social media incident investigations, Tun et al [22] identify three main requirements related to evidence collection: maintaining privacy, continuity, and integrity of digital evidence. Similarly, Gray et al [23] have proposed a technique to assess risks that local password managers can bring when maintaining integrity and authenticity of passwords. This technique could be applied to other sources of evidence to ensure integrity and authenticity of the data preserved proactively.…”

Snap forensics: a tradeoff between ephemeral intelligence and persistent evidence collection

“…The passwords stored by software managers are another form of ephemeral intelligence, where the master password in transient memory may be revealed by unexpected failure of the software system. To reduce the risk of exposing the master passwords, the in-memory plain text passwords should never last long [1]. Live forensic evidence could be combined with persistence storage in order to preserve them in the long run, while typically the storages are remote from the data generators.…”