Problem - Kevin Tafuro

Unfortunately, there is no way to prevent memory dumps on a per-application basis
on Windows. The settings for how to handle an application crash are system-wide,
stored in the registry under HKEY_LOCAL_MACHINE, and they require Administrator
access to change them. Even if you’re reasonably certain Dr. Watson will be the handler
on systems on which your program will be running, there is no way you can disable
its functionality on a per-application basis. On the other hand, any dump that
may be created by Dr. Watson is properly protected by ACLs that prevent any other
user from accessing them.
Discussion
On most Unix systems, a program that crashes will “dump core.” The action of
dumping core causes an image of the program’s committed memory at the time of
the crash to be written out to a file on disk, which can later be used for post-mortem
debugging.
The problem with dumping core is that the program may contain potentially sensitive
information within its memory at the time the image is written to disk. Imagine a
program that has just read in a user’s password, and then is forced to dump core
before it has a chance to erase or otherwise obfuscate the password in memory.
Because an attacker may be able to manipulate the program’s runtime environment
in such a way as to cause it to dump core, and thus write any sensitive information to
disk, you should try to prevent a program from dumping core if there’s any chance
the attacker may be able to get read access to the core file.
Generally, core files are written in such a way that the owner is the only person who
can read and modify them, but silly things often happen, such as lingering core files
accidentally being made world-readable by a recursive permissions change.
It’s best to prevent against core dumps as early in the program as possible, because if
an attacker is manipulating the program in a way that causes it to crash, you cannot
know in advance what state the program will be in when the attacker manages to
force it to crash.
Process core dumping can be restricted on a per-application basis by using the
resource limit capabilities of most Unix systems. One of the standard limits that can
be applied to a process is the maximum core dump file size. This limit serves to protect
against large (in terms of memory consumption) programs that dump core and
could potentially fill up all available disk space. Without this limit in place, it would
even be possible for an attacker who has discovered a way to cause a program to
crash from remote and dump core to fill up all available disk space on the server. Setting
the value of RLIMIT_CORE to 0 prevents the process from writing any memory
dump to disk, instead simply terminating the program when a fatal problem is
encountered.
36 | Chapter 1: Safe Initialization
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.