0

i was wondering - consider i have 2 machines - client and server. the Client is opened to the internet, and sends very sensitive data to the server.

If fake data will be sent to the server and is not identified - this will lead to a catastrophic situation.

Client certificate / authentication will not be helpful, as this is an automatic process and a compromised client certificate/credentials will be easily grabbed.

I've read the following post: Authentication and removing the ability to replay information from a compromised machine and the answer suggested to use a "secret" that will be hard to replay from a compromised machine.

So, following this information, i can think of hiding some "secret" info from time to time (when generating the "real" data) and let the server check it - if it's ommited, the machine was compromised.

I was wondering if there are any other recommended methods in denying compromised machine data?

thanks :)

  • I don't understand, what scenario are you defending against? – André Borie Feb 16 '17 at 17:33
  • 1
    Ever thought of the server fetching the information from the client? In addition to fetching the information the server could implement means of verifying the clients integrity. Since these checks are implemented on the server, it is harder to cricumvent these on the client. – cornelinux Feb 16 '17 at 23:35
  • @cornelinux how will exactly this will help? the (client) machine is compromised - so server can verify whatever he wants, the fake client will responds correctly. but as i see, there's no actual way to achieve this (identify that someone compromised the sender application) - only to make it harder for the attacker – ArielB Feb 19 '17 at 13:28
  • Security is only about making it harder. – cornelinux Feb 20 '17 at 23:07
  • @cornelinux true, though there are aspects that can be trusted much more, but i can agree with you. anyway, i'll go for the "make it harder" zone. – ArielB Feb 21 '17 at 8:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.