Most of the posts I've seen say it is impossible to achieve unbreakable security in this respect.

Whatever you do, you will end with a program (C, Perl, whatever) that contains two parts:

1. an encrypted or obfuscated secret (password or username and password)
2. all code required to decrypt or de-obfuscate the secret

In pseudo-code:

my $secret="(binary garbage here)";
sub checkSecurity;
sub decodeSecret;
sub reencode;
if (checkSecurity()) {  # <--- bypass the function call or make the fu
+nction return TRUE
    my $plaintext=decodeSecret($secret);
    # breakpoint here
    say $plaintext;
    # or, if you like:
    say reencode($plaintext);
} else {
    die "Insecure condition found, won't tell you the secret!\n";
}
[download]

It should be obvious that this can be broken quite easily. Start the program under control of a debugger and let it run to the place where it has decrypted or de-obfuscated the secret, break and dump the secret. Yes, there are ways to make exactly this harder. Search the web for anti-debugging techniques and how to bypass them. You can and should include the security checks in the decoder. But again, you can bypass those checks.

But if you use an external program from a perl script, it is even easier: Just make the perl script print the secret. Everything needed to make the external program happy must be present in the perl script. For a DBI application, just replace DBI->connect() with die. You don't even have to modify the perl script, a tiny module like the following, combined with perl -MDBIspy victim.pl should be sufficient.

package DBIspy;

use strict;
use warnings;
use feature 'say';
use DBI;

no warnings 'redefine';
sub DBI::connect
{
        say for @_;
        die 'BROKEN';
}
1;
[download]

Demo:

> perl -MDBIspy -E 'use DBI; DBI->connect("dbi:SQLite:","user","passwo
+rd")'
DBI
dbi:SQLite:
user
password
BROKEN at DBIspy.pm line 12.

>
[download]

There are several password managers available, commonly bundled with the Linux desktop environment you use. Whatever interface it uses, guess what happens when you need to call DBI->connect() with a secret from the password manager. Right, you need code that finally extracts the secret as plain text. And guess what happens when you use that ridiculously trivial DBIspy module. Your secret is no longer secret.

Alexander