3

I had an interesting conversation recently where I was told that Microsoft .NET is not secure since it is more easily reverse engineered than languages like C. Is there any validity in this? If I were to write a section of code which I did not want to have reverse engineered, would writing it in C provide that much additional security? I'm no expert on the subject so I'm interested in what the sage people of IS have to say.

  • It's common knowledge that interpreted languages are usually easier to reverse engineer or decompile. At the end of the day, any code can be reverse engineered though. – Alexander O'Mara Jun 6 '16 at 23:55
  • C# is much safer when it comes to memory corruption vulnerabilities and you don't need source code access to exploit those so one could argue that C# is much more secure. By his logic all open source projects would be horribly insecure because the code is public. In the end x vs y is an opinion based question and doesn't have a correct answer. – wireghoul Jun 7 '16 at 0:17
  • I just want to make one point to take with you. It is a bad thought process to think of a client side language as secure. Memory editors, hex editors, packet sniffers (for network apps), etc work just as good on C applications as their .Net counterparts. – Bacon Brad Jun 7 '16 at 2:29
  • Many languages (even when they're not part of Java or .net) can bea easily decompiled, blackboxed or otherwise reverse engineered – BlueWizard Jun 7 '16 at 9:14
  • So it sounds like no matter what language we use, it's not going to make much difference as to how long it takes a determined attacker to figure out our secret "formula". That was my feeling as well. People are much too clever to be stumped by a binary file. – Fratink Jun 7 '16 at 15:19
4

Are you looking to protect the code because of an intellectual property requirement the person/company you are writing the code for has? Then I guess writing it in C could make it a bit more challenging to decompile, but someone with the required motivation and skills would go around that by reverse engineering it using many of the available tools; maybe a dissembler like IDA: Wikipedia - Interactive Disassemler

On the other hand, if you are looking to hide the logic of your application in order to make it difficult to find vulnerabilities, you are going down the path of "security by obscurity", which is quite worthless from an application security perspective. As wireghoul said, this logic would imply that all closed source applications would be secure and open source software would be a disaster. In fact, both have the same families of vulnerabilities and flaws that are exploitable.

I would instead invite you to invest some time looking at Secure Coding Practice Guidlines and Core Security Concepts. A quick lookup on Google about those topics will guide you and there is also plenty of good literature on this subject.

  • I suppose security by obscurity is what they were suggesting, which I also find worrying. We're attempting to make something as secure as possible and hoping that someone won't disassemble the code is probably a bit naive. I'll look up those topics, thank you! – Fratink Jun 7 '16 at 15:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.