Could a hacker achieve this?

Discussion in 'ASP .Net Security' started by Framework fan, Apr 10, 2004.

  1. Hello.

    If I have this line of code inside my ASP.NET app:

    EncryptTripleDES("String to encrypt", "MySecretKeyXYZ!!!")

    Can a very experienced hacker do either of the following:

    1. "Steal" the DLL from the server, then reverse engineer the DLL in
    order to obtain the hard coded key above.

    2. (Much more clever) kind of "listen in to / tap in to" the DLL as
    it is actually executing on the server, and then kind of "syphon off"
    the data that is flying about the machine's data ports, in order to
    "catch / filter off" the secret key.

    -Frameworker.
    Framework fan, Apr 10, 2004
    #1
    1. Advertising

  2. Framework fan

    WJ Guest

    "Framework fan" <> wrote in message
    news:...
    > Hello.
    >
    > If I have this line of code inside my ASP.NET app:
    >
    > EncryptTripleDES("String to encrypt", "MySecretKeyXYZ!!!")
    >
    > Can a very experienced hacker do either of the following:
    >
    > 1. "Steal" the DLL from the server, then reverse engineer the DLL in
    > order to obtain the hard coded key above.
    >


    Depend on how tight your ACL is enforced at your server where the DLL is
    hosted. I would check this first to make sure only the intended users have
    access to it. I would offuscate my code if it is that sensitive. Hardcoding
    secret key in an application is a common practice. Just name things
    different than suggested by some best programming pratices to make life
    harder for hackers. This means that in some cases, you need to be abnormal
    in your programming style.

    > 2. (Much more clever) kind of "listen in to / tap in to" the DLL as
    > it is actually executing on the server, and then kind of "syphon off"
    > the data that is flying about the machine's data ports, in order to
    > "catch / filter off" the secret key.
    >


    Chances for this to happen is very slim unless there is an iider help.

    John
    WJ, Apr 11, 2004
    #2
    1. Advertising

  3. Stealing the DLL is one task and probably the hardest. As was mentioned in
    another post, it depends on how you have your security configured. If we
    assume a standard .Net app with the DLL in the bin folder, no explicit ACL
    set by yourself, then while it is possible, its not too easy. The more your
    machine is locked down, the harder it is for a hacker to get in and grab
    some code libraries.

    Now if we assume that the hacker has gained entry to your machine and can
    get your assemblies, then how hard would it be to have a look at your secret
    code. Well, without obfuscating your code, it would actually be quite easy.
    Obfuscating your code makes it considerably harder, but certainly not
    impossible. John mentioned that hardcoding the secret key is quite common,
    but it is bad practice. Ideally, you should probably extract it from
    somewhere that keeps it in an encrypted form also. Ideal for this situation
    is the DPAPI libraries. Typically, you can decrypt data only on the machine
    it was encrypted on (or only by the user it was encrypted by), with DPAPI
    handling the key storage for you. So if the hacker got your code, it would
    simply be referencing a key on the local machine, which is also encrypted.
    If the hacker then manages to get that encrypted key, they cant decrypt on
    anyother machine, so its useless to them.

    So you could either use DPAPI for all your encryption needs or just to
    store/encrypt the encryption key that you will be using. DPAPI is an
    unmanaged set of libraries/functions, but there is a managed wrapper with
    example code to be found here.
    http://weblogs.asp.net/pglavich/archive/2004/03/15/89687.aspx


    --
    - Paul Glavich
    Microsoft MVP - ASP.NET


    "WJ" <> wrote in message
    news:...
    >
    > "Framework fan" <> wrote in message
    > news:...
    > > Hello.
    > >
    > > If I have this line of code inside my ASP.NET app:
    > >
    > > EncryptTripleDES("String to encrypt", "MySecretKeyXYZ!!!")
    > >
    > > Can a very experienced hacker do either of the following:
    > >
    > > 1. "Steal" the DLL from the server, then reverse engineer the DLL in
    > > order to obtain the hard coded key above.
    > >

    >
    > Depend on how tight your ACL is enforced at your server where the DLL is
    > hosted. I would check this first to make sure only the intended users have
    > access to it. I would offuscate my code if it is that sensitive.

    Hardcoding
    > secret key in an application is a common practice. Just name things
    > different than suggested by some best programming pratices to make life
    > harder for hackers. This means that in some cases, you need to be abnormal
    > in your programming style.
    >
    > > 2. (Much more clever) kind of "listen in to / tap in to" the DLL as
    > > it is actually executing on the server, and then kind of "syphon off"
    > > the data that is flying about the machine's data ports, in order to
    > > "catch / filter off" the secret key.
    > >

    >
    > Chances for this to happen is very slim unless there is an iider help.
    >
    > John
    >
    >
    Paul Glavich [MVP - ASP.NET], Apr 11, 2004
    #3
  4. Thank you for everyone's input.

    "Paul Glavich [MVP - ASP.NET]" <-NOSPAM> wrote in message news:<#>...
    > Stealing the DLL is one task and probably the hardest. As was mentioned in
    > another post, it depends on how you have your security configured. If we
    > assume a standard .Net app with the DLL in the bin folder, no explicit ACL
    > set by yourself, then while it is possible, its not too easy. The more your
    > machine is locked down, the harder it is for a hacker to get in and grab
    > some code libraries.
    >
    > Now if we assume that the hacker has gained entry to your machine and can
    > get your assemblies, then how hard would it be to have a look at your secret
    > code. Well, without obfuscating your code, it would actually be quite easy.
    > Obfuscating your code makes it considerably harder, but certainly not
    > impossible. John mentioned that hardcoding the secret key is quite common,
    > but it is bad practice. Ideally, you should probably extract it from
    > somewhere that keeps it in an encrypted form also. Ideal for this situation
    > is the DPAPI libraries. Typically, you can decrypt data only on the machine
    > it was encrypted on (or only by the user it was encrypted by), with DPAPI
    > handling the key storage for you. So if the hacker got your code, it would
    > simply be referencing a key on the local machine, which is also encrypted.
    > If the hacker then manages to get that encrypted key, they cant decrypt on
    > anyother machine, so its useless to them.
    >
    > So you could either use DPAPI for all your encryption needs or just to
    > store/encrypt the encryption key that you will be using. DPAPI is an
    > unmanaged set of libraries/functions, but there is a managed wrapper with
    > example code to be found here.
    > http://weblogs.asp.net/pglavich/archive/2004/03/15/89687.aspx
    >
    >
    > --
    > - Paul Glavich
    > Microsoft MVP - ASP.NET
    >
    >
    > "WJ" <> wrote in message
    > news:...
    > >
    > > "Framework fan" <> wrote in message
    > > news:...
    > > > Hello.
    > > >
    > > > If I have this line of code inside my ASP.NET app:
    > > >
    > > > EncryptTripleDES("String to encrypt", "MySecretKeyXYZ!!!")
    > > >
    > > > Can a very experienced hacker do either of the following:
    > > >
    > > > 1. "Steal" the DLL from the server, then reverse engineer the DLL in
    > > > order to obtain the hard coded key above.
    > > >

    > >
    > > Depend on how tight your ACL is enforced at your server where the DLL is
    > > hosted. I would check this first to make sure only the intended users have
    > > access to it. I would offuscate my code if it is that sensitive.

    > Hardcoding
    > > secret key in an application is a common practice. Just name things
    > > different than suggested by some best programming pratices to make life
    > > harder for hackers. This means that in some cases, you need to be abnormal
    > > in your programming style.
    > >
    > > > 2. (Much more clever) kind of "listen in to / tap in to" the DLL as
    > > > it is actually executing on the server, and then kind of "syphon off"
    > > > the data that is flying about the machine's data ports, in order to
    > > > "catch / filter off" the secret key.
    > > >

    > >
    > > Chances for this to happen is very slim unless there is an iider help.
    > >
    > > John
    > >
    > >
    Framework fan, Apr 12, 2004
    #4
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. D E
    Replies:
    4
    Views:
    397
    Rowland Banks
    Jun 30, 2004
  2. =?ISO-8859-1?Q?Gerhard_H=E4ring?=

    Treffen/Stammtische für Hacker, PC-Freaks, Informatiker, Programmierer

    =?ISO-8859-1?Q?Gerhard_H=E4ring?=, Nov 24, 2003, in forum: Python
    Replies:
    2
    Views:
    673
    Henrik Weber
    Nov 25, 2003
  3. Soon HACKER SPY

    , Nov 5, 2007, in forum: Java
    Replies:
    0
    Views:
    386
  4. ffxff
    Replies:
    0
    Views:
    305
    ffxff
    Jun 27, 2008
  5. Xah Lee
    Replies:
    1
    Views:
    300
    rantingrick
    Mar 15, 2010
Loading...

Share This Page