Debug mode for an application but removed in production

Question

A application use the debug as boolean to prefill login, password for authentication.

The code is something like that :

if (ContantsFile.CUSTOM_DEBUG_FLAG) //static final
{
//disable access control ==> admin mode (admin section are now visible for anybody)
}

The application is coded in JAVA. And the constants.class is a different one delivered in production.

I have the feeling (excuse me I am still a newbie in the field) that this pattern is a security flaw for the following reason : - if an attacker could change the constants.class in production, the whole application will be vulnerable

It is obviously a bad pratice for a DEV point of view (I am a developer).

Do you have better explanation or arguments? Those developers will respond me that if an attacker have access to his file, he is already inside the application and could change anything.

Thank you in advance

Frenchy

Answer 1

In the code you posted, the username and password could be easily extracted from the compiled binary.

If you're going to do it this way, use a preprocessor directive like #if DEBUG so that the code is not even compiled in a release build.

This still leaves your other environments vulnerable, so I wouldn't hard-code the username and password at all and instead use a password manager to auto-fill it. Additionally, a development username and password probably shouldn't be valid in a production system.

Answer 2

The programming language used in this code may matter.

If this uses Java and the CONSTANTS.debug field is declared with static final, then the Java compiler (which turned the .java files into .class files) actually propagated the boolean constant in the code and optimized the code section away; the part with the prefilled login and password is gone, and cannot be resurrected by the attacker. You can check it by searching the login name in the .class files (open the .jar -- that's just a Zip archive under another name -- and launch a simple grep on the .class files: in Java, the literal strings and up UTF-8 encoded in the .class files, so grep will locate them).

With other languages, your mileage may vary. Any decent C compiler should propagate constants (at least those defined as macros) and optimize out dead code (i.e. code which, after macro replacement, looks like if (0) { ... }).

The developers are right in the following sense: if attackers can modify the application code at will, then you already have bigger problems.

Note, though, that having hardcoded login and password in the source code means that an attacker gaining read-only access to that source code could learn them. So you have to worry about the physical security of your backups. As @pdubs points out, login+password pairs used for development should not be valid in the deployed system (which would void that issue).