Immutable Data and Memory Sensitivity..

Considered this python code snippets

import hashlib

while True:

   print(“Enter your password”)

   s = raw_input(‘–> ‘)

   print(s)

   print(“Now the md5sum”)

   s = hashlib.md5(s).hexdigest()

   print(s)

By any means it’s relatively a simple code to understand, we use s as a placeholder for our incoming data string, compute it’s md5sum and replace the s value with a hexdigest.. In short s now contain the md5sum in hex right? So any plaintext that we’ve entered should vanished and and flush out by the garbage collector in python VM right?

Let’s give it a test.

So most people would think any previous plaintext value would be washed out from the memory. The String DogFood  won`t exist right? Let’s attach this current script on a debugger (‘Im using edb debugger , the best thing besides windbg sorry stallman gdb just sux!!!!’);

I like using edb debugger, it helps for example binary search string. Since we have replace the s value from DogFood to a hex string. We shouldn`t see any DogFood string in the memory right? Unfortunely that is entirely not true

DogFood in Hex

 High-level languages often have data types that are immutable. The program can only write to an immutable object once, at creation time. In other words s is just a label and the string maybe be stored in the same address or  anywhere in the memory. (Noted to self, heap/stack/bss/dss/ is actually some sort of label the computer generated to ou  give it some of approximate understanding on a specific region in the memory) 


Let’s search for the md5sum string. 36f65df05afee9fb079943b7ba5d9617

The string was stored in a different address!!

So in a High Level Language,  there is no gurantee your initial plaintext data in an address would be overwrite with a encrypted blob/binary . The only way to ensure overwrite is 100% is to use either mutable data structure that are capable of replacing dynamics element.


So why did u see a chunk of the unencrypted/crypted data in the heartbleed heak leak? Not a surprise anymore right?

Sumber: http://y0nd13.blogspot.com

Tweet