How can I protect sensitive information inside a binary?

Question

I am currently developing an application with Qt/C++ which needs to access a Shopify store using the Admin API. In order to access the API, my application needs to know the following information:

• API Token
• Shared Secret
• API Password

These values are stored as strings in a header using a simple #define, for example:

#ifndef STORE_INFO_H
#define STORE_INFO_H

#define ADMIN_API_TOKEN         "..."
#define ADMIN_API_PASSWORD      "..."
#define ADMIN_API_SHARED_SECRET "..."

// Sha la la la

#endif

Afterwards, these values are used across the application as needed. However, there's one big issue with this approach: if someone is smart enough to open the binary application inside a HEX editor or a decompiler, he or she may be able to see this information (which, if used with malicious purposes, could do a lot of damage).

Irrelevant of the needs of my application or which API I am using, is there are way to "hide" or protect sensitive information constants in a C/C++ application?

Answer 1

There's no foolproof way to do that. If the executable is in the hands of the potential attacker, they can ultimately get that information out of it.

---

The more usual way to do this is:

• Host a server yourself.
• Keep that sensitive information as configuration parameters to your server.
• Have your server provide an API which is as limited as possible, and when this is called, delegates the relevant operations to the Shopify API.
• Require users to authenticate themselves to your server to ensure only authorised callers can use it. Those user credentials would be supplied by the user to the client application.

Answer 2

There are a couple things to consider with API access:

• Tokens can and do change
• If there is a security breach the shared secret also must change

Compiling that information into your binary exposes that information in a couple places:

• It's in your version control
• It's in your binary

If an attacker can access your version control, it's a lot easier to get that information than sniffing your binary. Even if you encrypt your information using a calculated symmetric key (i.e. same key to encrypt and decrypt) you will run into problems the information is there to crack.

It is best to keep that kind of information outside of your binary. The following are easy ways to read that information at runtime:

• Read Environment variables
• Read a file
• Pass them in as parameters.

Each of those keeps the secrets out of the code, version control, and allows them to change without recompiling your code.