Re: if I encrypt key data why do I want or need SSL?

How would they put junk data into my system? Are you assuming they've been
able to hack in via an account? Unless ADO.NET 2.0 has some fundamental
security flaws when communicating to a SQL server? I could encrypt the
entire message also, all that SSL does for me is provide encrypted access to
external sources beyond the control of my security.

Slammer real world impact has been relatively low threat (which has been
countered via a patch a long time ago) -- in fact, it will provide zero
benefit in my situation (even if the SQL server is not patched) -- gaining
Windows Service security context (sends 376 bytes to UDP port 1434 for
buffer overflow) means nothing to the way my security is established -- the
only way they can obtain any value is if they were able to locate my strong
name DLL responsible for all security aspects, assuming they could get into
the DLL and somehow decompile it (without the public/private key pair) they
would then have to discover where in the DLL the call is to get the
encrypted key and then also have to realize that key needs to be
unencrypted.

In fact, the way my security is enforced has minimal reliance on the OS or
the SQL server -- about all a hacker could do is delete or change data and
that is assuming they have found a flaw in the OS/Service (i.e. slammer) --
data changes will soon be rejected by my applications as they will not
validate and be rejected as bogus data.

Can you provide details of how you might attack a strongly named assembly?
Opening the file in binary will not be terribly helpful and you can't
decompile it to any useful context, so please explain?

Web Services use the same approach, none of my web service will do anything
if they don't get a valid encrypted key as a parameter to all and any method
made available by the service and any sensitive data passed to from a web
service is always encrypted.

Rob

"Andy" <ajj3085@xxxxxxxxxxxx> wrote in message
news:1143573820.754223.139480@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
It sounds like it would still be possible for an attacker to put junk
data into your system. Take your encrypted value, and replace it with
another encrypted value. SSL would prevent this kind of tampering,
since the whole message is signed, not just individual fields.

Leaving port 1433 open to the internet has caused problems in the past;
perhaps you heard of the slammer worm?

Even with a strongly named assembly you are still open to some kinds of
attacks.

Finally you may need to communicate data with a web service at some
point, and I doubt you'd want to provide your key to the 3rd party.



.

Relevant Pages

  • Re: if I encrypt key data why do I want or need SSL?
    ... I could encrypt the ... name DLL responsible for all security aspects, ... Its trivial to decompile ANY .net ... For someone to send your web service they have to know the key? ...
    (microsoft.public.dotnet.security)
  • RE: protecting .NET assemblies from hackers
    ... try exposing a web service or a remote class.. ... So one thing to do here is use a code obfuscator to encrypt ... > edit data on basically every table in the database. ... >> other methods of security like domain authentication or using ssl. ...
    (microsoft.public.dotnet.general)
  • Re: Loading Class Library From FTP Location To Memory
    ... The web service is fine, but to clarify, my security concern was that the client machine would let code be executed from a byte array not stored locally. ... You show me a good way but I ll try to do using webservice instead of downloading dll file, cos I ll use dll based authentication and planning my web service accept some parameters and gives me desired dll as bytearray, every dll will have same method like ) and main app will call it. ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: WSE 3.0, usernameOverTransportSecurity, custom Token Manager w/ securityTokenManager,
    ... I've added the web service call directly to my Data binding method ... expected but not present in the security header of the incoming ... the username token to the message. ... protected override string AuthenticateToken(UsernameToken token) ...
    (microsoft.public.dotnet.framework.webservices.enhancements)
  • Re: Encryption of files on USB flash drive
    ... You can find problems with current transparent security methods, ... It is an EFS that encrypts individual files. ... You can choose to encrypt a folder and all of it's contents (including ... encrypt and decrypt data. ...
    (sci.crypt)