0

Recently, We developed an application that we want it's users to pay for a monthly subscription in order to use it. So the first thing that came to our minds how to implement a secure way for our application to check for the User validity and those ideas came up

  1. Using WebClient to enter to our website and log in using the user provided credentials : However, this might be vulnerable to MITM attack.
  2. Using the first approach but using SSL certificate (to make sure that we are connecting to our server and not the attackers') : However, Fiddler can easily do a MITM attack and de-crypt the SSL communication, which will result in the same vulnerability as the first approach.

Due to the internet's lack of documentation of what we need, we had to ask here for someone to explain how could we make sure that:

  1. Our application only connects to our server and not any fake hosted server (by the attacker).
  2. The communication is secure. Not altered or edited some how in order to grant unfair access to our application. (by sending a fake response to the app or editing the original response before the application receives it (replay attack)).
  • Fiddler shouldn't be able to MitM the connection unless you overrode the default .NET SSL certificate validation. If you did, then you threw away 90% of SSLs security anyway. – Polynomial Mar 17 '14 at 17:44
  • @Polynomial: So i want to know please if i just created a website and used COMODO's SSL or any other Authorized SSL Certificate and then used a normal WebClient from my .NET Application to connect to the website, login and check the user subscription then depending on it it grants access to the user. WILL THAT BE SECURE AND I CAN MAKE SURE THAT THE COMMUNICATION WILL NOT BE ALTERED OR EDITED NOR IT WILL BE VULNERABLE TO SOMETHING LIKE REPLAY ATTACKS sorry for caps just to highlight – Danny Rob Mar 17 '14 at 18:42
  • @Polynomial because i am planning to get VBulletin license and handle everything from there using it's Subscription Manager – Danny Rob Mar 17 '14 at 18:43
0

You can't prevent a sophisticated user from cracking the application. The only thing you can do is make your security measures hard to circumvent. From what I understand your application provides all functions unless your server says "don't". You have several ways to achieve this

Plaintext: Easy to circumvent. Edit the hosts-file, write a pseudo-server, done.

Encrypted transport: Slightly harder to circumvent. Add a Root-CA certificate, write a pseudo-server, done.

Encrypted message: The application generates an encrypted request, the server answers with an encrypted response. Hard to circumvent on network level. You would have to extract the key from the application (which can be obfuscated in the code). You should use nonces here to prevent replay attacks.

Always possible: Find the instruction that says yes/no inside the application, patch it to always say yes, done :-)

  • Seems legit however, by Add Root CA you mean the Fiddler way of MITM ?, i heard that this can be easily prevented by making my application only accept the certificate based on it's public key (which will be my cert public key here). So can i relay on that as i don't want to get into the bad Socket programming thingy and what comes after it (windows vps bla bla bla). – Danny Rob Mar 17 '14 at 19:01
  • So if i override the acceptance of the certificate to only accept my cert can i safely use option number 2 ?. And yeah i know that it is always possible once the attacker got his hands on the code. Which i am planning to avoid as much as possible by using good Packers like Themida. Given that info can i safely go on ? – Danny Rob Mar 17 '14 at 19:03
  • Yes you can. Accepting only a specific server certificate is a good way of assuring trust. A drawback is that you can't change the certificate without updating the software. – fr00tyl00p Mar 17 '14 at 19:16
  • It is going to be updatable software anyway so that is not a problem. And sorry to ask this again but there is no vulnerability of doing this :D, as i don't understand anything about that and i will take your words as a go on word. What i will do is 1- Create a forum using VBulletin to handle the monthly subscriptions for me. 2- Secure the site using SSL Certificate which i already bought. 3- Connect to the forum and login from my Application and make the WebClient only accept my Certificate. 4- Do any checks i want as i am sure that my connection is secure and replay attacks can't be done. – Danny Rob Mar 17 '14 at 19:19
  • Is that okay ?. Again so sorry to keep insisting on having a 1 final answer to go. – Danny Rob Mar 17 '14 at 19:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.