“Physical Access = Total Access”. In this post we will take a quick look at pulling ProtonMail artifacts from a Windows 10 process memory dump.
It’s been a very long time since I have posted on my blog. I have been very busy with a couple new book writing projects, but I have missed doing regular blog posts. Ran into this today and thought it would be a good post to hopefully get back on the blogging horse. Let me say before we get started that I am a big ProtonMail fan, and highly recommend it. I am not breaking their encryption or anything fancy like that, just simply pulling artifacts that belong to a ProtonMail session out of the computer’s memory.
Last year I covered how to pull Word documents out of Windows memory using a remote Kali Linux shell. Using the same techniques and tools covered in that article you can do the same to recover ProtonMail artifacts.
As a test I crafted an e-mail using text from the Boba Fett Wikipedia entry. I figured the word “Boba” would make a good canary, a word that would be easily found in the memory dump.
The test e-mail looked like this in ProtonMail:
I then performed a memory dump on the Firefox process:
- The “tasklist” command returned the Firefox process ID
- Then, “procdump64 -ma [Process ID or you can just use ‘firefox.exe’] mem_dump_filename“
- And then, “strings64 mem_dump_filename.dmp > Protonmail.txt“
The procdump command copies memory in use by the Firefox process to a file. The resultant file is very large, so the strings command is used to pull text strings out of the dump and save them to a much smaller file called “Protonmail.txt”.
I then manually searched through the resultant .txt file for artifacts.
I found the source e-mail address, and the e-mail subject. A little farther down I found the entire e-mail text as seen below:
Comparing the two images you can see that the entire e-mail text was recovered from the memory dump. I was also able to view the contents of every e-mail that was opened during the session (not shown) and most, if not all e-mail contacts that I have in ProtonMail.
This shows that if you have physical access to a system, you could recover ProtonMail artifacts including entire messages from a memory dump. The moral of this story, as a Linux guru once told me – “physical access equals total access”. If you have physical access (including remote access) to a system, you can recover many interesting things from system memory. That is why it is important to secure physical access to your systems.
If you enjoyed this article, check out my book, “Intermediate Security Testing with Kali Linux 2” which has an entire section on performing Forensics with Kali Linux.
CYBER ARMS - Computer Security 