|
|
|
|
|
by Nursie
4305 days ago
|
|
And if I run my C program in an emulator that allows me to freeze it and dump memory I can do this stuff too... The point is, if you want security you need to look at the whole system and in the situation you describe you can't guarantee it, no. I'm not going to say "So don't do that", but I am going to say "If you're going to do things like that, please realise that the assumptions the system security was built on no longer hold true". I think to do it better we just need to pay a bit more attention. And try not to let ourselves get into situations (cough heartbleed cough) where memory zeroing is actually an important feature. IE - by the time the attacker is able to read your process memory you're probably already screwed. |
|