Bypassing object interface (security)

[Rene]

I am currently developing a Widows application that uses remoting to pass
objects back and forth from the server to the client computer and
vice-versa. When an object is instantiated and loaded on the server, the
object is loaded with important read-only information that I obviously don't
want the user to change because when the object is passed back on the
server, I use that read-only information to take different actions in how to
save the object's data back into the database.

My question is as follows: Once the object is moved to the client computer,
is it easy for a hacker to use some utility that is capable of locating
where the object is in memory and then use a utility to modify the data in
the object (my read only property values)?

Thanks

 

[Scott Allen]

"Easy" a relative term, but there are a plethora of memory tools and
debuggers that can inspect the memory of a process. You can't assume
anything is safe on a remote computer.

You could, however, detect if the client tampered with the data with a
cryptographic hash. The following article has some details and
examples:
http://msdn.microsoft.com/msdnmag/issues/02/09/aspnethashalgorithms/default.aspx

 

[Rene]

Can data be overridden directly in memory even for objects such as the
System.Threading.Thread.CurrentPrincipal object?

 

[Scott Allen]

Well, it would be easy to overwrite the property with managed code.