Re: Protecting assemblies from being used outside a company/group/team

From: Nicole Calinoiu (calinoiu)
Date: 02/02/05 

Date: Wed, 2 Feb 2005 16:11:11 -0500

Unfortunately, it will be possible for code with adequate CAS permissions to
spoof this at runtime without decompiling your code if you use the .NET
framework methods for reading the strong name from the assembly. (This is
also one of the mechanisms used to spoof a StrongNameIdentityPermission
verification, so it's not exactly obscure.) In addition, since your
obfuscated code will be calling into unobfuscated framework or CLR code, it
would be trivial to find the verification method in your assembly's IL, so
reverse engineering won't be nearly as difficult as you might hope.

"William Stacey [MVP]" <staceywREMOVE@mvps.org> wrote in message
news:u0zBD3VCFHA.3596@TK2MSFTNGP12.phx.gbl...
> You could sign the assembly with a public key, then also include the
> public
> xml key inside your code. Then your code checks that the assembly is
> signed
> by getting the public key on the assembly and verifies that against the
> stored one in your code. If they match, then the code has not been
> modified
> sense it was signed and you can ~trust the public key. You can then also
> obfuscate the code to make it much harder to reverse and inspect the code.
> All this would still not prevent someone from reversing the code (However
> I
> can not do this today with XenoCode obfuscator and logic obfuscation on,
> but
> probably in the future) and just bypassing all your checks to produce a
> new
> assembly and use that. The upside is a simple crack or bit flip in the
> code
> does not work to change the assembly as it is signed and changing a byte
> would fail your tests above.
>
> -- William
>
> "Abelardo Vacca" <AbelardoVacca@discussions.microsoft.com> wrote in
> message
> news:D65F3836-1432-489F-8B1D-A101B5918CB5@microsoft.com...
>> Thanks Dominik,
>> As I feared, yeah, there is no bulelt proof protection if my application
>> will be locally installed in the client machines.
>>
>> Just for the sake of knowledge: yeah there is a way to "assign" a
> PublicKey
>> to an assembly (I just tested it on my machine a few minutes ago.) But as
> you
>> said, I guess turning CAS off would do the trick too.
>>
>> Thanks for the info
>>
>> "Dominick Baier" wrote:
>>
>> > well - the easy answer is : you can't.
>> >
>> > if someone 'owns' your assembly he can pretty much do everything he
> wants.
>> >
>> > e.g. turn off CAS altogether (caspol -s off).
>> >
>> > You can't just "assign" the public key to a assembly - because you
>> > need
> the private key to sign the assembly to match the publik key /
> signature...
>> >
>> > What you may looking for is the licensing API in .NET
> (System.ComponentModel.License) - but again - if someone has your binaries
> it is only a matter of time until he figures out your protection scheme
> (guess why virtually every commercial software is availabe cracked??). but
> it buys you time.
>> >
>> > Dominick Baier - DevelopMentor
>> > http://www.leastprivilege.com
>> >
>> >
>> >
>> >
> nntp://news.microsoft.com/microsoft.public.dotnet.security/<9345EB50-D78C-4E11-8648-0EDF7AD5EB36@microsoft.com>
>> >
>> > Hello
>> >
>> > On my previous post I mentioned my developement team is interested in
>> > protecting our assemblies from being used by other people. One way we
> think
>> > we could do this is by giving a strong name to our assemblies using
>> > the
> same
>> > key pair, and using a LinkDemand for the PublicKey in all the
> assemblies
>> > public classes.
>> >
>> > I suppose this way we are protected from being called by not signed by
> our
>> > team.
>> >
>> > But I have been reading about Delay signing and I foudn out this
> command "sn
>> > -Vr myAssembly.dll" that bypasses the verification process for strong
> name
>> > assemblies.
>> >
>> > So, here is the question: If the Pulic Key is , well, Public, and it
>> > is
>> > found inside our assemblies, what is keeping other people from
> artificially
>> > assigning the public key to their assemblies, then bypasing the strong
> name
>> > verification, and voila! they have access to our "secured" assemblies!
> :S
>> >
>> > Is this possible?
>> >
>> > If so, I guess many others before me have found a better way to
>> > protect
>> > their assemblies. Please let mw know your thoughts and ideas. Is the
>> > Publisher Certificate a better option?
>> >
>> > Thanks
>> >
>> > [microsoft.public.dotnet.security]
>> >
>
>

Relevant Pages

  • Re: When to use Public/Private Key & when to gen new one?
    ... The key pair is uniquely bound to each other: you can't have one private key ... options for extracting the public key, but not one for 'build new public key ... I was including in assemblies whatever it had spat one ... probably keep the same snk file across various builds of an assembly, ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: problem with StrongNameIdentityPermissionAttribute
    ... I suppose this because it doesn't matter If I use the public key ... key blob (the one from my assemblies) or the right one (from Microsoft WSE ... Request for the permission of type ... > not perform any checks at all, it is used to modify stack walk behavior. ...
    (microsoft.public.dotnet.security)
  • Re: how to ensure only strong name assemblies are loaded with matching public key
    ... assembly for introspection, which means that you can inspect its metadata (including the public key), but cannot execute any code. ... >Subject: Re: how to ensure only strong name assemblies are loaded with matching public key ... >assumption is that one would load an assembly to use it, ... >>>special directory containing updates to the client software. ...
    (microsoft.public.dotnet.security)
  • Re: Another StrongNameIdentityPermission/LinkDemand question
    ... If you are planning to do this to "keep the honest people honest", ... serve as a mild deterrent. ... public key and achieve my original purpose that way. ... caller only trusted assemblies, and it seems like this should work. ...
    (microsoft.public.dotnet.security)
  • RE: ilasm and delayed signing
    ... We can use the al and sn tool to do the delay sign. ... you must have access to the public key. ... option specifies the name of the key file containing the public key to use ... Note that strong-named assemblies contain version information that the ...
    (microsoft.public.dotnet.framework.interop)