Re: Are .NET Windows Applications Totally Insecure?

From: Michel Gallant \(MVP\) (neutron@istar.ca)
Date: 03/09/03

  • Next message: Andrew: "Thread protection" 
    From: "Michel Gallant \(MVP\)" <neutron@istar.ca>
Date: Sat, 8 Mar 2003 18:05:50 -0500

    First off, an item (whether it be a native exe, dll or .net assembly or java appetl)
    is digitally signed to provide *authentication* and integrity verification for the end
    user.
    It is not really about protecting the "digital asset ownership" of the application
    itself.
    You can probably do the same thing with a signed cab archive (i.e. extract the contents,
    and repackage and sign with your own certificate, claiming you are the owner .. hence
    constituting fraud!).

    It is up to the owner to ensure that they *trust* the digital certificate (and hence the
    CA issuer)
    of any application they receive that is signed.

    So this is not an issue with .net at all. It is a lack of understanding of what
    the purpose of a digital signature is all about!

     - Mitch

    "clintonG" <csgallagher@REMOVETHISTEXTmetromilwaukee.com> wrote in message
    news:#E0fSwb5CHA.2400@TK2MSFTNGP11.phx.gbl...
    > An associate claims windows applications developed with the
    > .NET Framework are totally insecure with regard to maintaining
    > digital asset ownership.
    >
    > His claim is based on an assertion that he can use ILDASM
    > on a dll or an exe to expose the owner of the application,
    > including the security certificate which can then be cut out and
    > replaced with other credentials and re-assembled thereby
    > making the application 'theirs.'
    >
    > How sound is his assertion?
    > Comment on why or why not please.
    >
    >
    > --
    > <%= Clinton Gallagher
    > A/E/C Consulting, Web Design, e-Commerce Software Development
    > Wauwatosa, Milwaukee County, Wisconsin USA
    > NET csgallagher@REMOVETHISTEXTmetromilwaukee.com
    > URL http://www.metromilwaukee.com/clintongallagher/
    >
    > LaGarde StoreFront 5 Affiliate: e-Commerce Software Development
    > SEE: http://www.storefront.net/default.asp?REFERER=-201499070
    >
    >
    >
    >
    >
    >
    >

  • Next message: Andrew: "Thread protection"

    Relevant Pages

    • Re: Programmatically Signing DLL
      ... key on it and sign a .DLL before it goes into production. ... > Dim Signer, SignedCode ... What kind of certificate do we need to buy to allow programmatic ... signing and validation of a DLL using VC++. ...
      (microsoft.public.security)
    • Re: Hi, Any work around for windows mobile 6 dynamic loading warni
      ... xml file is named _setup.xml (ensure you include the underscrore as the ... Then included the dll during runtime. ... your only option is to purchase a code signing certificate from the ...
      (microsoft.public.dotnet.framework.compactframework)
    • Re: Ask the Experts Help
      ... I didn't mention the 3rd party dll is also unmanaged C++. ... chktrust.exe to check an "assembly's" certificate, but only in my VS 2003 ... > the target dll that triggers the error message. ... > b) if I just sign my test app would it then be able to use the target dll? ...
      (microsoft.public.pocketpc.developer)
    • privileged dll in c# application
      ... application to run i must select a Privileged Certificate from the ... I created the dll with the ... Finally i deploy the application to my Smartphone and run it ... However i do not understand how the embedded visual c++ app works however ...
      (microsoft.public.dotnet.framework.interop)
    • c++ privileged dll in c# application
      ... application to run i must select a Privileged Certificate from the ... I created the dll with the ... Finally i deploy the application to my Smartphone and run it ... However i do not understand how the embedded visual c++ app works however ...
      (microsoft.public.dotnet.framework.compactframework)