Re: Code Signing And Hacking

From: Eugene Mayevski (mayevski_at_eldos.org)
Date: 10/15/04 

Date: Fri, 15 Oct 2004 13:56:32 +0300

Hello!
You wrote on Fri, 15 Oct 2004 09:45:41 +0200:

 AH> Not quite sure, but if he is talking about strong naming then your
 AH> statement is

Hackers are not usually interested in changing supplementary assemblies.
They usually need to remove protection, which is (usually) located in main
code. Another possible hacker's goal is to extract some algorithm or
resource. And signing won't help here either.

 AH> So strong naming provides both a way of identifiying if the code is
 AH> from a specified
 AH> (and perhaps trusted) source as well as way to determin if it has been
 AH> tampered with.

While the assembly can identify that it (or other assembly) has been
changed, the average hacker can easily remove the check too.

With best regards,
Eugene Mayevski

Relevant Pages

  • Re: Custom security permission exception error message
    ... > We're planning to use strong naming for our app and this does indeed ... unrestricted permission grant. ... AllowPartiallyTrustedCallersAttribute (APTCA) to your library assembly. ... appropriate security audit of the target library assemblies since applying ...
    (microsoft.public.dotnet.security)
  • Re: strong name and web service
    ... Great, that solves one question, strong name won't be checked by clients. ... I am investigating the use of strong naming in our .Net solutions. ... What can I benefit from strong naming a web service? ... > You can assign a strong name to assemblies that make up a web service, ...
    (microsoft.public.dotnet.security)
  • RE: ASP.Net 1.1 shadow copy + reflection problem
    ... Well if you use strong naming the problem will not dissapear but rather ... If you load all your dll's from the same folder you can simplify this by ... > (assemblies) from other directories that are not the bin. ...
    (microsoft.public.dotnet.framework)
  • Re: strong naming?
    ... Lack of strong naming means the runtime only has a version and path to load. ... There may be cached assemblies, ... reference different "versions" of the dll. ...
    (microsoft.public.dotnet.framework)
  • Re: strong name and web service
    ... should use strong naming. ... I can not think of any direct benefits from signing web service code. ... > I am investigating the use of strong naming in our .Net solutions. ... >> You can assign a strong name to assemblies that make up a web service, ...
    (microsoft.public.dotnet.security)