1

Does anyone have any thoughts on how to prevent malware attacks on standalone applications. Let's say this is a program on a Windows machine connected to the internet, this is the most common scenario.

I'm also wondering what type of attacks are possible. I believe .NET will do some type of static check on the code before it runs it, using a type of checksum. This would detect a statically attached malicious code snippet. Can this be gotten around?

What about dynamically injected code. Separate program spaces prevent this to some degree. What about infecting data files? Is it safer to store data in a database and only use service calls no file operations?

What about memory usage techniques to increase security? I know it's not a standalone case, but, the problem with DNS server corruption had to do with a predictable use of, I think, IP addresses. Should memory usage be made more unpredictable?

4

2 回答 2

2

I'm also wondering what type of attacks are possible.

What you can check for varies depending on your application. Here are some thoughts that may help you get started:

  • Assuming you have a image editor you will want to be sure that people don't exploit buffer overruns due to bugs in the image encoder/decoder libraries.

  • If you have a browser or a document viewer, you need to check every URL before allowing the user to browse to that URL -- you should disable javascript injection.

  • If you are dealing with sockets, see that you don't allow any arbitrary connections.

  • If you are reading/writing from system clipboard, double check the data and don't leave anything behind. Do proper cleanup.

  • Sign your own binaries and other distributables.

  • If your application deals with security:

  • use a good Crypto library

  • have a threat analysis
  • don't use static passwords

and many many more...

What about dynamically injected code.

This is almost always because of some bugs in your code. Run your code through a static analysis tool and check for buffer overruns and friends.

What about memory usage techniques to increase security?

In a multiuser scenario, your application is already sandboxed to run in each user's own process space. However, it doesn't make sense to sandbox different applications for a single user.

于 2009-03-24T18:04:06.127 回答
1

最重要的是：不要以管理员身份运行，或要求您以管理员身份运行。使用 CAS 拒绝自己不需要的权限。那样的话，如果所有其他方法都失败了，而你完全拥有，你只是搞砸了自己，而不是你的整个 PC。

于 2009-03-24T18:28:12.900 回答