How do I ensure that a username/password combination is not read from memory

Question

How do I ensure that a username/password combination is not read from memory while my application is in use.

My program is a GUI wrapper for some CYGWIN tools, including SSH and SCP. I need to ensure single sign-on capabilities to a variety of hosts.

Answer 1

Use a public/private key pair with authorized_keys.

Answer 2

With the SSH key pair using ssh-agent, but is there any other way? The problem is that you need to get the public key out to the remote host, which can be done in a simple string but still requires a login. So the initial setup of the key pairs with passphrase and the adding of the key to the remote host requires many passwords to be entered. After the initial setup it all works well.

ideas?

Answer 3

An attacker will try to obtain passwords from memory using a Debugger while the application is running. The use of any encryption can be bypassed because the password must be in plain text at the time of use. Any time memory is used it can also be observed with a debugger.

The answer lies in anti-debugging: http://www.codeproject.com/KB/security/Intro_To_Win_Anti_Debug.aspx

More advanced windows Anti-Debugging:

http://www.veracode.com/blog/2008/12/anti-debugging-series-part-i/

http://www.veracode.com/blog/2008/12/anti-debugging-series-part-ii/

http://www.veracode.com/blog/2009/01/anti-debugging-series-part-iii/

http://www.veracode.com/blog/2009/02/anti-debugging-series-part-iv/