Py2Exe security

[Terje Johan Abrahamsen]

Hello.

We have created some programs in Python that are to be distributed
around. The programs will be made into .exe files by py2exe. However,
in the source there are certain webadresses, logins and passwords that
the programs use, that we would like to keep away from the end users.
They will use them thru the program, but we would like them not to be
extracted and used separately for other purposes.

Is the compiling by py2exe enough? I have opened all the files in the
directory py2exe has made, and have not found anything I could read in
clear text. However, that does not mean that others can not. Is it
possible to extract these passwords, adresses and logins from the
sourcecode? If py2exe is not enough, is there some other simple tools
we can use to hide the source from the endusers?

Thanks in advance.

[ech0]

someone can sniff the client for the information it sends/receives so
its possible to extract the info that way.

[Simon Brunning]

On 3 May 2005 05:03:00 -0700, Terje Johan Abrahamsen <te*****@gmail. com> wrote:

We have created some programs in Python that are to be distributed
around. The programs will be made into .exe files by py2exe. However,
in the source there are certain webadresses, logins and passwords that
the programs use, that we would like to keep away from the end users.
They will use them thru the program, but we would like them not to be
extracted and used separately for other purposes.

If your program can access these details, then a suficiently
determined attacker can access them too, regardless of what you do.

--
Cheers,
Simon B,
si***@brunningo nline.net,
http://www.brunningonline.net/simon/blog/

[Terje Johan Abrahamsen]

Simon Brunning wrote:

On 3 May 2005 05:03:00 -0700, Terje Johan Abrahamsen

<te*****@gmail. com> wrote:

We have created some programs in Python that are to be distributed
around. The programs will be made into .exe files by py2exe. However, in the source there are certain webadresses, logins and passwords that the programs use, that we would like to keep away from the end users. They will use them thru the program, but we would like them not to be extracted and used separately for other purposes.

If your program can access these details, then a suficiently
determined attacker can access them too, regardless of what you do.

Yes, I assume so. Luckily it is not national secrets we are trying to
hide. But, how does py2exe compare with for example a program written
in a compiled language like C++? Is it easier to find the info in a
py2exe .exe than a c++ compiled c++?

[Will McGugan]

Terje Johan Abrahamsen wrote:

If your program can access these details, then a suficiently
determined attacker can access them too, regardless of what you do.

Yes, I assume so. Luckily it is not national secrets we are trying to
hide. But, how does py2exe compare with for example a program written
in a compiled language like C++? Is it easier to find the info in a
py2exe .exe than a c++ compiled c++?

Its not the exe file you need to be concerned about, its the pyc files
that are created with it. I imagine the strings will be in plain text
form, just like compiled C++.

As others have pointed out, it would be impossible to prevent an
attacker from discovering information inside the app. The best you can
do is obfuscate the strings somehow and 'un-obfuscate' them when the app
runs. That way they at least wont be obvious. Take a look at my
signature for an example!

Will McGugan
--
http://www.willmcgugan.com
"".join( [ {'*':'@','^':'. '}.get(c,None) or chr(97+(ord(c)-84)%26) for c
in "jvyy*jvyyzptht na^pbz" ] )

[Harry George]

"Terje Johan Abrahamsen" <te*****@gmail. com> writes:

Hello.

We have created some programs in Python that are to be distributed
around. The programs will be made into .exe files by py2exe. However,
in the source there are certain webadresses, logins and passwords that
the programs use, that we would like to keep away from the end users.
They will use them thru the program, but we would like them not to be
extracted and used separately for other purposes.

Is the compiling by py2exe enough? I have opened all the files in the
directory py2exe has made, and have not found anything I could read in
clear text. However, that does not mean that others can not. Is it
possible to extract these passwords, adresses and logins from the
sourcecode? If py2exe is not enough, is there some other simple tools
we can use to hide the source from the endusers?

Thanks in advance.

Putting passwords in your program is a bad idea, with or without
Python and py2exe. Even if you wrote the program in obfuscated C, and
stripped comments etc, an attacker could use "strings" to search for
candidate passwords. Or just start at the beginning of the program
and use each byte as a candidate starting char.
Since you are working on MS Windows, consider getting:
M. Howard, D. LeBlanc, "Writing Secure Code", Microsoft Press, 2002.

--
ha************@ boeing.com
6-6M21 BCA CompArch Design Engineering
Phone: [phone]

[andreas]

On Tue, May 03, 2005 at 06:01:33AM -0700, Terje Johan Abrahamsen wrote:

Simon Brunning wrote:

On 3 May 2005 05:03:00 -0700, Terje Johan Abrahamsen

<te*****@gmail. com> wrote:

We have created some programs in Python that are to be distributed
around. The programs will be made into .exe files by py2exe. However, in the source there are certain webadresses, logins and passwords that the programs use, that we would like to keep away from the end users. They will use them thru the program, but we would like them not to be extracted and used separately for other purposes.

If your program can access these details, then a suficiently
determined attacker can access them too, regardless of what you do.

Yes, I assume so. Luckily it is not national secrets we are trying to
hide. But, how does py2exe compare with for example a program written
in a compiled language like C++? Is it easier to find the info in a
py2exe .exe than a c++ compiled c++?

About the same. C++ programs do have their string constants as cleartext
in the binary too.

Personally I'd be more concerned about the network side (use https and
verify the server certificate), and debugging tools that might be able
to intercept your traffic anyway.

Andreas

[mahasamatman]

I suggest You to use base 64 encoded strings
something like
password = 'aGlkZGVuX3Bhc3 N3b3Jk\n'
password = pasword.decode( "base64")

[Grant Edwards]

On 2005-05-03, mahasamatman <vl************ ***@gmail.com> wrote:

I suggest You to use base 64 encoded strings
something like
password = 'aGlkZGVuX3Bhc3 N3b3Jk\n'
password = pasword.decode( "base64")

That will delay the attacker for a few minutes.

--
Grant Edwards grante Yow! Do you like "TENDER
at VITTLES"?
visi.com

[Ivan Voras]

Grant Edwards wrote:

On 2005-05-03, mahasamatman <vl************ ***@gmail.com> wrote:

password = pasword.decode( "base64")

That will delay the attacker for a few minutes.

True, but a script kiddie that only knows about the 'strings' program
will be forever baffled :)

Though deprecated, I think the enigma cipher (rotor) is still present in
python - it could find its use in simple cases like this.