Is it safe to store sensitive data in a C++ compiled binary?

Asked 28/12, 2012 at 13:5 Answered 28/12, 2012 at 14:38

It's well known that dlls produced by .NET can be easily decompiled. This means that sensitive information (e.g. encryption keys) should not be stored in .NET binaries.

Would it be a sensible alternative to store sensitive data in (for example) C++ binaries which could be consumed by my .NET code? I don't yet know anything about interop stuff, but am curious about whether this could be an avenue worth pursuing. I guess to clarify, my questions are:

Could a binary produced in C++ (or C) be readily decompiled to access sensitive string data?
Is this a totally harebrained idea, either because it wouldn't work, would be very difficult to accomplish, or because a far better alternative exists which I haven't encountered yet?

Excite answered 28/12, 2012 at 13:5 Comment(9)

amazing that while reading your question SO is showing a link to dotPeek decompiler: jetbrains.com/decompiler/… :))) – Surrebutter 28/12, 2012 at 13:8

Couldnt you just use Dotfuscator ? – Apiary 28/12, 2012 at 13:10

obfuscated code can be decompiled. – Coracorabel 28/12, 2012 at 13:11

whoever makes dotfuscator could make a fortune selling a decompiler for dotfuscator (and, of course, dotfuscator professional.... and a decompiler and then dotfuscator premium, and then... you get the idea) – Ultramicroscopic 28/12, 2012 at 13:18

Yeap, stupid question, my bad. – Apiary 28/12, 2012 at 13:24

If you want to store sensitive data, consider CryptProtectData and company. – Confident 28/12, 2012 at 13:42

This belongs in the security subforum of SO, in my opinion. – Taco 28/12, 2012 at 14:52

@Guillied: security subforum??? Where do I find this? – Excite 28/12, 2012 at 16:41

@Excite I think he/she is refering to security.stackexchange.com – Windpipe 29/12, 2012 at 11:53

The answer is no. Whilst its true a .NET dll can be trivially decompiled to its original structure, and a C/C++ dll can only be decompiled to a monster mess that a compiler would love, the data that's stored in there will be placed in a big, un-mangled, bucket so anyone who knew which part to look at (and, ok, all that data is crammed up close to each other so it becomes difficult to know which bit is which) but the data will be there for all to see.

Google for data segment which is where the static data in a native windows binary gets placed.

quick edit: of course, you can store encrypted information in your C++ binary, pre-encrypt it but you will have to use something else to store the decrypt key (eg your windows user password or similar). .NET allows you to store sensitive information in a config file and will easily encrypt it on first-run or install, this encrypts and decrypts it based on the user account details the app runs under (so don't change it, and keep a copy of the un-encrypted config file somewhere :-) )

Ultramicroscopic answered 28/12, 2012 at 13:9 Comment(5)

The truth is, you can store sensitive data in the binary, if you know what you are doing. Skype does that (RC4 keys) and no one to this day managed to find it there. – Volpe 28/12, 2012 at 14:35

@aleguna any sources to prove that? – Windpipe 28/12, 2012 at 14:50

Presumably you could add the sensitive string data to the binary in some jumbled up way and add some trivial code to your C++ binary which knows how to reassemble it again. I don't mean proper encryption, just a means of rearranging it arbitrarily. So anyone looking at the data segment wouldn't see the sensitive data as it is, and wouldn't be able to decompile the actual source code to see how it needs to be rearranged. – Excite 28/12, 2012 at 16:25

@David: Yes, you can do that. But that just means that someone who wants the sensitive info can't just dump the string table, so they have to attach a debugger. Be aware that there exist people intimately familiar with debugging compiled code, and they will find your obfuscating function and reverse engineer it perhaps even faster than it took you to design and write it. Obfuscating simply adds a speed bump. – Authorize 28/12, 2012 at 17:30

@aleguna - sure but that works out like DRM, where the key is embedded in the player.. didn't take long for hackers to crack those DRM systems and extract the keys. As it is, the skype rc4 keys were supposed to be hacked years ago – Ultramicroscopic 29/12, 2012 at 18:9

String literals can be read from native(c c++ code compiled) binary (exe or dll)

Paulenepauletta answered 28/12, 2012 at 13:8 Comment(0)

There's always a way to sniff out the sensitive information in your binary file. The differences between .NET binaries and native binaries are the complexity of their reverse analysis (the root cause is NET code is run on process virtual machine (VM), so the protection mechanisms of .NET barely do some tricks beyond the VM). As you mentioned, .NET binaries can be easily decompiled, even you obfuscated your binary file by some obfuscator, such deobfuscators like de4dot can deobfuscate it easily. But the reverse analysis of native binaries is more difficult than the former. There are plenty more effective protection mechanisms in this field, such as anti-debugging, the virtual machine obfuscation and so on. These techniques could make your code more secure, of course this is a relative thing.

Joli answered 28/12, 2012 at 14:21 Comment(0)

The answer is YES. Sensitive data can be stored in C++ compiled binaries. People who don't know anything about security do it all the time.

Coracorabel answered 28/12, 2012 at 13:10 Comment(4)

If you want to be ironical put this as comment but not as an answer! – Struthious 28/12, 2012 at 13:11

You just should never, ever, EVER do it. I'd never use a product that did that. – Bona 28/12, 2012 at 13:12

I wasn't sure if I should +1 or -1 your answer (I didn't vote), because according to the pure title your answer is correct, but it isn't helpful at all. I renamed the question's title so I'm sorry that your answer now became wrong. – Phylogeny 28/12, 2012 at 13:16

@aleguna: Oh. I don't. I use Google Voice, which I trust to be a little better in that regard. – Bona 28/12, 2012 at 15:10

There are various degrees of security with different costs and inconveniences to users. Storing keys in code is fairly common but not very secure. Since you are using .NET that implies Windows and you might want to look into the data protection API (DPAPI). It encrypts data using your Windows user id password as the key.

Many laptops and servers includes a Trusted Platform Module (TPM) chip which will do encryption for you and protect the key for you.

Pavior answered 28/12, 2012 at 14:38 Comment(0)

Recommended topics

Hot tags