1

If I have a simple CRUD app executable in .NET, what prevents a user from loading it into RedGate Reflector and viewing all the contents, including db connection strings, passwords, etc?

Can I protect against this in any way?

7
  • 5
    Storing connection strings and passwords in an executable is asking for trouble. Commented Aug 25, 2009 at 17:17
  • This question has been asked over and over again on SO. Please search for obfuscation. Commented Aug 25, 2009 at 17:17
  • 1
    Rewrite you app in C++ and reflector won't be able to load it. ;)
    – P.K
    Commented Aug 25, 2009 at 17:22
  • Sid, is it asking for trouble in general, or with regard to .NET executables only?
    – David
    Commented Aug 25, 2009 at 17:26
  • 1
    You need to redesign so that all this information is NOT in the executable PERIOD. C++ doesn't protect you, any idiot with a hex editor can view your strings just fine through that. Look at stored procedures, web services, or any sort of good remote authentication scheme to do this right. Commented Aug 25, 2009 at 17:29

7 Answers 7

3

No, the best you can do is obfuscate the assembly to make it harder to read and understand but other than that there is not way to stop someone from using Reflector or ILDASM to view the IL in your assembly.

Remember that the CLR needs to be able to read this assembly as well so if the CLR can read the assembly, so can anyone else.

2

Obfuscation is never the right answer. Maybe you're going about this the wrong way.

There are several ways I can think of so that the connection string is either not available or not important.

You could put your database behind a web service so that the connection string to the database would only be known to the web service. Of course, you'd need another way to restrict access to the web service, such as using login credentials.

Or, you could give each user their own SQL login name/password. That way, they would know their own userid/password but it would be easy to "turn it off" from the database. This also gives you much better control over each person's access to the database itself... like what tables/views they have access to, and what type of access.

1

You can make it hard to do so (obfuscation, string encryption, etc.) but it will never be impossible to reverse-engineer as long as the user has access to the executable.

1

including db connection strings, passwords

Define security in the database engine: limit users, limit machines from which users can connect, limit what users can do, and/or specify that users may interact with the database only via defined "stored procedures".

1

It depends what you want to protect.

If it's DB connection string with passwords, then don't store them, Example: set up IIS App Pool to run a limited service account to connect to the database and the trusted security. Assuming decent database security, knowledge of servername etc is useless.

1

You can put your passwords and connection strings in an hashtable or xml then encrypt your data, make an zip file with a password hidden in text file hidden with stenography behind an image. All your unzip and reading make in memory after making a read make a release, flush of memory, call the collector, after using your connection strings and fill clean your variables. Keep only the data you need in memory, be careful in using ram.

1
  • Nice ideas. Next time you answer try setting out your answer to make it a bit easier to read.
    – thomasfedb
    Commented Jun 24, 2011 at 8:20
0

Obfuscation would be an option. But I guess you cannot hide e.g. password strings completely. That's really unsafe.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.