Question

I have a launcher app which lets the user select exe files they want to open quickly. To do this, they select the file from a File Browser, and I store the exe path in a config file. Is there a security problem with this? My concern is that some malware could alter the config file to change the exe file to a malicious executable and the app would then launch it. Is this a viable threat, or is it the case that if the malware can rewrite a file, it wouldn’t need a proxy app to launch another file? I could encrypt the file, but I don’t mind the user manually altering the settings via a text editor.

Answer 1

You could store in your config file the Hash of the exe file launched and inform the user if the hash changes between execution.

To calculate the Hash of a file:

public static string ComputeHash(string fileName)
{
    using(FileStream st = File.OpenRead(fileName))
    {
         SHA1CryptoServiceProvider sha1 = new SHA1CryptoServiceProvider());
         byte[] hash = sha1.ComputeHash(st);
         return BitConverter.ToString(hash).Replace("-", "");
    }
}