Re: sn.exe -Vr assembly

From: Nicole Calinoiu (calinoiu)
Date: 01/21/05 

Date: Fri, 21 Jan 2005 07:12:31 -0500

"Gecko" <nada@nada.com> wrote in message
news:%23BBA1Gz$EHA.1452@TK2MSFTNGP11.phx.gbl...
<snip>
> I am currently in the process of developing a Windows application that is
> intended to run in home computers so you can forget about trying to rely
> on the users logging as restricted users and protect my assemblies that
> way, heck, as far as I know, the users of the application themselves may
> want to tamper with my files to just to piss me off!!

Why would a user's modification of your assemblies on their own machine have
any effect on you? If you're concerned about protecting your intellectual
property, obfuscation is the generally recommended first line protection.

> At the end, the whole idea is to be able to distribute an exe and a dll to
> my users that can't be tampered with by some hacker or by them.

What you want simply isn't possible. It's even possible to tamper with
unmanaged assemblies, but that happens to be considerably more difficult
than tampering with managed assemblies. You can increase the difficulty of
reverse engineering and tampering with your managed assemblies via
obfuscation.

Strong naming also has its place, but it's meant to protect your users, not
you (despite what various articles and even some of the Microsoft
documentation might suggest). If they run as admins and lose that
protection, that is at least partly their problem. If you feel that it's at
least partly your fault for distributing assemblies that are so trivially
tampered, then perhaps .NET isn't for you.

> The application uses remoting to communicate with the server and I think
> there is some integrity checking that goes on there but I am still trying
> to figure all this out.

That's another issue entirely. If you're counting on your client
application to perform data validation, permissions verifications, or other
security measures that aren't replicated on the server, then you've got a
much bigger problem than tampering with your distributed client assemblies.
Basically, in an "any client" remoting scenario, anyone could submit
requests to your server, and the only information the server has is the data
received from the client. That data can be submitted from any client
application, not just the one you distributed, and it's not all that
difficult to simulate most remoting communications. Unless you are
restricting communication to trusted clients (e.g.: by implementing IPsec
restrictions to allow distribution of middle tier work between multiple
fully controlled servers without allowing other clients to connect to these
servers), you should not be trusting that supposed protective mechanisms run
on the client have really been run.

Relevant Pages

  • Re: A case for windows firewall
    ... the license renewal includes the right to the newer software. ... may protect against downadup attempting to use the SMB vector but fail ... So do I recommend that my clients, whether they are 5 client machines or ... I use the Windows firewall, but I cannot help but ask, "Where was the ...
    (microsoft.public.windows.server.sbs)
  • Re: soapsuds
    ... > the 'server' assembly, then the soapsuds extraction falls over. ... > in .Net that namespaces cannot span assemblies? ... > interface defined in a shared assembly (which can be implemented my other ... dll which sits both on the server and the client allowing objects to talk to ...
    (microsoft.public.dotnet.framework.remoting)
  • Re: "Insufficient state to deserialize the object" error
    ... The delegate itself is a serializable object, so both client and server need ... > that requires serialization? ... >> If any of the assemblies are being loaded from the mapped drive, ...
    (microsoft.public.dotnet.framework.remoting)
  • Re: Can RCW and CCW be used together?
    ... component project reference to my client project and build. ... Dim iads As IadsAutomationLib.Application ... problem-domain specific assemblies and the assemblies for the RCW-Interop ...
    (microsoft.public.dotnet.framework.interop)
  • Re: Natural keys vs Aritficial Keys
    ... A welding shop client that empoyed hundreds of welders built and assembled very ... complex piping assemblies for refineries, power plants and oil sands plants. ... When a designer is exposed to this, a moment's thought should be enough to see that the different parties operate from distinct concepts. ...
    (comp.databases.theory)