Tamper proof software
Security can be considered at different levels, we can think about how can we make our connexions secure and avoid any network related attacks, or how can we guarantee authentication, authorisation, manage and store users permissions. However, this is not enough, and security in computing is more than this. Security deals with other aspects and adds more layers and measures to make sure that data is correctly protected and provided to the eligible users. One of the interesting aspects of security is the tamper resistance, which are couple of technics and approaches aiming to avoid data, software or devices getting changed or altered by unauthorized persons or processes. This concept is used in different areas and not only for digital data; the Anti-tamper (device or software) generally comprises: tamper detection, tamper resistance, tamper response and tamper detection (Rannenberg, 2010).
Tamper resistance can be used to secure software and protect them from being modified. Attackers can chose to alter the security mechanisms of software instead of cracking passwords. When building software, we generally use some checks verifications with specific methods, we should keep in mind that attackers are generally good coders and most of the used software development platforms (Java or .Net) compile their code to an Intermediate language, which will be translated by the virtual machines. This can be considered as pre-executable code, it is not a native code (directly executable by the processor), but a simplified and modified version of the source code.
The executable files generated with Visual Studio, are intermediate code-based. Visual studio contains a set of tools as the IL Disassembler, which is used to read the content and structure of the Intermediate Language Code. The amount of information we can get simply by opening an executable or a library with this free legal tool is considerable, especially for security methods; attackers can know exactly which method is called for authentication with which parameters (type, name …etc.). This can be considered as a serious security issue. Attackers could go further and alter the security method used in the code, suppose we have a simple authentication method, which gets in parameter the typed password, compares it to the stored (and valid) password and return a Boolean value (true or false depending on the validity of the passed password). If attacker is able to alter this code, a simple insert of one command will change the whole software authentication and allow access for attackers.
Figure 1: Tampered authentication method.
One of the methods for software tampering is the code obfuscation. Complex method used to secure the intermediate and native code. As defined by Gregory “Let TR be translating process, such that P → B translates source program P into a binary program B. TR is a one-way translation, when time required for reconstruction of program P from program B is greater from a specific constant T.” (Wroblewski ,2002).
From this definition we can retain the most important information, which is the one-way transformation, obfuscated code can’t be reversed to the original source code neither the intermediate code. This method breaks most of the reverse engineering methods and ensures that the software is kept safe and won’t be altered. Here is a simple example of code obfuscation, we can see the Intermediate code before and after obfuscation.
Figure 2: IL before and after obfuscation (Nagara & Collberg, 2009).
Finally, it is worth saying that we should not only build secure software but also think about how to secure our software and avoid any tampering or un-authorised modifications. This should be considered seriously especially in encryption and security software (firewall, key encryption, antiviruses …etc.) (Rannenberg, 2010).
References
– Gregory Wroblewski (2002). General Method of Program Code Obfuscation. Wroclaw, available at: http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.19.9052&rep=rep1&type=pdf
– Jasvir Nagra, Christian Collberg (2009). Surreptitious Software: Obfuscation, Watermarking, and Tamperproofing for Software Protection. Pearson Education, 2009. ISBN: 0132702037
– Kai Rannenberg, Vijay Varadharajan, Christian Weber (2010). Security and Privacy – Silver Linings in the Cloud: 25th IFIP TC 11 International Information Security Conference, SEC 2010, Held as Part of WCC 2010, Brisbane, Australia, September 20-23, 2010, Proceedings. Springer, ISBN: 3642152562
Security can be considered at different levels, we can think about how can we make our connexions secure and avoid any network related attacks, or how can we guarantee authentication, authorisation, manage and store users permissions. However, this is not enough, and security in computing is more than this. Security deals with other aspects and adds more layers and measures to make sure that data is correctly protected and provided to the eligible users. One of the interesting aspects of security is the tamper resistance, which are couple of technics and approaches aiming to avoid data, software or devices getting changed or altered by unauthorized persons or processes. This concept is used in different areas and not only for digital data; the Anti-tamper (device or software) generally comprises: tamper detection, tamper resistance, tamper response and tamper detection (Rannenberg, 2010).
Tamper resistance can be used to secure software and protect them from being modified. Attackers can chose to alter the security mechanisms of software instead of cracking passwords. When building software, we generally use some checks verifications with specific methods, we should keep in mind that attackers are generally good coders and most of the used software development platforms (Java or .Net) compile their code to an Intermediate language, which will be translated by the virtual machines. This can be considered as pre-executable code, it is not a native code (directly executable by the processor), but a simplified and modified version of the source code.
The executable files generated with Visual Studio, are intermediate code-based. Visual studio contains a set of tools as the IL Disassembler, which is used to read the content and structure of the Intermediate Language Code. The amount of information we can get simply by opening an executable or a library with this free legal tool is considerable, especially for security methods; attackers can know exactly which method is called for authentication with which parameters (type, name …etc.). This can be considered as a serious security issue. Attackers could go further and alter the security method used in the code, suppose we have a simple authentication method, which gets in parameter the typed password, compares it to the stored (and valid) password and return a Boolean value (true or false depending on the validity of the passed password). If attacker is able to alter this code, a simple insert of one command will change the whole software authentication and allow access for attackers.
Figure 1: Tampered authentication method.
One of the methods for software tampering is the code obfuscation. Complex method used to secure the intermediate and native code. As defined by Gregory “Let TR be translating process, such that P → B translates source program P into a binary program B. TR is a one-way translation, when time required for reconstruction of program P from program B is greater from a specific constant T.” (Wroblewski ,2002).
From this definition we can retain the most important information, which is the one-way transformation, obfuscated code can’t be reversed to the original source code neither the intermediate code. This method breaks most of the reverse engineering methods and ensures that the software is kept safe and won’t be altered. Here is a simple example of code obfuscation, we can see the Intermediate code before and after obfuscation.
Figure 2: IL before and after obfuscation (Nagara & Collberg, 2009).
Finally, it is worth saying that we should not only build secure software but also think about how to secure our software and avoid any tampering or un-authorised modifications. This should be considered seriously especially in encryption and security software (firewall, key encryption, antiviruses …etc.) (Rannenberg, 2010).
References
– Gregory Wroblewski (2002). General Method of Program Code Obfuscation. Wroclaw, available at: http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.19.9052&rep=rep1&type=pdf
– Jasvir Nagra, Christian Collberg (2009). Surreptitious Software: Obfuscation, Watermarking, and Tamperproofing for Software Protection. Pearson Education, 2009. ISBN: 0132702037
– Kai Rannenberg, Vijay Varadharajan, Christian Weber (2010). Security and Privacy – Silver Linings in the Cloud: 25th IFIP TC 11 International Information Security Conference, SEC 2010, Held as Part of WCC 2010, Brisbane, Australia, September 20-23, 2010, Proceedings. Springer, ISBN: 3642152562
