A application use the debug as boolean to prefill login, password for authentication.

The code is something like that :

if (ContantsFile.CUSTOM_DEBUG_FLAG) //static final
//disable access control ==> admin mode (admin section are now visible for anybody)

The application is coded in JAVA. And the constants.class is a different one delivered in production.

I have the feeling (excuse me I am still a newbie in the field) that this pattern is a security flaw for the following reason : - if an attacker could change the constants.class in production, the whole application will be vulnerable

It is obviously a bad pratice for a DEV point of view (I am a developer).

Do you have better explanation or arguments? Those developers will respond me that if an attacker have access to his file, he is already inside the application and could change anything.

Thank you in advance



In the code you posted, the username and password could be easily extracted from the compiled binary.

If you're going to do it this way, use a preprocessor directive like #if DEBUG so that the code is not even compiled in a release build.

This still leaves your other environments vulnerable, so I wouldn't hard-code the username and password at all and instead use a password manager to auto-fill it. Additionally, a development username and password probably shouldn't be valid in a production system.

| improve this answer | |
  • I have update the question since it is not about an insecure storage of credentials but some possible privilege escalation . Could you bring me your light about that ? – Omar Elfada Dec 28 '11 at 16:18
  • 1
    "if an attacker could change the constants.class in production, the whole application will be vulnerable". If an attacker has full physical or remote access to the machine in a way that allows them to modify the running application code, it's likely game over anyway, and this constants class is really the least of your concerns. – pdubs Dec 28 '11 at 16:37
  • Ok thank you pdubs I will marry you ;) (but you are a man so no ;) ) – Omar Elfada Dec 28 '11 at 16:50

The programming language used in this code may matter.

If this uses Java and the CONSTANTS.debug field is declared with static final, then the Java compiler (which turned the .java files into .class files) actually propagated the boolean constant in the code and optimized the code section away; the part with the prefilled login and password is gone, and cannot be resurrected by the attacker. You can check it by searching the login name in the .class files (open the .jar -- that's just a Zip archive under another name -- and launch a simple grep on the .class files: in Java, the literal strings and up UTF-8 encoded in the .class files, so grep will locate them).

With other languages, your mileage may vary. Any decent C compiler should propagate constants (at least those defined as macros) and optimize out dead code (i.e. code which, after macro replacement, looks like if (0) { ... }).

The developers are right in the following sense: if attackers can modify the application code at will, then you already have bigger problems.

Note, though, that having hardcoded login and password in the source code means that an attacker gaining read-only access to that source code could learn them. So you have to worry about the physical security of your backups. As @pdubs points out, login+password pairs used for development should not be valid in the deployed system (which would void that issue).

| improve this answer | |
  • Im not saying that they have harcoded the password but they can bypass restriction normally for admin only. Thank you ;) – Omar Elfada Dec 28 '11 at 16:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.