As a software developer, should my crash dumps (e.g. from Breakpad, Windows) be encrypted and signed? I provide the ability to export crash dumps so that I can pinpoint the problem when the user reports one.
My concerns, in terms of protecting my product (the attacker is a user hacking the product to gain something):
- Dumps give too much info for hackers to reverse engineer or hack the software, say to enable features or licenses?
- Passwords and keys might be stored in the dumps for hackers to hack the software.
- A user could return us a maliciously malformed dump, which causes havoc when we try to decipher the dump on our machines. If our application signs the dump, at least we can confidently open the file.
Update: For the last bullet point, one of the answers has reminded me that there is no pointing in signing the data, since the key has to be in the product itself, which the hacker can then use it to sign anyway. Furthermore, the fear of malicious dumps can be circumvented through the use of temporary virtual machines.
The last remaining concern is how dumps, given it contains addresses and stuff, could help hackers circumvent restrictions like licensed features.