Protecting Windows and .Net application from prying eyes

[Guest]

Hi. I am developing a Windows application that will connect to SQL Server and I had a few deployment questions.

First, on my server, I only have access to a single SQL Server login account. So, I need to use that account in my Windows application to talk with SQL Server. This application can have many users, each with their own security permissions, so I will control their rights and access through security tables that I will create. However, of course I still need to connect to the Sql Server - so how do I make my application secure? The application needs to have the master password and login account to access the database, but I obviously only want to allow access to the information that is relevant to that person, not all information in the database. How can I stop a malicious person from finding the password (maybe by looking through the compiled code or watching through some kind of network sniffer) and using it to connect to the database and gain access to all data through some other means (even using Enterprise manager or something)

On a related note, this application will have an accompaning ASP.NET web site that will also have access to the data. How can I stop a person from appending onto a url or using some other spoofing method such as guessing user ids to gain access to other people's information. I know to make this harder I can use guids but it seems like making every table's primary key a guid is a cumbersome solution

Finally, has anyone used those obfusicating programs? Do they really work or do they just make the offender go and by their own decomplier or something that will reverse the process or at least give them access to information such as a password? If they are worthwhile, which one would you recommend

Thanks for any help

Gre

 

[Guest]

Most of the security concerns you mentioned are pretty mush aleviated if you switch to Integrated Windows Security instead of name/passwod access. Managing accounts, storing passwords and all that jazz isn't much fun, and it's easy to get wrong

If you must use name/password logons and store some of them for your app to use, you can encrypt the values to prevent them from being read. You certainly should avoid hard coding any usernames or passwords into your app, however. At the very leasat, this will save you a recompile should your password become known and you need to change it. Changing passwords often is a good practice and hard coding it will make it *much* less likely that you'll do so.

Microsoft has a Configuration Management Application Block available that includes encryption abilities that will save you a bunch of time setting your configuration system up. It can store values in your app's config file or SQL Server or the registry or a custom store.

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnbda/html/cmab.as

On the subject of obfuscation: Yes, obfuscating your code can make it much more difficult to reverse engineer, but nothing will stop a determined and talented hacker. That is pretty much true for apps written in any language, though. Even machine code can be reverese engineered.

 

[Guest]

Hi. Thanks very much for your response. It was very helpful. The Configuration Management Application Block looks like something that will help with my questions. Also, I will look more into integrated security instead of username passwords

Greg