Tag Info

You may need to use a File Integrity Monitoring tool to look at the directories the software may affect. The FIM will monitor for creation, modification and deletion of folders/files in those locations and provide a report. However, it may tell you that changes have been made but not what are the specific changes. You could run 2 separate systems; one ...

I'd suggest that you could use Process Monitor from the sysinternals suite to do this.

Any secret key that you embed in a program can be recovered by a person who has full access to that program, the best you can do is make it time consuming to do so. But let's say you could make the secret totally unrecoverable by analysing the binary. The user could perform dynamic analysis by running the program while monitoring it's memory and wait ...

You state that the following doesn't apply because desktop applications need to work offline: Using a remote database server and an n-tier architecture where the program doesn't directly access the database but authenticates with another layer which grants each operation and forwards it to the database layer. Everything is encrypted through SSL and ...

You can't. It's a chicken or egg problem. Have the user of the application enter the password every time the database is used.

This clearly is being written to promote a reasonably tested application. I have three comments about this: First and foremost, they should have their own internal scanning program (vulnerability assessment) that they would provide a test bed to run your program on as part of their acceptance testing. A software vendor may choose to have and develop their ...

Web application scanners are hardly be the be all end all of web application security and simply running an off the shelf tool will not solve the the problem of an insecure application. That being said, the security impact of a desktop application is highly dependent on what your application does. Is it a server? Does it communicate over a network? Does ...