1

I have a C# program (could be any programming language) that saves data to a file on a memory (hard disk, USB drive, etc.). The program uses this data for monitoring its operation time, but it could be any purpose.
When the program is started, it reads the data from the file so it knows how long it has been operating before. It updates the data in the file every minute, so there is a failure of maximum 1 minute if the program is not shut down properly.

My problem is a quite general question: How can I prevent the user from manipulating the file?

I want to avoid that someone edits the operation time while the program is not running, or at least I want to be able to detect manipulation.

  • I though of a checksum first, but I also need to prevent that from manipulation.
  • The user can replace the current files by backups every time, thus the files themselves are not save if he knows where to look.
  • Therefore I need to store data at a location that is not easily editable. On a windows system, this could be the registry. Alternatively I could create a hidden system file in a special directory. However, I think the only chance is to hide the file or any information about the data from the user.
  • The user could replace the whole operating system including all data by an image. Therefore also a hidden location is not safe, but a) I cannot avoid this risk, and b) the user would need special equipment and knowledge, so the system is safe to most users.

Any other ideas how to secure data on a typical computer?

  • 7
    Ultimately, you can't. Even if you encrypt the data, a determined user can decompile your program to get the encryption key and algorithm. The computer belongs to them, not to you, and what you're trying to do sounds shady anyway, so my advice is to forget this idea and find something else more productive to do with your time. If this is a corporate machine and the use case is legitimate, talk to IT and figure out a way to do it with security policies. Make sure you provide adequate disclosure to the users. – Robert Harvey Jul 31 '15 at 22:34
  • Decompilation is possible, but even more unlikely than replacing the current system by an image. I am not trying to lock out hackers... I know I can't. I am trying to lock out standard and experienced users. I just had the idea to use different user accounts and hard-code the credentials into my program. Not perfect, but good enough. BTW: the users are our customers. We just want to prevent them from running our machines for weeks and telling us that they're still evaluating... Basic security is sufficient here. – Tobias Knauss Jul 31 '15 at 22:44
  • 2
    Good enough doesn't include resistance to hard drive reformats. If I want everything off my machine, I do mean everything, including any rogue traces or remnants of your program. Just sayin'. I've been through too many incidents of people thinking they can do whatever they want with my machine to have any tolerance at all over these kinds of shenanigans. Your users are unlikely to go through the pain of enduring a hard drive reformat just so they can continue to use your program for free. – Robert Harvey Jul 31 '15 at 22:46
  • You didn't get me. If the user formats the disk of the computer (which is ours as long as he hasn't paid), he won't be able to run the machine. In this case I don't care about the program's operation time any more. I want to avoid manipulation. I am not trying to protect against hackers. – Tobias Knauss Jul 31 '15 at 22:50
  • You are furnishing the computers? I guess I misunderstood. You said in your question that you wanted program information to persist after a reformat, and you didn't suggest that you were providing the hardware. If it's hardware protection on your own machines that you're after, there are technologies like built-in circuit cards and dongles that are quite effective. Just put some of the software into firmware, in other words. – Robert Harvey Jul 31 '15 at 22:51
1

I would suggest the following implementation.

If the program is initially started create an encrypted and authenticated file containing either a timestamp or counter to have a starting value. It is important not to use the basic user displayed and changeable time/clock, because otherwise your customer could just set the system time into the past. When you run the program start a timer or increment the counter to measure the usage and update the encrypted an authenticated file periodically.

The location where the file is stored is unimportant, but you need to use the following things to accomplish reasonable security:

  • Use existing cryptographic functions, which are well tested and provide both encryption and authentication. To put it simple, encryption protects you from somebody trying to figure out the content, authentication from manipulation

  • Generate a random key for the encryption, no hard coding. Everything that is hard coded can be found through reverse engineering with more or less effort. Also reusing keys is always a bad idea

  • Store the key some place save where it can be automatically accessed by your program. This is the tricky part, as you have to trust the OS to properly handle it, as things need to be working without you entering things manually. My suggestion would be using DPAPI (assuming you develop for C# .NET on Windows). You can easily store your key, and could as well be changing your key once in a while without big hassle.

So if the user either deletes, exchanges the file with an old version or manipulates the file, you are able to recognize it.

I hope this give some ideas how you could do it.

Edit

I was not correct regarding the replay attack, if the user is able to access both files then indeed he would be able to replace both with old versions.

My suggestion regarding your comment would be the following:
Have a file that contains a timestamp, the counter for usage, shutdown flag.

You will need a windows service running on start-up. Set a registry entry on the very first start-up.

The service checks for if the file is existent and if it is the very first time the service runs. If there is registry entry says that it runs for the first time, create the file containing the current timestamp (non-dependend on system clock, if possible), the counter for usage should be zero and shutdown flag false. The file is encrypted and the key encrypted through the DPAPI (use a fixed additional entropy). The registry entry is updated as from now on, all consecutive writes will be updates.

Now the service needs to update the file in a fixed interval, e.g. every 10 minutes. This means unprotecting the key with DPAPI and decrypting the file. Here is where we protect against replay attacks. The timestamp in the file is check and may not deviate more than e.g. 30 minutes (should be more than the update interval in case of failed update). If it does deviate more, manipulation is suspected (or heavy error from the application or hardware or OS). Otherwise, if everything is fine, the timestamp gets updated to the current time. If your service/program was used in the meantime, the usage counter gets updated as well. Generate a new key, encrypt the file and store the key after protecting it with the DPAPI.

When the user shutsdown the computer and starts it later on, you would have the problem, that the timestamp exceeds the allowed limit. That is why the file should contain the shutdown flag. This flag should be set when the user shutsdown the computers. When the service is stopped, it's final action is to update the file, with the shutdown flag set to true. On a start-up the file is read and if the shutdown flag is true, set it to false and update the timestamp again.

This is how I would do it. It isn't bullet proof but more than enough to protect against fraudulent customers. I wouldn't even go that far and simply use the DPAPI and file combination and store the output of DPAPI in the registry. No normal person is his right mind would spend his time searching the entire registry. After all they are your customers not prisoners. With physical access to the computer there is no way to absolutely secure it.

The Isolated Storage is not very useful either, I just have read about it the first time. The user and also other programs with administrator/system privileges will be able to read these files.

| improve this answer | |
  • Sounds nice. I will check out the details on monday. Thank you! – Tobias Knauss Aug 1 '15 at 14:04
  • After getting an overview over DPAPI (where I saw that it in general would fit my needs) I finally found time to start the implementation. But now I discovered that DPAPI only has encryption capabilities and it doesn't store data. Wikipedia (en.wikipedia.org/wiki/Data_Protection_API) states that many Windows components/programs use DPAPI, too, and these also store the secured data somewhere. But where? – Tobias Knauss Aug 26 '15 at 9:28
  • @Tobias Knauss Yes that is correct sorry if that wasn't clear. There is no restriction as to were you save the output of the Protect Call. You could put it on the registry or a plain text file. The important part is that you can decrypt the key with Unprotect without any User interaction. – John Aug 26 '15 at 14:18
  • DPAPI does a lot of the required work. However, I need to store the encrypted data securely so that it cannot be replaced by an old copy. I am going to use c# IsolatedStorage for this, because this storage cannot easily be edited by hand. Perhaps I find a more secure alternative in the future. – Tobias Knauss Aug 26 '15 at 15:14
  • In the way I described it, you will be able to spot manipulation to both the key (which will be protected by DPAPI) and the data. You could use Isolated Storage for the output of Protect from DPAPI. – John Aug 26 '15 at 15:18
0

"secure data on a typical computer". From your comments it's clear your victims are not using "typical computers" but are slaves to an irrational IT department which you're a part of.

The only way to do what you want is not to store the data on the computer at all, but to store it on another computer somewhere on the network that your users have no access to. Of course that requires that all their computers are networked to a LAN, but you're going to have that anyway as no doubt you've found out that network admins can remotely start, shut down, and reboot computers and forcibly load and remove software on them and are regularly pestering your victims with that just to annoy them as well as for legitimate reasons (yes, I've worked in companies with such IT departments more than I care to remember, I have experienced it from both sides, though I've never been one of those admins I've worked in the same departments they were part of).

| improve this answer | |
  • I was asking for suitable ways to secure data as good as possible. The data needs to be on the computer as it may or may not be connected to a network or the internet. I wouldn't call it an irrational IT department. We are monitoring the usage of out machines to avoid fraud by the customer (like "it has run only 10 hours, we're in warranty period" but it actually was 1000 and they're out). The computer IS a typical computer, but the software is made to control the machines, so you don't get it elsewhere. A hacker could overcome the restrictions though, but the customer won't risk a damage. – Tobias Knauss Aug 1 '15 at 8:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.