Click here to Skip to main content
15,891,184 members
Home / Discussions / .NET (Core and Framework)
   

.NET (Core and Framework)

 
GeneralRe: display control Pin
mahesh s charan19-Oct-12 22:38
mahesh s charan19-Oct-12 22:38 
GeneralRe: display control Pin
Eddy Vluggen19-Oct-12 22:44
professionalEddy Vluggen19-Oct-12 22:44 
Question"There was no endpoint listening at http" Pin
loweryk17-Oct-12 11:51
loweryk17-Oct-12 11:51 
Questionis it possible to make a setup wizard to include updates? Pin
neodeaths15-Oct-12 8:41
neodeaths15-Oct-12 8:41 
AnswerRe: is it possible to make a setup wizard to include updates? Pin
Eddy Vluggen16-Oct-12 2:46
professionalEddy Vluggen16-Oct-12 2:46 
QuestionDisappearing FormClosing/FormClosed event Pin
Bernhard Hiller14-Oct-12 22:39
Bernhard Hiller14-Oct-12 22:39 
AnswerRe: Disappearing FormClosing/FormClosed event Pin
Eddy Vluggen15-Oct-12 0:44
professionalEddy Vluggen15-Oct-12 0:44 
Question.Net Securing Connection String Clarification Pin
Member 838957110-Oct-12 10:39
Member 838957110-Oct-12 10:39 
Hello 
I have been programming for something like 3 years in VBA - Excel and trying to move to VB.Net, The reason I want to move to .Net is basically because of security issues (I really enjoy programming to help excel users) and because I believe for sure that using .Net framework is a more robust platform and I will be able to keep working with excel users and also start programming new things.
I need some clarification about .Net Framework security. I have been searching the web the last week reading and understanding how I can protect connection strings and realize (I think) that the best way is by encrypting the app.config connectionstring section. 
But now I am really frustrated because I made a very simple test and then I myself tried to hack my application and it was very, very simple to reveal the connection strings. 
The reason I am asking is because may be I am misunderstanding something and I want to clarify if it is really that simple to hack the connection strings? And obviously get advice if I am doing something wrong…? 
If I am right…, let me ask you if there is a way to really protect a connection string from being read in a windows application that will be in the user computer? 
I also think and to encrypt a simple .xml (Not an app.config) with the connection strings but this will be useless because in order my app can decrypt the .xml, the app needs to have the decryption sub inside the .exe or a .dll and with any decomplier a hacker can read the code and copy the decrypt sub to decrypt the .xml.
I have also read there are a lot of code ofuscators but they are expensive and at this point I only want to know if it possible to really protect a connection string.
Please HELP… I am getting mad trying to figure it out!!! 
Let me explain the test I did:
1.- Create a windows test app with 2 buttons and 1 app.config
App.config:
<?xml version='1.0' encoding='utf-8'?>
<configuration>
<connectionStrings>
  <add name ="sourcepath"  connectionString ="valid url path"/>
  <add name ="finalpath"  connectionString ="valid desktop path"/>
</connectionStrings>
</configuration>


Button 1:
Private Sub Button1_Click(sender As System.Object, e As System.EventArgs) Handles Button1.Click
  Try
      Dim path As String =ConfigurationManager.ConnectionStrings("sourcepath").ConnectionString
      Dim path1 As String = ConfigurationManager.ConnectionStrings("finalpath").ConnectionString
      ' Download file from web server to my desktop
      Dim fileReader As New WebClient()
      fileReader.DownloadFile(path, path1)
  Catch ex As Exception
      MsgBox(ex.Message)
  End Try
End Sub

Button 2: I just copy ToggleConfigEncryption sub from http://msdn.microsoft.com
Private Sub Button2_Click(sender As System.Object, e As System.EventArgs) Handles Button2.Click
        Call ToggleConfigEncryption("WindowsApplication4.exe"
End Sub

Sub ToggleConfigEncryption(ByVal exeConfigName As String)
        ' Takes the executable file name without the .config extension.
        Try
            ' Open the configuration file and retrieve 
            ' the connectionStrings section.
            Dim config As Configuration = ConfigurationManager. _
                OpenExeConfiguration(exeConfigName)

            Dim section As ConnectionStringsSection = DirectCast( _
                config.GetSection("connectionStrings"), ConnectionStringsSection)

            If section.SectionInformation.IsProtected Then
                ' Remove encryption.
                section.SectionInformation.UnprotectSection()
            Else
                ' Encrypt the section.
                section.SectionInformation.ProtectSection( _
                  "DataProtectionConfigurationProvider")
            End If

            ' Save the current configuration.
            config.Save()

        Catch ex As Exception
            MsgBox(ex.Message)
        End Try
End Sub

2.- Run app, press button 2 to encrypt app.config connectionstrings section, press button 1 to download file, open app.config with notepad and verify the section is encrypted. So far, so good!!!
Now to hack my own app did the following.
1.- Download JustDecomile a free .Net decoder from internet
2.- Open my app with Just Decompile and I was able to read from button 1:
Dim path As String =ConfigurationManager.ConnectionStrings("sourcepath").ConnectionString
Dim path1 As String = ConfigurationManager.ConnectionStrings("finalpath").ConnectionString

3.- create a new app with following code: (I just copy paste from Just Decompile to new app and add msgbox line)
Private Sub Button1_Click(sender As System.Object, e As System.EventArgs) Handles Button1.Click
  Dim path As String = ConfigurationManager.ConnectionStrings("sourcepath").ConnectionString
  Dim path1 As String = ConfigurationManager.ConnectionStrings("finalpath").ConnectionString
  MsgBox(path & " " & path1)
End Sub

4.- Compile the new application.
5.- Copy the new application to test app directory
6.- Rename the new application with same name as test app (Maybe not necessary)
7.- Run the new app and I got a message box with the connection strings in 100% readable text!!!

AnswerRe: .Net Securing Connection String Clarification Pin
Richard Andrew x6410-Oct-12 12:03
professionalRichard Andrew x6410-Oct-12 12:03 
GeneralRe: .Net Securing Connection String Clarification Pin
Member 838957110-Oct-12 14:29
Member 838957110-Oct-12 14:29 
GeneralRe: .Net Securing Connection String Clarification Pin
CafedeJamaica21-Nov-12 5:33
professionalCafedeJamaica21-Nov-12 5:33 
AnswerRe: .Net Securing Connection String Clarification Pin
jschell11-Oct-12 8:53
jschell11-Oct-12 8:53 
QuestionArray of Double - Shallow vs. Deep Cloning? Pin
M-Badger5-Oct-12 7:01
M-Badger5-Oct-12 7:01 
AnswerRe: Array of Double - Shallow vs. Deep Cloning? Pin
Eddy Vluggen5-Oct-12 12:25
professionalEddy Vluggen5-Oct-12 12:25 
GeneralRe: Array of Double - Shallow vs. Deep Cloning? Pin
M-Badger7-Oct-12 9:56
M-Badger7-Oct-12 9:56 
AnswerRe: Array of Double - Shallow vs. Deep Cloning? Pin
Eddy Vluggen8-Oct-12 0:39
professionalEddy Vluggen8-Oct-12 0:39 
GeneralRe: Array of Double - Shallow vs. Deep Cloning? Pin
M-Badger9-Oct-12 23:04
M-Badger9-Oct-12 23:04 
GeneralRe: Array of Double - Shallow vs. Deep Cloning? Pin
Eddy Vluggen10-Oct-12 1:22
professionalEddy Vluggen10-Oct-12 1:22 
GeneralOT Pin
M-Badger10-Oct-12 2:23
M-Badger10-Oct-12 2:23 
GeneralRe: OT Pin
Eddy Vluggen10-Oct-12 9:00
professionalEddy Vluggen10-Oct-12 9:00 
GeneralRe: Array of Double - Shallow vs. Deep Cloning? Pin
dojohansen10-Oct-12 5:36
dojohansen10-Oct-12 5:36 
GeneralRe: Array of Double - Shallow vs. Deep Cloning? Pin
Eddy Vluggen10-Oct-12 9:09
professionalEddy Vluggen10-Oct-12 9:09 
QuestionSMS forwarding through GSM modem Pin
Member 94607155-Oct-12 2:57
Member 94607155-Oct-12 2:57 
QuestionHow to force rendering to generate an ID? Pin
AtALossHere5-Oct-12 1:13
AtALossHere5-Oct-12 1:13 
AnswerRe: How to force rendering to generate an ID? Pin
Sandeep Mewara5-Oct-12 2:24
mveSandeep Mewara5-Oct-12 2:24 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.