2

I installed CentOS 6 on a 3gb virtualbox disk. It hosts a web server which starts automatically when the OS boots. No user login required. When it boots, it is given an IP and the host machine can connect to the server.

The idea is to hand this to someone on a flash drive, let them install virtualbox on their computer and run the image to start the server.

The server software is written in an interpreted language and the source code also resides on the image. The problem is, we don't want someone to hack into the disk and get the source code that is plainly lying around.

Since we want the httpd to start at boot without giving anyone any passwords, we can't encrypt the disk. Disk encryption also leads to complications since httpd will have to start after encrypted volume is mounted etc.

Considering these constraints, what options do I have in order to protect the source code inside the virtual drive?

Improve this question
1
  • 5
    You can't! It's impossible. You're basically giving someone your server, you can't expect them not to have access to everything on it. You're effectively breaking physical security, after that.. there's nothing off-limits. Even if you encrypt the disk, you have to give your client the decryption key, or you have to put the decryption key somewhere on the server (the image).
    – Adi
    Commented May 3, 2013 at 10:40

2 Answers 2

Reset to default
4

Virtual machine, but real CPU. Regardless of how you elect to see it, the code for your server still runs on the machine of the supposed attacker. Similarly, disk encryption of any kind would not help either, even if you personally typed the password yourself upon boot: at some point, the data is still decrypted, on the attacker's machine.

Virtual machines don't offer any protection against that kind of inspection. VM protect the host operating system from the guest, not the other way round.

This is one of these situations where "go Cloud" is a good advice. Don't give a USB Flash drive; instead, host the code on a server somewhere. That way, you keep control of the whereabouts of the data and who reads it.

Improve this answer
2

If you give someone code to run on their own computer, there is always the possibility that they will do something with it that you didn't want or expect. If you've given them the source code, you've made that easier for them. If you absolutely must give people the actual code, and you don't want them to play with it, here are two possibilities gleaned from the real world of software sales:

  • Increase the risk. Make the end-user agree to some nonsense that forbids them to copy, reverse-engineer, or redistribute the code.

  • Increase the complexity. Obfuscate the code through compression, encryption, symbol stripping, spaghettification, and other nonsense.

In the end, if you give people code, they may do something you don't like with it. This is the nature of computers.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .