Question

I have a program based on WPF in C#, and I want to remove the user’s privileges for debugging the application (SeDebugPrivilege) (in Release mode at least). What’s the best way to go about this ? I’ve found a couple of ways of doing it in code that requires unsafe calls to unmanaged code. I’d prefer to do this either purely in C# or, even better, via an application manifest or some other means that prevents the user from having the SeDebugPrivilege at all during the execution of my application. Is there anyway of declaring a Windows group and revoking the privilege for the whole group ? The motivation for this is part of a push to better secure my application by following the principles of least privilege. There are other privileges I’m sure I’d like to remove at some point later, but I’d like to worry about one thing at a time.

Answer 1

I think you may be misunderstanding the effects of privileges such as SeDebugPrivilege. Whilst you can certainly remove the privilege from process token using AdjustTokenPrivileges, this does not prevent the application from being debugged, it instead prevents the application itself from performing certain debugging actions. This could however be used to reduce the impact of possible vulnerabilities in your application by preventing it from affecting other processes via means that require the privilege.

Note that by default, a user can debug an application they have started themselves even without SeDebugPrivilege, so even if run as a non-administrative user (which by default will not have the privilege at all) this will not prevent the application from being debugged.

There are of course many examples of applications that attempt to detect whether a debugger is attached and they do so with varying levels of success. At best you will be able to make it harder to debug the application but you won’t be able to prevent it entirely if you are running on the user’s machine.

You could perhaps periodically check System.Diagnostics.Debugger.IsAttached, and take some action if the value is true, but it would be relatively straightforward to overcome for someone determined to debug the application.