0

for Authentication of my Executeable i use a TCP Server Module running on a VPS my Client(Executeable) connects to. Therefor i have to have the IP of the VPS inside the Executeable. I have two major problems with this: 1. If someone somehow gets hold of the source or disassembles the Executeable(i do have obfuscation, but if he somehow manages to) he would have the IP. 2. If the Server goes down (maybe due to being DDOSed after someone obtained the IP inside the Executeable), how should the program know to which server it should connect, without me pushing an updated version of the Executeable.

To solve this i thought about having another server which distributes the IPs, but then there would be an IP/Address in the Executeable again and they could just put down the distributing server and we are back at Problem #2. I don't know if you guys get what i mean, but i would love some advise or ways i could atleast make this more efficient.

1

Instead of using a static IP address in the executable why not use a domain. This way in the case of needing to change the IP address you can just change the IP address that your domain name points to.

This will prevent you from needing to patch the executable in the case the IP address needs to change. Of course it is still possible for an attacker to DDoS the new IP so you'll still need some way to mitigate the effects of an attack like this.

  • as anon suggested why not using services like no-ip (noip[.]com) for example ? – Soufiane Tahiri May 12 '17 at 14:19
  • that's actually quite simple and probably what i'm looking for, thanks! – ZZ_James May 12 '17 at 16:24
1

You should not try to authenticate an executable. The best you can do is the have a secret in the executable itself and rely on obfuscation to hide it. And it is well known that obfuscation is not security. That is a hopeless fight...

You should instead authenticate users, and expect them to correctly use your application. And anyway never trust too much what comes from the outside... But here, you could distribute usernames and let the users choose their password, or if you really need strong authentication use a 2 Factor Authentication with certificate on smartcards for example, or with random unique token sent as SMS.

  • That's not really what i wanted, but you got me curious. Maybe i should explain what i'm doing a bit more. The Authentication is not based on an user entering crednetials. The executable will run on a xbox and use an unique key (assign by microsoft to the console) and check if the executeable runs on a verified console. The executeable is written in c++ and an attacker can only access the code by reversing it using PPC. Combined with obfuscation and checks if the file is tampered/the key is spoofed... i think everything that happens in the executeable is pretty safe (besides strings and ips) – ZZ_James May 12 '17 at 16:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.