News for hackers. Stuff that matters.

A comment on A walkthrough the AcridRain password stealer. Parent comment

Re:A walkthrough the AcridRain password stealer by kevindqc on Tuesday August 28, 2018 @05:01PM (#17862846)
> The CryptProtectData function performs encryption on the data in a DATA_BLOB structure. Typically, only a user with the same logon credential as the user who encrypted the data can decrypt the data. In addition, the encryption and decryption usually must be done on the same computer. For information about exceptions, see Remarks.

https://docs.microsoft.com/en-us/windows/desktop/api/dpapi/n...

If you can execute code on the computer (as the user), you can decrypt the credentials.

Scary how easy it is to steal it all :(

[ Parent | on HN ]
Re:A walkthrough the AcridRain password stealer by carterage on Tuesday August 28, 2018 @05:25PM (#17863045)
So... fundamentally, encrypting data on the very same machine that retains the related keys, is tantamount to simply encoding the data in plaintext form without any real protection, yes?
[ Parent | on HN ]
Re:A walkthrough the AcridRain password stealer by buckminster on Tuesday August 28, 2018 @05:46PM (#17863201)
It's slightly better than that. You can't decrypt the data when the user isn't logged in.
[ Parent | on HN ]
Re:A walkthrough the AcridRain password stealer by wiz21c on Wednesday August 29, 2018 @04:19AM (#17866617)
bah, if one can install a password stealing program, then he can as well install a key logger. With both of those, you become virtually transparent.
[ Parent | on HN ]
Re:A walkthrough the AcridRain password stealer by Fnoord on Wednesday August 29, 2018 @02:09AM (#17866042)
> If you can execute code on the computer (as the user), you can decrypt the credentials.

The problem is that programs gain too much privileges they do not need (yet) without consent from the user.

This kind of attack wouldn't work on Qubes OS, a well configured SELinux, or a well configured capability-based OS.

[ Parent | on HN ]