An exploit can reveal your KeePass master password in plaintext

KeePass password supervisor customers might need to be further vigilant for the subsequent a number of weeks or so. A newly found vulnerability permits retrieval of of the master password in plaintext, even when the database is locked or this system is closed. And whereas a repair is in the works, it gained’t arrive till early June on the soonest.

As reported by Bleeping Computer (which covers the problem in full technical element), a safety researcher often known as vdohney revealed a proof-of-concept software that demonstrated the exploit in motion. An attacker can carry out a reminiscence dump to collect many of the master password in plaintext, even when a KeePass database is closed, this system is locked, or this system is now not open. When pulled out of the reminiscence, the primary one or two characters of the password might be lacking, however can then be guessed to determine your entire string.

For these unfamiliar with reminiscence dumping vulnerabilities, you can consider this state of affairs a bit like KeePass’s master password as free change in a pants pocket. Shake out the pants and also you get practically the entire greenback (so to talk) wanted to purchase entry into the database—however these cash shouldn’t be floating round in that pocket to start with.

The proof-of-concept software demonstrates this problem in Windows, however Linux and macOS are believed to be susceptible, too, as the issue exists inside in KeePass, not the working system. Standard consumer accounts in Windows aren’t secure, both—dumping the reminiscence doesn’t require administrative privileges. To execute the exploit, a malicious actor would wish both entry to the pc remotely (gained by way of malware) or bodily. 

All present variations of KeePass 2.x (e.g., 2.53.1) are affected. Meanwhile, KeePass 1.x (an older version of this system that’s nonetheless being maintained), KeePassXC, and Strongbox, that are different password managers appropriate with KeePass database information, aren’t affected based on vdohney.

A repair for this vulnerability will come in KeePass model 2.54, which is more likely to launch in early June. Dominick Reichl, the developer of KeePass, gave this estimate in a sourceforge discussion board together with the caveat that the timeframe is just not assured. An unstable take a look at model of KeePass with the safety mitigations is offered now. Bleeping Computer studies that the creator of the proof-of-concept exploit software can’t reproduce the problem with the fixes in place.

However, even after upgrading to the fastened model of KeePass, the master password should be viewable in this system’s reminiscence information. To absolutely shield towards that, you’ll should wipe your PC utterly utilizing the mode that overwrites present knowledge, then freshly reinstall the working system.

That’s a reasonably drastic transfer, nonetheless. More moderately, don’t let untrusted people entry your pc, and don’t click on any unknown hyperlinks or set up any unknown software program. A superb antivirus program (like a type of amongst our prime suggestions) helps, too. When the fastened model of KeePass launches, you can additionally change your master password after upgrading—doing so ought to make the earlier password irrelevant if it’s nonetheless lurking in your reminiscence information.

You can additionally scale back your publicity by restarting your PC, clearing your hibernation and swap information, and briefly accessing your KeePass database in a secure various like KeePassXC as a substitute. Device encryption can additionally assist towards a bodily assault on your PC (or in case you assume somebody may mine this data after you donate or junk the PC). There are methods to remain protected—and fortuitously, this seems to be solely a proof-of-concept concern, moderately than an energetic exploit.

Author: Alaina Yee, Senior Editor