Prevent request forgery attack

Question

I don't know if I used the term correctly but basically this is the scenario:

I am working at an application witch on every computer install must make a request to a server notifying the server that the app installed properly.The system I use currently has a checksum value that is calculated on client side and on server side that will validate an install.The problem is someone can forge the request decompiling the application and calculate the checksum using the same algorithm I use for calculating it.

So besides using a RSA encryption is there a way I can protect my application from such an attack?

Answer 1

The technique of "keep the application away from the user" is basically obscurity, and should be added only as a layer and not as a true security measure.

One way of handling this would be to add an additional component that requires validation with the server, such as a license token, or a name, that is produced by some sort of legitimate process like a web sign up, that is then part of the activation process.

This can still be gamed, but it's much easier to detect on the server side when both components are in place. Additionally, you can insert a validation check on the server side based on a number of variables captured during activation, e.g.: source IP address, operating system, etc. So if you saw 10,000 activations spring up out of an unexpected country all of a sudden, or some other pattern, you could then disable future activations from that location.

Answer 2

This is another variant on the classic trusting-the-client problem. You have to give the client machine enough information to generate the signature, at which point if the attacker has access to that machine you lose. RSA won't help you there.

To make it work you would need to ensure that the operators of the target machines don't have access to the application. ie: they aren't administrators, the application gets installed by another user such Local System, and the shared key (or public key for RSA) is not left lying around somewhere they can see it when the application is ready for use.

Answer 3

The only way to ensure that only your unmodified code runs on the client side is to enlist the cooperation of tamper-resistant, incorruptible hardware -- e.g. a TPM. To a large extent, that's the security model of gaming consoles like the PS3 (the special hardware then being integrated in the Cell Broadband CPU). When Sony does not goof up, this works reasonably well (i.e. Sony still makes a lot of money out of it; software piracy and modified applications remain at a low financial impact).

You cannot count on the existence of such hardware in PC or smartphones today. No amount of RSA may replace it.