|
I didn't mean to duplicate my post in many places and if it done I'm sure it done by fault... sorry
JusT LeT YouR MinD WorK
|
|
|
|
|
Question -
There're many obfuscators in the market - what happen if you obfuscate an exe which is NOT signed with a strong name? Strong name - is if you want to install your dll's into GAC, or that you want runtime to check if the binary has been tampered with.
http://www.eziriz.com/help/source/main_panel.html[^]
Take .NET Reactor for instance, it can sign an exe WITHOUT a strong name, with anti tampering/anti disassembly options. In this case, what's the point of having a strong name?
MSDN says ...[^]
dev
modified 26-Aug-13 19:13pm.
|
|
|
|
|
You can always obfuscate a dll which is not signed.
You just can put it in the GAC.
An exe would normally not go into the GAC in any case.
|
|
|
|
|
Bullshit from "MSDN says"
"Strong names offer a powerful mechanism for giving .NET Framework assemblies unique identities. ... mentioned, the .NET Framework verifies the signature either when loading the assembly or when installing it in the GAC. Without access to the private key, a malicious user cannot modify your code and successfully re-sign it."
With all this complication, it has nothing against tampering (If you want anti tampering, buy obfuscation tool from vendor). Unique name? Why not I just read md5 signature? Why bother strong name?
M$ recent years has just been too busy inventing useless sh*t.
For those of you who want to read this bullshit[^]
dev
|
|
|
|
|
devvvy wrote: Why bother strong name?
I load my stuff using the strong name; the fact that it's unique makes it a bit harder to register a new dll on the machine with the same name.
Bastard Programmer from Hell 
If you can't read my code, try converting it here[^]
|
|
|
|
|
devvvy wrote: Why not I just read md5 signature?
Who told you a MD5 hash was unique to only one assembly? That's simply not true. It's rare that two different streams of bytes can come up with the same MD5 hash value, but it is possible.
MD5 is not considered secure anymore. It's too easily broken.
But, it's still just barely useful enough to be a factor in a multiple-factor identification scheme.
|
|
|
|
|
is there any signature based algorithms? I think strong name too much work
dev
|
|
|
|
|
Sign the .EXE with a certificate specifically created for code signing.
|
|
|
|
|
Obfuscation and strong naming serve different purposes.
|
|
|
|
|
for antitampering, use obfuscation tools
for unqiue names/id, seems like i'd prefer simple md5 signature over strong names as strong names takes too much time (sign all 3rd party dll's requires a lot of time) but some argue md5 not unqiue
wonder if all this complexity/additional work from strong name necessary - that really there's no alternative to md5, that we can just run a simple command and generate a unqiue id string like md5 for a binary
dev
|
|
|
|
|
Strongname signing - is for authentication.
Obfuscation - is for encryption.
You, yourself, can authenticate an assembly you are about to load. You need the public key of the assembly supplier, the assembly public key and hash (both stored in the assembly). Now calculate the hash of the assembly using its bytes. If the public key of the assembly matches the public key you know belongs to the supplier, and the hash of the assembly matches the hash you calculated with the public key of the assembly, the assembly can be assumed to be original.
Microsoft .Net performs strong name checking when loading, but it doesn't know whether the assembly's embedded public key is the right public key. That is for you to check.
The same goes for signed executables (VeriSign, etc.) - these all rely on the user being able to tell whether the public key in the executable is the right public key.
Btw. The authentication check only makes sense if all the assemblies to load are checked. Otherwise, a dependent assembly could be tampered with. That is why an assembly should not be strong name signed, if it is dependent on unsigned assemblies.
Hope it makes sense.
Kind Regards,
Keld Ølykke
|
|
|
|
|
Thanks - do you think md5 is sufficient (and much simpler with much lower admin cost) than strong name?
Are you aware of alternatives than strong name and md5?
dev
|
|
|
|
|
Custom MD5 doesn't authenticate that the DLL is the right one so MD5 isn't even an option;
If you have Application A that depends on DLL B
Application A contains in the binary an MD5 sum value of say "12345"
DLL B in the binary has an MD5 sum value of say "12345"
there's nothing stopping an attacker from creating a new version of DLL B with MD5 sum of say "23456" And then just using a hex editor to modify application A to accept MD5 hash of "23456" so nothing is achieved
If; however; you attempt to do the same thing with strong named Application A and dll B, you won't be able to do it, as Application A will refuse to run when it's modified
Strong naming has nothing remotely to do with the MD5 hash of the file nor do they achieve the same thing.
|
|
|
|
|
Hi Matty,
In your example A is signed with information about B's signature, which builds a lovely hierarchy of signed assemblies. This is great tech.
However, if I decompile and compiles A, your users would not know - would they?
It doesn't matter whether the hacked A is signed or not. If the user never checks the signature of A against a public available source that is authentic to the user.
Don't be tricked into thinking that strong name signing is a solid automatic run-time authentication - neither are certificate signing. They both rely on the user initiating a signature verification using a "correct" public source - e.g. a public key or certificate.
Btw. I can recommend this post. he is much better with words than I am: http://blogs.msdn.com/b/ericlippert/archive/2009/09/03/what-s-the-difference-part-five-certificate-signing-vs-strong-naming.aspx[^]
Kind Regards,
Keld Ølykke
|
|
|
|
|
Totally agree;
The entire system hinges on validating the signature before you execute it.
My main point was more than a hand-rolled solution based only on an MD5 hash doesn't provide remotely the same features as strong signing does.
However; there are cases where run-time authentication using the strong signing is useful.
Consider following example;
You can easily grant .NET security permissions based on a particular publisher.
I grant only assemblies published by "MattyCo" access to read/write from MattyCo's super secret drive
If you decompile and recompile A with no or a different signature; the newly recompiled assembly they've sneakily placed on my machine isn't signed by MattyCo, can't access the drive, and no harm is done.
So I got a fair amount of benefit there using the inbuilt run-time authentication that .NET/Windows provides
(Also you obviously get none of these benefits just by using an MD5 sum..)
|
|
|
|
|
Yes, indeed I think your example is the way to use strong name authentication of assemblies as a windows user. Whether it is easier than MD5 checks of downloaded files is another discussion.
Btw. I wonder if this possibility is used by IT staff when managing shared workstations, or what other cases could be. I know there is some identity management when running Azure apps - don't know if it is linked to strong name signing. Would make sense though.
Kind Regards,
Keld Ølykke
|
|
|
|
|
If understand you right, you are asking whether I think MD5 hashes are great to verify that a downloaded file is authentic - e.g. like described here http://www.openoffice.org/dev_docs/using_md5sums.html[^]. I like this tech.
However, I don't think most users are able or care to do these checks. The problem here is that the user needs to authenticate the file herself, that is, to match the public available hash code of the file with a calculation she has to initiate.
If you ask me whether you should use strong name signing, my answer is yes. Not because it is a very strong security, but because it is a mechanism that runs by default for most users.
Again most users will not check the public available hash'es of the assemblies that they load, so whether they have been decompiled and compiled again by an evil person is not a question that can be answered by your users.
> Are you aware of alternatives than strong name and md5?
Not really for files. Sorry. I guess it is hard to enforce.
Between servers it is pretty common to know each others certificates / public keys. Messages are signed when sent and authenticated when received.
If you have code running at both server and client, you could add server authentication on the client side e.g. if your code is downloading files the files your code can authenticate the files against server certificates.
I think there is a gap here in the user experience that needs to be filled by a good standard and a handful of products.
Kind Regards,
Keld Ølykke
modified 30-Aug-13 6:41am.
|
|
|
|
|
Thanks for your thoughts first of all, I was hoping to see the most/more stringent argument for/against using Strong Name as supposed to md5 for "authentication" of binary.
"However, I don't think most users are able or care to do these checks. The problem here is that the user needs to authenticate the file herself, that is, to match the public available hash code of the file with a calculation she has to initiate."
I think as long as I publish the md5, that's end of my responsibility at least for the line of work that we're doing - I wouldn't go about signing all 3rd party library.
I do appreciate your argument however. It's informative.
dev
|
|
|
|
|
I need to my work (C#) projects with good unit tests. This code should have relative good coverage. I wrote relative, because good is depend on point of view  . I can wrote simple project on my self, but I need real world apps.
Thanks
|
|
|
|
|
I don't know what you are talking about, but if you need Unit Testing, get a free book by Marc Clifton. Unit Testing Succinctly[^]. What's your question?
I remain joe!
|
|
|
|
|
Links, names projects with unit tests where code is relative good covered.
|
|
|
|
|
You still didn't asked a question. What do you mean by code covered? You want a sample project that includes Unit Testing, read that book. You want a good code? Good code does what is suppose to do. You want a good website? CodeProject.
I am running around as I don't know what you are looking for.
I remain joe!
|
|
|
|
|
I use NUnit for Unit Testing, and that comes with a lot of tests for NUnit. The soure code for NUnit is available, and I hope their unit tests are included...
|
|
|
|
|
Skynet87 wrote: I need to my work (C#) projects with good unit tests. This code should have relative good coverage.
You want a Unittest that covers your Project good? So you have to design a Unittest that covers it. Unittests aren't automatically there, they have to be designed and written.
Best way:
- Write a concept with all Requirements
- Let Team / Person A write the Unittests for that concept
- Let Team / Person B write the Code for that concept
- Run the Unittests, while Team / Person B is coding. The Unittests should cover almost all code and the tests should work. If they don't the concept hasn't been implemented fully either by Team A or by Team B or by both.
|
|
|
|
|
I did a billing project using C# Windows Forms & MySql. But i don't know how to back up this data for every 1 week.
How many possibilities are there to backup a database? And which one is the best and how to recover the database??
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
