RE: [Dev-C++] Help with application security (hiding strings in compiled binaries)
Open Source C & C++ IDE for Windows
Brought to you by:
claplace
Menu
▾
▴
RE: [Dev-C++] Help with application security (hiding strings in compiled binaries)
|
From: P.D. v. Z. <pa...@my...> - 2003-08-17 00:43:34
|
Yeah, you're right... I only checked the executable for the string
literal (in either ASCII or Unicode) using a hex editor, didn't spend
much time checking for any other patterns. Another option would be to
use (or write) a string encoding program, which emits a (reversible)
string that you then use as a literal in your application. Then when you
need the plain-text string, you decode it using some decoding function
(could be anything simple, bit inversion would even suffice). I know
it's a bit more work, but it will effectively get rid of your problem.
Doesn't get rid of the plain-text string existing in memory at some
point, but that's not your problem as far as I understood.
I'll send along a simple example of what I mean. This is just some
really basic 'encoding', and not quite safe in any way.. using bit
inversion... simplest I could think of to effectively garble text (have
no idea if it'd work correctly at all, this is off the top of my head).
[for encoding your strings for use in your application, don't think
you'd want to do that by hand :P]:
#include <iostream>
using std::cout;
using std::endl;
int main(int argc, char* argv[])
{
if (argc !=3D 2)
return 1;
=09
for (int i =3D 0; i < strlen(argv[1]); ++i)
cout << ~argv[1][i];
cout << endl;
}
[decoding function for use in your application]
#include <iostream>
using std::cout;
using std::endl;
void decodepass(char* pDest, const char* pSrc, int iLen)
{
if (!pDest || !pSrc)
return;
=09
for (int i =3D 0; i < iLen; ++i)
pDest[i] =3D ~pSrc[i];
pDest[i] =3D '\0';
}
int main()
{
const char* pszSomePass =3D "<some encoded string>";
char szDecoded[256];
=09
decodepass(szDecoded, pszSomePass);
cout << "My decoded string is: " << szDecoded << endl;
=09
return 0;
}
-----Original Message-----
From: dev...@li...
[mailto:dev...@li...] On Behalf Of Ed
Cottrell
Sent: Sunday, August 17, 2003 1:22 AM
To: dev...@li...
Subject: RE: [Dev-C++] Help with application security (hiding strings in
compiled binaries)
Hi -
That's certainly an improvement. However, it still shows up somewhat
predictably. It looks like this in a text editor (I doubt this will
display
correctly):
=
=FA=FF=FFj=C6=85=A9=FA=FF=FFi=C6=85=AA=FA=FF=FFl=C6=85=AB=FA=FF=FFl=C6=85=
=AC=FA=FF=FF =C6=85
^ ^ ^ ^ ^
It's a little weird, but you can see the pretty regular repetition,
there. It MIGHT be sufficient to my purposes to do it this way, but it's
not ideal...
Other ideas?
-Ed
-----Original Message-----
From: dev...@li...
[mailto:dev...@li...] On Behalf Of P.D. van
Zelst
Sent: Saturday, August 16, 2003 6:45 PM
To: 'Ed Cottrell'; 'Michael D. Smith';
dev...@li...
Subject: RE: [Dev-C++] Help with application security (hiding strings in
compiled binaries)
Well, it appears that if you specify your passwords as separate
characters in a character array, it won't turn up in the executable as a
string literal. I just tested this, as I was curious myself... The
following code will generate an executable with the string literal
"jack" in it, but "jill" won't show up as a literal (at least, not on my
compiler... GCC 3.2 [Dev-C++
4.9.8.2]):
#include <iostream>
using std::cout;
using std::endl;
int main()
{
char szUser[] =3D "jack";
char szPass[] =3D { 'j', 'i', 'l', 'l', '\0'};
cout << szUser << endl;
cout << szPass << endl;
return 0;
}
Hope this helps you somewhat,
Paul
-----Original Message-----
From: dev...@li...
[mailto:dev...@li...] On Behalf Of Ed
Cottrell
Sent: Sunday, August 17, 2003 12:02 AM
To: 'Michael D. Smith'; dev...@li...
Subject: RE: [Dev-C++] Help with application security (hiding strings in
compiled binaries)
Hi Mike & others,
I know I can't make it impossible to find, but I'd like it to be more
difficult than it is. The user logging in to the database will have
limited capabilities, of course, but one (the trickiest to secure) is
SELECT capability, by necessity...
I'm not sure how I could separate the logon program from the main
program (and put it in a secured directory) without losing
functionality; the end user HAS to be able to login to the database
servers from the program itself, but without having access other than
through the program's own controls. In other words, when he/she runs my
app, he/she should then have limited access to the database, but without
knowing the authentication used to get there. If the user is going to
somehow invoke a separate login program, that requires yet another layer
of security, right? The user will be accessing some of the data over the
net, and I don't want just anybody to run a login script... (NOTE:
traffic sniffing isn't a concern with this data
- no credit cards or anything; somebody logging in and getting lots at
once, though, is).
NOTE: I don't mind encrypting it, somehow; I'm just not thrilled about
it, because it would result in definite penalties in file size,
execution speed, and development time.
How else can I make this more discrete?
-Ed
-----Original Message-----
From: Michael D. Smith [mailto:for...@hi...]=20
Sent: Friday, August 15, 2003 10:14 PM
To: Ed Cottrell
Subject: Re: [Dev-C++] Help with application security (hiding strings in
compiled binaries)
I've done a good bit of computer security work over the years, I first=20
programmed a UNIVAC 9200 in 1969, but I'm just now learning C, so from
that=20
perspective...
The situation is that you can't make it impossible to the truly
determined.=20
You might could make it take 200 people 3 years though, which is no
doubt=20
much, much, much better than "anyone" and "notepad"
It depends on the specifics which of course you don't want to give for=20
obvious reasons. The first thing that comes to my mind is you should ask
yourself "why do people logging on have access to the logon program?" If
you could stop that, that alone would go a long way towards making you
more=20
secure. See if you can't do something with the file/directory
permissions=20
to make that impossible.
YOu could store it packed (as binary) but anyone can read that as well
if=20
it's in a known code. I'm not 100% sure but I think putting it in a=20
"struct" does that in C. If not, there's certainly someway to convert
it.=20
They would have to be a "little" (very little) more determined to crack
it=20
but it could still be done. Still it's better than "anyone" and
"notepad."
Even though you don't like encoding, it certainly could work. There's a=20
world of possibilities out there. Just be aware, a "good" code is going
to=20
cost you in processing time. Maybe as much as 30 seconds per user. If=20
you're already at, or close to capacity that could be a hit. Of course
with=20
processing speed doubling every few months "they say" you're not
supposed=20
to worry about that. Of course with everyone not worrying about that ...
:)
And of course the current hot programming thinking is OOP (object
oriented=20
programming). For some reason, the way they push OOP these days leaves
out=20
the fact that it's purpose was/is security. But it too has security
holes=20
for those in the know. I guess they figure that if you don't know that's
it's purpose, you don't make it your purpose to find the security holes.
You give the users an object that only allows them to use your method=20
(subroutine) to access/change the database or perhaps to logon to start=20
with. Your subroutine of course only does access/changes that you
approve=20
of. I suspect this would involve rewriting the whole program which, if
your=20
not interested in encoding, you're probably not interested in rewriting
the=20
whole thing either. That too very much depends on your program being in
a=20
directory they don't have permission to access.
By necessity, as I don't know much C, and don't have any specifics, I've
been rather vague but if there's anything else I can do to help (yea=20
right:) -- write anytime.
Good luck.
ms
At 04:10 PM 8/15/03, you wrote:
>Hi,
>
>I have an application that, as one of its primary features, connects to
>numerous databases with semi-sensitive to highly sensitive info in=20
>them. The end users of this will be employees of a large organization,=20
>and they should not have ANY direct access to the databases,=20
>themselves. So, rather than giving them a username and password, I want
>to hard-code that into the application.
>
>This is currently being done like this (simplified pseudo code):
>
> char myconnectionstring =3D=20
> =
"DSN=3Dsomething;server=3Dmyserver;username=3Dmyname;password=3Dmypass";
> MyConnectionFunction(myconnectionstring);
>
>The compiled file (binary), though, contains this info in plain text.=20
>I.e., anybody can open it up in Notepad, find the usernames and=20
>passwords, and go hack the databases. That won't work.
>
>So, how can I hide those strings in the compiled code, other than
>building in some sort of encryption? Would building the passwords from
individual=20
>characters (ASCII values) work? Other ideas?
>
>Thanks!
>
>-Ed
-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01
/01
_______________________________________________
Dev-cpp-users mailing list
Dev...@li...
TO UNSUBSCRIBE: http://www23.brinkster.com/noicys/devcpp/ub.htm
https://lists.sourceforge.net/lists/listinfo/dev-cpp-users
-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01
/01
_______________________________________________
Dev-cpp-users mailing list
Dev...@li...
TO UNSUBSCRIBE: http://www23.brinkster.com/noicys/devcpp/ub.htm
https://lists.sourceforge.net/lists/listinfo/dev-cpp-users
-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01
/01
_______________________________________________
Dev-cpp-users mailing list
Dev...@li...
TO UNSUBSCRIBE: http://www23.brinkster.com/noicys/devcpp/ub.htm
https://lists.sourceforge.net/lists/listinfo/dev-cpp-users
|
