How to fix heap inspection vulnerability in c#

Instead of storing sensitive data in objects like Strings, store them in a SecureString object. Each object stores its contents in an encrypted format in memory at all times.

public static SecureString getPassword()
{
SecureString inputPassword = new SecureString();
ConsoleKeyInfo nextKey = Console.ReadKey(true);
while (nextKey.Key != Console.ReadKey(true))
{
inputPassword.AppendChar(nextKey.KeyChar);
Console.Write("*");
nextKey = Console.ReadKey(true);
}
inputPassword.MakeReadOnly();
return inputPassword;
}

Please read this

https://community.microfocus.com/t5/Fortify-User-Discussions/Fortify-Heap-Inspection-kind-of-attack-in-asp-net/td-p/1535377

2 Replies

Know the answer? Post it — somebody with the same question will find it here.

Rajanikant Hawaldar7y ago
Instead of storing sensitive data in objects like Strings, store them in a SecureString object. Each object stores its contents in an encrypted format in memory at all times.
public static SecureString getPassword()
{
    SecureString inputPassword = new SecureString();
    ConsoleKeyInfo nextKey = Console.ReadKey(true);
    while (nextKey.Key != Console.ReadKey(true))
    {
        inputPassword.AppendChar(nextKey.KeyChar);
        Console.Write("*");
        nextKey = Console.ReadKey(true);
    }
    inputPassword.MakeReadOnly();
    return inputPassword;
}
Please read this
https://community.microfocus.com/t5/Fortify-User-Discussions/Fortify-Heap-Inspection-kind-of-attack-in-asp-net/td-p/1535377
+1
Dinesh Gabhane7y ago
If it is for String, you need to convert it into class property. please refer below link

https://stackoverflow.com/questions/40789379/how-to-solve-heap-inspection-vulnerability-for-mvc-viewmodel
0