3

I have a file that is gpg encrypted. I would like to view the content of the file, but leave no trace of the output. Lets say for example that the encrypted file has some passwords, and I don't want them floating around in memory or wherever. I know the command

gpg -d file_name

will dump the output of the file to STDOUT, but is there a way to make sure that there are no traces of the contents to be found?

  • 1
    You're not going to be able to get around it sitting in memory. If it's being displayed, it's going to be in memory somewhere. – Patrick Dec 26 '13 at 19:04
0

If you run this command the decrypted content of your file is (or was) in the memory (You cannot go around that). But you don't have to worry about this. While your program is running and another application tries to access this part of the memory it gets a segmentation fault and will be killed instantly by the kernel.

Every file accessed by a process stays in the memory as long as there is free memory. Also your encrypted file. To clear this cache you can run the following after you viewed the file:

sync
echo 3 > /proc/sys/vm/drop_caches
  • Dropping the caches doesn't clear the memory. It only marks it as unused, but the data will remain until something else happens to be written at the same location. – Gilles Dec 26 '13 at 23:38
0

You have no control over what happens to the memory that held the confidential content. For example, it's possible that the content was swapped out then back in at a different physical address, leading to multiple copies in the physical memory as well as in the swap space.

The risk is very low: it would take a root process or physical access to extract the password (plus some luck). Root access allows the attacker to plant undetectable malware anyway. So the only dangerous attack is extraction through a dump of the swap space (solution: encrypt your swap) or a cold boot attack on the RAM content.

You can remove that (very small, not worth worrying about unless you have very special needs) risk by running a process that allocates all the virtual memory it can get (assuming it can get everything that's available — on a 32-bit system you may need multiple such processes). This way the virtual memory will be cleared.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.