Question

I have an application running on remote systems. The remote systems are an embedded computer built into a kiosk. As a result, they are somewhat “untrusted,” in that the physical security for them is rather lax. However, these kiosks can be credit card processing, etc. via a WCF service to my server.

Using machine certificates, etc., I can verify that the client is who they say they are, which protects against someone copying my binaries off of the kiosk somehow and then running it on their own machine. However, how can I prevent against the following two attacks:

• Someone takes the binary, modifies it maliciously, and then runs it on the system
• Someone decompiles my application, and using parts of my code (such as where I reference certificates or shared secrets) writes their own application, and runs it on the machine.

Obviously I have taken steps using the operating system to prevent against these sort of attacks, but I need a way at the server to ensure that it is not being duped.

Any suggestions?

Answer 1

If the machines are not physically secure then there’s no way to guarantee any of those attacks won’t occur. Focus your efforts on minimising the damage that can be caused by a compromised machine. Examples:

• each client should have its own certificate/key, so you can easily revoke credentials of compromised machines without affecting operations elsewhere
• minimise unnecessary functionality provided by the server (for instance, clients have no need to retrieve credit card numbers – instead, return some kind of surrogate token that can be used to initiate a payment)
• minimise sensitive data stored on the client side, and delete when no longer necessary
• enforce business logic on the server side
• the server should require authentication before performing sensitive operations
• log sensitive operations server-side so you have an audit trail and early warning of malicious activity

In general, take the same precautions that you’d take when writing a web app exposed to the masses…