Re: root/admin and client users in an application

Re: root/admin and client users in an application

Secure Home | Search | About
 General Computer Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Re: root/admin and client users in an application Dustin Cook 10-06-2006
Posted by Dustin Cook on October 6, 2006, 11:31 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

> I need to secure an application somewhat and I am trying:
> .
> 1._ for the source/app executable code not to be viewed/hacked

Impossible to achieve...

> 2._ to not store passwords or user names of any kind. They must not be
> permanently stored by the application

I don't see any problem here...

> 2.1_ user would just enter theri login info at the command prompt
> nothing is stored in a file so that dictionary attacks aren't possible


This could be a problem. How would you intend to retrieve the login data
for verification?

> .
> 3._ for the application to pretty much take care of security itself
> not the OS

What sort of security?




--
Dustin Cook
Author of BugHunter - MalWare Removal Tool
web: http://bughunter.it-mate.co.uk
email: bughunter.dustin@gmail.com.removethis
Last updated: October 6th, 2006


Posted by Rhino 007 on October 7, 2006, 11:27 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

Dustin Cook wrote:

>
> > I need to secure an application somewhat and I am trying:
> > .
> > 1._ for the source/app executable code not to be viewed/hacked
>
> Impossible to achieve...

Dustin,

I'm just curious about this. I assume this is because the executable
can be disassembled
and the assembly code can be read.... So even if you could encrypt the
executable, and still have it execute you could simply cause it to dump
core, and read the corefile.... Or if you had the executable
firewalled, and protected on the remote server by the best firewalls
available
once the program ran on your computer locally, once again you could
crash it and read the corefile... correct?

Rhino


Posted by Dustin Cook on October 9, 2006, 9:02 am
If you were  Registered and logged in, you could reply and use other advanced thread options
@i3g2000cwc.googlegroups.com:

>
> Dustin Cook wrote:
>
>>
>> > I need to secure an application somewhat and I am trying:
>> > .
>> > 1._ for the source/app executable code not to be viewed/hacked
>>
>> Impossible to achieve...
>
> Dustin,
>
> I'm just curious about this. I assume this is because the executable
> can be disassembled
> and the assembly code can be read.... So even if you could encrypt the
> executable, and still have it execute you could simply cause it to dump
> core, and read the corefile.... Or if you had the executable


I'm not sure about dumping core, but given enough time with the proper
tools one could disassemble the executable, yes.

> firewalled, and protected on the remote server by the best firewalls
> available

If it's going to run on the client pc, assuming it is actually running on
the client pc, the firewall becomes a moot point... However, if your
doing something like vnc, and it's not actually running on the client,
and the client has no direct access to the program, then you could say
it's fairly safe from being cracked/examined, yes.

> once the program ran on your computer locally, once again you could
> crash it and read the corefile... correct?

The goal isn't to crash the program if at all possible, the goal or idea
rather is to trace the programs calls as it runs.

--
Dustin Cook
Author of BugHunter - MalWare Removal Tool
web: http://bughunter.it-mate.co.uk
email: bughunter.dustin@gmail.com.removethis
Last updated: October 6th, 2006


Similar ThreadsPosted
web application call executable code to serve client req December 14, 2006, 1:18 am
Application Hosting January 23, 2008, 5:31 am
access to server application January 10, 2006, 11:21 am
OPIE or SKEY authentication on web application January 26, 2005, 7:43 am
password versus pin in application authentication May 29, 2006, 8:38 pm
Call for papers: Special Issue on: "Data and Application Security" October 21, 2006, 1:20 pm
REVIEW: "Application Security in the ISO27001 Environment", Vinod Vasudevan et al November 20, 2008, 12:38 pm
VPN Client Software July 6, 2004, 7:48 am
Value of SSL client certificates? October 19, 2007, 10:18 am
VPN vs SSL client side certificates September 6, 2005, 12:48 pm

The site map in XML format XML site map

Contact Us | Privacy Policy