0

I need my program to be secure as it's contents include personal information like IP (a private IRC chat if you must know). My plan is to read the bytes of the program and then create a symmetric encryption algorithm like AES to encrypt the byte arrays, to increase security I have added other minor things which can take care of debugging and emulators for example. Then I will use codedom to create my stub that 'carries' these encrypted bytes. There are 2 ways that I know which can 'carry' the code:

  1. Append encrypted bytes to stub in order for it to decrypt, write and run. (Known as dropping)
  2. Add it to the stub's resources so it can decrypt and load it so it which then is able to run it in Memory.

I could have 4 ways by adding to resource then decrypt, write and run or appending then decrypt, load and run in the memory. I could also make my own little obfuscation in the code but I doubt it will make much difference.

Method 2 seems to have been abused by people and is detected by the Anti-Virus and it is really annoying to get your project blocked by your anti-virus every time you debug. Enough of the excuses it will just be a false positive for the user when all the program is doing is protecting itself from being easily disassembled with programs such as the Red Gate Reflector. Including the database information e.g. SQL login methods are still going to be analyzed if disassembled:

Are there more ways of doing this?

K_X
  • 173
  • 9
  • 3
    You can't include sensitive information in your executeable as it can be reverse engineered at any time. There is **NO** way to protect your executeable from beeing reverse engineered. – GameScripting Jan 14 '13 at 21:29
  • 2
    A private IP address? The one that anyone can see being used with a tool like TcpMon after you decrypted your code? A careful threat analysis sounds in order. – Hans Passant Jan 14 '13 at 21:37
  • @Hans: In context, I believe that IP = "Intellectual Property" and not "Internet Protocol address". But I could be wrong. Depends on whether "private IRC chat" means "a transcript of a confidential chat" or "connection information to establish a new chat" – Ben Voigt Jan 14 '13 at 21:43
  • 2
    Very relevant: http://stackoverflow.com/a/4532568/103167 You can't control (via technical means) what happens to information once you transfer it to a computer you don't own. Period. – Ben Voigt Jan 14 '13 at 21:46
  • @Ben Voigt, Are you saying decrypting information/my program with the user's consent is illegal? What do you think about programs that require internet connection for example a new trend of this is happening in games. Which require you to be logged on at all times. – K_X Jan 14 '13 at 21:54
  • 1
    @K_X: I didn't say it's illegal, I said it's ineffective. It's also a terrible idea because it adds bugs without actually accomplishing anything. And if you're talking about online games (vs just having an online license check), my statement doesn't apply because the server code and data is never transferred to other computers (i.e. outside the server farm(s) of the owning entity). – Ben Voigt Jan 14 '13 at 21:55

2 Answers2

2

There is no way of doing what you describing. Get rid of it.

Another way to do such a thing would be to have a webservice that the user has to authenticate against which then sends the sensitive information over a secure channel (e.g. SSL/TLS).

An second approach could be that you

  1. Enrypt the information
  2. Embed the encrypted version of the sensitive informations into the executeable
  3. Ask the user for a symmetric key at runtime (e.g. he has to enter the "passwort" for the data)
  4. Use the symmetric key to decrypt the information
  5. Use the information

The big disadvantage here is, that if the symmetric key (e.g. the password) is stolen in any way, the attacker can then get all that enrypted information.

GameScripting
  • 16,092
  • 13
  • 59
  • 98
  • So I use the user's password to encrypt the data. Thus I can use Asymmetric encryption instead which is useful for small amounts of data. – K_X Jan 14 '13 at 21:44
  • If you want to use asymmetric encryption you'll have to store the private key somewhere, **and the executable is not the right place to do so**. – GameScripting Jan 14 '13 at 21:47
  • No no no, I know this. I would encrypt the data with the public key then the user will use their private key which they can obtain online. – K_X Jan 14 '13 at 21:59
  • The the user has then to authenticate against the online service which will provide the private key. So the online service could provide all the data itself, so whats the point? – GameScripting Jan 14 '13 at 22:03
0

What about SecureString? Seems like this would handle hiding the information within the program without a whole lot of bother. If the memory is dumped during execution then the data will be encrypted.

John
  • 15,990
  • 10
  • 70
  • 110
  • 1
    How/where does he store the string that will at runtime be transformed into a `SecureString`? – GameScripting Jan 14 '13 at 21:32
  • Ah so I could use this both for the IP and personal information and also the symmetric password for even more security, good idea. – K_X Jan 14 '13 at 21:37
  • This could, maybe, possibly, make it a bit harder. It can't possibly make it impossible (or even impractical) for someone to get at that info. – Servy Jan 14 '13 at 21:38
  • I'd think the data could be encrypted some other way but this would do no good if it was unencrypted while the program was running. Maybe I misunderstood his question a bit. – John Jan 14 '13 at 21:40