Bypassing object interface (security)

[Rene]

I am currently developing a Widows application that uses remoting to pass
objects back and forth from the server to the client computer and
vice-versa. When an object is instantiated and loaded on the server, the
object is loaded with important read-only information that I obviously don't
want the user to change because when the object is passed back on the
server, I use that read-only information to take different actions in how to
save the object's data back into the database.

My question is as follows: Once the object is moved to the client computer,
is it easy for a hacker to use some utility that is capable of locating
where the object is in memory and then use a utility to modify the data in
the object (my read only property values)?

Thanks

[Scott Allen]

"Easy" a relative term, but there are a plethora of memory tools and
debuggers that can inspect the memory of a process. You can't assume
anything is safe on a remote computer.

You could, however, detect if the client tampered with the data with a
cryptographic hash. The following article has some details and
examples:
http://msdn.microsoft.com/msdnmag/is...s/default.aspx

--
Scott
http://www.OdeToCode.com/blogs/scott/
On Wed, 10 Nov 2004 23:24:10 -0600, "Rene" <no****@nospam. nospam>
wrote:

I am currently developing a Widows application that uses remoting to pass
objects back and forth from the server to the client computer and
vice-versa. When an object is instantiated and loaded on the server, the
object is loaded with important read-only information that I obviously don't
want the user to change because when the object is passed back on the
server, I use that read-only information to take different actions in how to
save the object's data back into the database.

My question is as follows: Once the object is moved to the client computer,
is it easy for a hacker to use some utility that is capable of locating
where the object is in memory and then use a utility to modify the data in
the object (my read only property values)?

Thanks

[Rene]

Can data be overridden directly in memory even for objects such as the
System.Threadin g.Thread.Curren tPrincipal object?

"Scott Allen" <bitmask@[nospam].fred.net> wrote in message
news:gd******** *************** *********@4ax.c om...

"Easy" a relative term, but there are a plethora of memory tools and
debuggers that can inspect the memory of a process. You can't assume
anything is safe on a remote computer.

You could, however, detect if the client tampered with the data with a
cryptographic hash. The following article has some details and
examples:
http://msdn.microsoft.com/msdnmag/is...s/default.aspx

--
Scott
http://www.OdeToCode.com/blogs/scott/
On Wed, 10 Nov 2004 23:24:10 -0600, "Rene" <no****@nospam. nospam>
wrote:

I am currently developing a Widows application that uses remoting to pass
objects back and forth from the server to the client computer and
vice-versa. When an object is instantiated and loaded on the server, the
object is loaded with important read-only information that I obviously
don't
want the user to change because when the object is passed back on the
server, I use that read-only information to take different actions in how
to
save the object's data back into the database.

My question is as follows: Once the object is moved to the client
computer,
is it easy for a hacker to use some utility that is capable of locating
where the object is in memory and then use a utility to modify the data in
the object (my read only property values)?

Thanks

[Scott Allen]

Well, it would be easy to overwrite the property with managed code.

--
Scott
http://www.OdeToCode.com/blogs/scott/

On Thu, 11 Nov 2004 02:59:13 -0600, "Rene" <no****@nospam. nospam>
wrote:

Can data be overridden directly in memory even for objects such as the
System.Threadi ng.Thread.Curre ntPrincipal object?