Securing a password in source code?

Question

I have a password in my code which is needed to connect to a sftp server. Whats the best way to "obfuscate" or hide it in the code?

Thanks

Etherify

What type of app? A desktop application or asp.net application? For asp.net you have some valid options because hopefully the user/attacker won't have access to the server. – Sulfite

Answer 1

Don't store you password in your source code, store it in a protected section within you App.Config (or Web.Config).

See Encrypting Configuration File Sections Using Protected Configuration section in this Microsoft Doc

This works by encrypting the encryption keys using built-in Windows stuff, locked to the MAC address and various other undocumented things.

This will even work if you are using more than one server:

... if you are planning to use the same encrypted configuration file on multiple servers, such as a Web farm, only the RsaProtectedConfigurationProvider enables you to export the encryption keys used to encrypt the data and import them on another server.

Using this, if someone wanted to get your password, they would have to first break the Windows security on your server (not impossible, but harder than looking into your IL for the password by far).

Tolman

Is there a way to protect password even if someone has control over your server ? – Monochromatism

Answer 2

I actually consider using the "protected sections" feature in App.Config or Web.Config to be LESS secure than storing the password in your code.

Anyone with server access can decrypt that section of the config just as quick as you encrypted it by running the decrypt command described in the article everyone keeps quoting:

aspnet_regiis -pd "connectionStrings" -app "/SampleApplication"

https://msdn.microsoft.com/en-us/library/zhhddkxy.aspx#Anchor_1

So this feature of ASP.Net only adds security in the case that a hacker somehow had access to your web.config but not your entire server (happened in 2010 as @djteller mentioned in the oracle padding attack comment). But if they do have server access, you're exposed in one cmd call. They don't even have to install ildasm.exe.

However, storing actual passwords in your code is a maintenance nightmare. So one thing I've seen done is storing an encrypted password in your web.config and storing the encryption key in your code. This accomplishes the goal of hiding passwords from casual browsing while still being maintainable.

In this case a hacker has to at least decompile your code, find your key, and then figure out what encryption algorithm you're using. Not impossible, but certainly harder than running "aspnet_regiis -pd...".

Meanwhile I am also looking for better answers to this six year old question...

Ander

Answer 3

Don't bother.
Anything you can do, your attacker can trivially undo.

If it only needs to run on a single machine, however, you can use the ProtectedData class, which will protect it securely against anyone not on that machine and/or user.

In general, the only remotely secure way to do this is to store the key in a separate, secure, location.
For example, you can encrypt it using a (non-MD5) hash of a password, then require the user to enter the password so that you can get the hash. (The hash and password themselves would not be stored anywhere; you should make a separate hash to verify the password)

Laius

is there a reason why MD5 is not suitable in this case? – Ingar

@the: MD5 is not a secure hash. Also, it's output isn't long enough for a secure encryption key. (Read, AES) – Laius

Answer 4

Best way is don't!

Failing that:

Encrypting Configuration File Sections Using Protected Configuration

Brusquerie

Answer 5

There are no "best way" to store password in source code since it can be recovered in many ways.

You can obfuscate password string or even encrypt it to prevent reveal thru simple viewing but it can't be treated as serious protection.

Negus

Answer 6

You can put it as an encrypted value in the web.config file. It doesn't look too hard: K scott Allen tutorial http://odetocode.com/blogs/scott/archive/2006/01/08/encrypting-custom-configuration-sections.aspx

I think there's a Scott gu blog post with links to other information. http://weblogs.asp.net/scottgu/archive/2006/01/09/434893.aspx

Displease

Don't forget to patch your machine, since the web.config file is viewable via Padding Oracle Attacks: threatpost.com/en_us/blogs/… – Volkman

Answer 7

Encrypt it with something strong like AES, but as implied by SLaks, your attacker can reverse engineer your code and work out the encryption method and key. All you are doing is adding a layer which keeps script kiddies and a certain level of attacker out. Someone who really wants to work it out, can do. They could also run your program and watch what password is sent.

Armbruster

True, but I was also thinking that stepping through the program with a debugger will show the password unencrypted in memory, between the unencryption and before the sftp connection is opened. – Armbruster

Answer 8

Don't save your password in the source code.

Read this: http://en.wikipedia.org/wiki/Security_through_obscurity

There is no good way.

All you can do is use a smart algorithm to encrypt the password.

An experienced reverse engineer would manage to crack it.

Volkman

Answer 9

There's not much you can do against someone who really wants your password. However, if this isn't a public app (intranet? in-house app or something) you could simply encrypt it using a symmetric encryption algorithm, or do something like base 64 encoding it. You could also run an obfuscator over your code to make it less obvious that there is a password in there somewhere.

Do you have another option? Raw SFTP access is kinda dangerous, maybe you can create some sort of proxy service in between, which only allows the specific actions your app requires. Storing the password for that service in your code is a not as risky as storing your SFTP password in your code.

Cardon

Answer 10

You could use something like SLP Code Protector to block reverse engineering of your assemblies. Still, I agree with everyone else, it's not the best idea.

Lewendal

Answer 11

Instead of storing a password in the code, the code could create a random key when the application first starts and store it somewhere else in a secure place. That random key could then be used to decrypt configuration files etc.

Eardrum

As it’s currently written, your answer is unclear. Please edit to add additional details that will help others understand how this addresses the question asked. You can find more information on how to write good answers in the help center. – Crabbed