.Net code security

[ceebmoj]

Had luck asking questions in hear in the past.

I have been working on some c# stuff in .net that connects to a db and I am now looking at ways of releasing the code and ensuring things like pass words and other strings are not easy to extract. The code is going to run on pocket pc and windows pc

I have used obfuscation and string encryption and this just seams to be a bit of a hassle to extract the data but is not going to stop any one who is determined.

Looked at pc guard but this does not seam to work on pocket pc’s

Does any one have any hints tips or solutions?

Blake

[m12_nathan]

Use securestring to store any passwords, even though you have to pass a string in to your sql connection string the less time you have a string in RAM the less chance there is of it being swapped to pagefile or copied around by the GC.

Can't help on the storage of passwords in config files as we have a bespoke encryption com componant to deal with that, I'd guess the standard classes are usable but it depends on your target environment as to how secure you deem it.

Would using remoting to a middle tier where the work is carried out reduce the attack vector at all? Certainly you wouldn't have to store sql connection parameters on the device if you went that way as the middle tier would hold all that data.

[ceebmoj]

m12_nathan said:

clever .Net stuff.

I am relativly new to .Net so you are going to have to go a bit slower.

Use securestring to store any passwords. I am all ready doing this.

Can't help on the storage of passwords in config files as we have a bespoke encryption com componant to deal with that, I'd guess the standard classes are usable but it depends on your target environment as to how secure you deem it.

do you recomend buying in a component for this?

Would using remoting to a middle tier where the work is carried out reduce the attack vector at all? Certainly you wouldn't have to store sql connection parameters on the device if you went that way as the middle tier would hold all that data.

im sorry you have lost me

Edited by ceebmoj on Tuesday 5th December 16:41

[Jared_m]

You're unlikely to succeed in protecting your connection string from a user.

If you can decrypt it on the device then assume the user could access it. No buts or ifs.

Could you perhaps create a database login for each user who needs to access your system?

[m12_nathan]

Look at remoting - your end user devices talk to a middle tier (easy to host and secure in IIS), that middle tier does all the database and calculation work and passes back your business objects to the end user devices. Not suitable for every implementation but worth investigating. Can you discuss exactly what the app does?

[ceebmoj]

Jared_m said:

If you can decrypt it on the device then assume the user could access it. No buts or ifs.

I agree however it’s about appropriate security.

I want to be able to deploy in to the field

1 data base
Pocket pc app or windows app witch connect to the same db above

I am looking for was to protect the data to connect to the db having separate db accounts is not really practical and also what to try and keep piracy to a minimum.

[ceebmoj]

m12_nathan said:

Look at remoting - your end user devices talk to a middle tier (easy to host and secure in IIS), that middle tier does all the database and calculation work and passes back your business objects to the end user devices. Not suitable for every implementation but worth investigating. Can you discuss exactly what the app does?

cant realy talk spesifics but that is not an apropreat solosion as ther will not be a remote conection avaloble.

[ceebmoj]

m12_nathan said:

Look at remoting - your end user devices talk to a middle tier (easy to host and secure in IIS), that middle tier does all the database and calculation work and passes back your business objects to the end user devices. Not suitable for every implementation but worth investigating. Can you discuss exactly what the app does?

cant realy talk spesifics but that is not an apropreat solosion as ther will not be a remote conection avaloble.

[m12_nathan]

So the database is local to each device? If so you can't really keep the data secure from a malicious user anyway?

[ceebmoj]

m12_nathan said:

So the database is local to each device? If so you can't really keep the data secure from a malicious user anyway?

yep local and yes you cant keep it secure for ever but how about taking say a mounth to get in?

[m12_nathan]

What format is the database? SQL?

Is there a central db at all or does each device have it's own unique set of data?

[GnuBee]

If you need to store passwords (or any "sensitive" data) in an external config file you can elect to leverage the inbuilt XML element encryption functionality in .NET 2.0

Your problem will likely be that whilst you can find any number of ways of encrypting the data securing the key will present a challenge...

[ceebmoj]

GnuBee said:

Your problem will likely be that whilst you can find any number of ways of encrypting the data securing the key will present a challenge...

spot on

[ceebmoj]

m12_nathan said:

What format is the database? SQL?

Is there a central db at all or does each device have it's own unique set of data?

there is a central sql sever 2005 then an merge replicate to an encripted SQL mobile db that is on the devices. and it is acces to this mobile data bases that we whnat to protect.

blake

[m12_nathan]

Problem is that anyone who whats to run reflector on your app can do so and see what you are doing with regards to decrpyting the db password at the moment you need to get it out of a securestring to a string to use it. IL is trivial to reverse engineer unfortunately

Once it is a string anyone running debugging on the device can see the password in memory, and you can't be sure when the GC is going to get rid of it from ram, or even start making copies of it and leave orphaned copies of the password in plain text in memory all over the place.

I haven't played with db encrption in SQL 2005 - does it stop you granting permissions to a new user on the database or copying the db file to another instance of sql?

Cheers

[ceebmoj]

hi,

thanks for all the hints and tips guys. unfortunatly you just seam to be reenforcing what I all ready suspected. i.e. im in trouble regarding security and will need to have a big think about this.

blake