Re: COM Interface Security

From: Klaus H. Probst (usenet001_at_simulplex.net)
Date: 01/19/05 

Date: Tue, 18 Jan 2005 23:56:23 -0700

Joseph,

Are you using COM+? If you are, you can set the call authentication level
for calls to the COM+ application to "packet privacy" and that will encrypt
the wire protocol used by the marshaler.

If you're not using COM+ and the call is local (ie, not over RPC or a pipe)
then I don't think you need to worry about interception very much - I'd
worry about spoofing instead. Since your interface is public and the progid
is well-known, it's probably not difficult to create a stub that looks like
your encryption DLL and offer it up to the client making the call.

I've never seen something that intercepts straight COM calls, but I assume
it's possible given that the PSDK ships (or used to) with an app that will
hook standard API calls (depends.exe does something similar). It's probably
not trivial, but I doubt it's impossible. 

-- 
Klaus H. Probst, MVP
   http://www.simulplex.net/
"Joseph Geretz" <jgeretz@nospam.com> wrote in message
news:u%23u4PiZ$EHA.3372@TK2MSFTNGP10.phx.gbl...
> How easy or difficult is it to intercept data values passing between a
> client and server via a public COM interface? I've built an encryption
> component (using the VB Blowfish sample) as a public class in our utility
> library. As with all encryption, the secrecy of the key must be protected.
> The key is generated dynamically at run time via an internal algorithm. It
> would take reverse assembly to discover the key. I'm not worried about
> reverse assembly. If someone can reverse-assemble our code then the game
is
> over in any case.
>
> I am wondering though about how we submit our private key when we first
> instantiate and initialize the cryptor class. (Anyone can instantiate this
> class, but unless they know the key, they won't be able to decrypt our
> protected ciphertext.) Can information passing through a COM interface be
> easily intercepted or would it take a skill at the level of
reverse-assembly
> in order to do this?
>
> Thanks for your advice.
>
> Joseph Geretz
>
>

Relevant Pages

  • Re: COM Interface Security
    ... you can set the call authentication level ... then I don't think you need to worry about interception very much - I'd ... your encryption DLL and offer it up to the client making the call. ... > How easy or difficult is it to intercept data values passing between a> client and server via a public COM interface? ...
    (microsoft.public.vb.winapi)
  • My response to a message by Dorothy Denning in 1995 - Australia and Encryption Policy
    ... Subject: Australia and Encryption Policy ... interception, which includes the issue of the use of cryptography as: ... keys but may be required to provide them in response to a court order. ...
    (sci.crypt)
  • Re: Automate GPG or PGP to make an .exe
    ... a website that he created for that purpose, ... without encryption, for example normal email and phone calls. ... interception and tampering without having to rely on the transport layer. ...
    (sci.crypt)
  • Re: Ex2007 EVS on Windows 2008
    ... if it's possible to query the requested encryption of a WMI namespace. ... If the WMI namespace to be queried is known ahead of time, ... Microsoft Online Community Support ... the authentication level to PKT_PRIVACY. ...
    (microsoft.public.win32.programmer.wmi)
  • Re: [SLE] Wireless ... again
    ... encryption key and open my wireless network up everything seems to work ... The whole story from booting to getting the network up ... >Although this was a useful way of starting the wireless interface it didn't ...
    (SuSE)