Security and C# - how secure are C# applications (w.r.t IP) ?

[Susan Baker]

We are currently developing a commercial application which we are
writing mostly in C# (at least the front end).

The apparent ease at which code is reverse engineered gives me sleepless
nights (I come from a C/C++ background). It appears that signing
assembles and using role based security policies etc have limited
benefits if an end user can easily reverse engineer the binaries and
"side step" any implemented security policies.

I may be over emphasising the problem - but I'd like to know what
measures commercial vendors out there (that use C#), are employing to
ensure that their IP stays as safe as possible?

MTIA

[Jesse McGrew]

Reverse engineering only poses a threat to security if your security is
implemented on the client side. That's obviously a bad idea.

Even if you stick with C/C++, you'll only make reverse engineering
slightly harder, not impossible. Anyone with enough motivation will be
able to crack it anyway - just look at how the copy protection in video
games is cracked within hours of release. The real solution is to
implement your security measures on the server, where attackers won't
be able to read or alter the code.

Jesse

[Marc Gravell]

With regards to reverse engineering, have you looked at dotfuscator or other
obfuscation tools?

Marc
"Susan Baker" <sb****@no.spam.net> wrote in message
news:dn**********@nwrdmz01.dmz.ncs.ea.ibs-infra.bt.com...

We are currently developing a commercial application which we are writing
mostly in C# (at least the front end).

The apparent ease at which code is reverse engineered gives me sleepless
nights (I come from a C/C++ background). It appears that signing assembles
and using role based security policies etc have limited benefits if an end
user can easily reverse engineer the binaries and "side step" any
implemented security policies.

I may be over emphasising the problem - but I'd like to know what measures
commercial vendors out there (that use C#), are employing to ensure that
their IP stays as safe as possible?

MTIA

[Henry Padilla]

"Susan Baker" <sb****@no.spam.net> wrote in message
news:dn**********@nwrdmz01.dmz.ncs.ea.ibs-infra.bt.com...

We are currently developing a commercial application which we are writing
mostly in C# (at least the front end).

The apparent ease at which code is reverse engineered gives me sleepless
nights (I come from a C/C++ background). It appears that signing assembles
and using role based security policies etc have limited benefits if an end
user can easily reverse engineer the binaries and "side step" any
implemented security policies.

I may be over emphasising the problem - but I'd like to know what measures
commercial vendors out there (that use C#), are employing to ensure that
their IP stays as safe as possible?

MTIA

A couple of great obfuscators I've seen are CodeVeil and XenoCode Protector.

See if that helps you. But, as one person already mentioned, resign
yourself now to some amount of hackery. Even if just to prove they can do
it.

Tom P.

[Ivan]

With regards to reverse engineering, has anyone heard about a tool to reverse-engineer from C#
source code to UML?

Ivan

Marc Gravell wrote:

With regards to reverse engineering, have you looked at dotfuscator or other
obfuscation tools?

Marc
"Susan Baker" <sb****@no.spam.net> wrote in message
news:dn**********@nwrdmz01.dmz.ncs.ea.ibs-infra.bt.com...

We are currently developing a commercial application which we are writing
mostly in C# (at least the front end).

The apparent ease at which code is reverse engineered gives me sleepless
nights (I come from a C/C++ background). It appears that signing assembles
and using role based security policies etc have limited benefits if an end
user can easily reverse engineer the binaries and "side step" any
implemented security policies.

I may be over emphasising the problem - but I'd like to know what measures
commercial vendors out there (that use C#), are employing to ensure that
their IP stays as safe as possible?

MTIA

[Jesse McGrew]

Well, there's the class diagram tool built into Visual Studio 2005.

Jesse

Ivan wrote:

With regards to reverse engineering, has anyone heard about a tool to reverse-engineer from C#
source code to UML?

Ivan

Marc Gravell wrote:

With regards to reverse engineering, have you looked at dotfuscator or other
obfuscation tools?

Marc
"Susan Baker" <sb****@no.spam.net> wrote in message
news:dn**********@nwrdmz01.dmz.ncs.ea.ibs-infra.bt.com...

We are currently developing a commercial application which we are writing
mostly in C# (at least the front end).

The apparent ease at which code is reverse engineered gives me sleepless
nights (I come from a C/C++ background). It appears that signing assembles
and using role based security policies etc have limited benefits if an end
user can easily reverse engineer the binaries and "side step" any
implemented security policies.

I may be over emphasising the problem - but I'd like to know what measures
commercial vendors out there (that use C#), are employing to ensure that
their IP stays as safe as possible?

MTIA