Attack Methods

Attack Methods

An attacker can access private information held in software in many ways, some obvious and others not so obvious, depending on how the data is stored and how it s protected. One method is simply to read the unencrypted data from the source, such as the registry or a file. You can mitigate this method by using encryption, but where do you store the encryption key? In the registry? How do you store and protect that key? It s a difficult problem to solve.

Let s imagine you decide to store the data by using some new, previously undiscovered, revolutionary way. (Sounds like snake oil, doesn t it?) For example, your application is well written and builds up a secret from multiple locations, hashing them together to yield the final secret. At some point, your application requires the private data. All an attacker need do is hook up a debugger to your process using the secret, set a breakpoint at the location where your code gathers the information together, and then read the data in the debugger. Now the attacker has the data. One way to mitigate this threat on Windows NT, Windows 2000, and Windows XP is to limit which accounts have the Debug Programs privilege referred to as SeDebugPrivilege or SE_DEBUG_ NAME in the Microsoft Platform SDK because this privilege is required to debug a process running under a different account. By default, only administrators have this privilege.

Another danger is an asynchronous event, such as the memory holding the secret becoming paged to the page file. If an attacker has access to the Pagefile.sys file, he might be able to access secret data. Another, perhaps less obvious, issue is your application faulting and a diagnostic application such as Dr. Watson writing a process s memory to disk. If you have the secret data held in plaintext in the application s memory, it too will be written to the disk.

Remember that the bad guys are always administrators on their own machines. They can install your software on those machines and crack it there.

Now that we ve seen how a secret can be leaked out, let s focus on ways to hide the data.



Writing Secure Code
Writing Secure Code, Second Edition
ISBN: 0735617228
EAN: 2147483647
Year: 2005
Pages: 153

flylib.com © 2008-2017.
If you may any questions please contact us: flylib@qtcs.net