How To Ensure Uploaded File Contents Cannot Be Recovered After Use?

Question

I would like to make the contents of a file uploaded to a web server unrecoverable after it has been used. My concerns are:

1. When the file is uploaded, is it stored in a temporary directory (e.g. Windows Temp directory) and how do I clear all traces from there?

2. Can the contents of the file be written to virtual memory and how do I ensure it is not or remove the contents once written?

3. If I encrypt the file, would I still have to worry about the contents being saved to the Temp directory, virtual memory or elsewhere before the file was encrypted?

4. Can I perform a secure delete in all the concerned about locations (temp, virtual memory, any others) and how do I do this?

5. Are there any concerns I have missed or an alternate way to achieve the stated goal?

N.B. This is an ASP.NET web application.

Edit: Thanks djeeg's for pointing out a link on how to relocate the temp upload directory to something more controllable.

Any feedback on the other points?

Answer 1

Disk security

You can let wipe utility do the job for you.

If you are running ASP.NET on Mono/Linux, you can use the wipe command via Process class (ensure that wipe package is installed).

If you run Windows, the approach is the same. Use a wipe.exe utility that performs hard cleanup when you need to safely dispose of the file.

I fond this website that distributes a free wipe.exe, which is not included in Windows standard installation (too bad).

Second way is to implement the Guttman algorithm, but I think it's cheaper to use someone else's code.

Bear in mind that wipe is very I/O intensive, don't wait for it to complete or you may slow down your application dramatically. Also, on highly loaded websites you might experience a significative slow down.

Memory security

The SecureString class helps you leave no trace of a string in memory. But when you work with files you actually work with streams. I'm not sure if worrying about the contents of volatile memory (even if you handle Wikileaks documents).

You must first perform a threat analysis telling you what are the major threats to memory. Here are some questions:

1. Can someone access the server with an Administrator/root account with the ability to perform a memory dump? (Regular users can't read your memory and .NET prevents buffer overrun because of pointers being unused)
2. Can someone physically access the server? Don't you trust your hosting provider enough? Do you run a virtual server instead?

If answer is not yes you shouldn't worry about memory security

Swap space security

Even if you run on Windows, let me call "swap" the paging file, or virtual memory file, or whatever. You might think about disabling it (be sure you have plenties of RAM) or, else, you might think about encrypting it (but you get a performance drop).

But again, in order for somebody to scan your swap file at runtime, he must be root, or have physical access to the shut down server.

If data is too sensitive, I would go for disabling swap.

[Add] I'm sure that you already use SSL to upload the file, just in case you forgot some principles...