Vulnerability in Credant Mobile Guardian Shield for Windows Vendor: Credant Technologies Inc. http://www.credant.com/ Product: Credant Mobile Guardian Shield for Windows Version: 5.2.1.105 (and prior) Affected Operating Systems: Windows XP SP2 (and likely others) Product Overview: Credant Technologies markets the Credant Mobile Guardian Shield for Windows as part of their data security solution for mobile devices. The product is installed on a mobile device (e.g. Laptop). The shield receives its policy from a centralized server which dictates the encryption settings as defined by the Credant administrator. Credant Technologies has trademarked their encryption approach as ?Policy based Intelligent Encryption?; this means that the product does not provide full disk encryption. This approach allows the Credant administrator to dictate what files and directories are to be encrypted e.g. All .doc files regardless of directory, and all files in the ?My Documents? folder. By default, Credant does not encrypt the paging file, operating system files, or slack space to improve performance. Vulnerability Details: A serious security flaw is present in Credant Mobile Guardian Shield for Windows versions 5.2.1.105 and prior. Several instances of the users Windows Domain name, Domain username, and password are stored in plain text within the memory (RAM) of the mobile device. This risk is compounded by the fact that the Windows paging file is not encrypted per default settings. The unencrypted paging file would likely contain the plain text Windows Domain credentials as well. Attack Scenario?s: 1) Offline attack: A lost or stolen device would allow as attacker to search the paging file with the goal of obtaining the plaintext Domain credentials, once obtained the attacked could simply boot the device and login thereby gaining complete access to the encrypted data. 2) Online attack: An attacker could create a malicious program which upon execution would dump the active memory image / or locate the area in memory where the password is stored and retrieve it. The memory image or password could then be sent over a network to the attacker. Methodology: To reproduce and confirm the findings a clean Windows XP SP2 build without Credant Mobile Guardian Shield for Windows was installed, a dump and search of the memory for the plaintext domain password yielded no matches (ruling out the Windows OS). Credant Mobile Guardian Shield software version 5.2.1.105 was then loaded. The memory was dumped and searched following a reboot and Domain login, the password was stored (multiple times) in plaintext within memory. Workarounds: Contact vendor for patch 5.2.1.125 Credit: Mike Iacovacci