I'm working on a machine which needs to store usernames and passwords for the various operators, technicians, and engineers that may be using and configuring it. It is important that some functions be accessible only by engineers, some be accessible by technicians and engineers, and some be accessible by everyone. There must also be a way to add, remove, and change accounts. Finally, the data must be stored on the same physical computer as the application.
It's been suggested that we simply store the username, password, and privilege level in an INI file on the disk. This, obviously, is bad. I'd like to use a more secure system, with the goals that a low-privilege user:
- Cannot find a plain-text copy of anyone's password
- Cannot perform actions outside of their privilege scope
I believe that I have accomplished goal #1 by salting and hashing the password, storing the salt and hash on the disk, and authenticating against these values. I'm using the .NET framework, and the System.Security.Cryptography.Rfc2898DeriveBytes PBKDF2 hashing scheme for this purpose.
However, 2 is more difficult, because by storing the user accounts on the disk, the following attack is possible:
- Attacker makes a backup of the current application state
- Attacker resets the machine to the clean/initial state by deleting backed-up files
- Machine must now provide a mechanism to add user accounts, such offering an admin password which is displayed only on the first run
- Attacker gives themselves desired privileges and executes previously restricted action
- Attacker restores old machine state
I can't see a way around this attack. Is there anything I can do? How are fully-offline authentication systems, such as Windows or Linux user accounts, protected from this sort of attack?
I do realize that an attacker with this kind of access could modify or inspect the application itself and could add a physical or software keylogger, but that's not really something I can protect against, so I want to focus on making the authentication mechanism as secure as possible.