Shawn Wildermuth President, AgiliTrain Microsoft MVP (Data) Knowing the Enemy

Securing Silverlight: Knowing the Enemy

Users/Hackers (Reflector, Silverlight Spy, Debuggers, Memory Profilers) Users/Hackers (Reflector, Silverlight Spy, Debuggers, Memory Profilers) Hackers/Personnel (Intrusion and Physical Security) Hackers/Personnel Eavesdroppers (Packet Sniffers, etc.) Eavesdroppers

Securing Silverlight: Knowing the Enemy YourApp.xap Main Assembly CodeCode Embedded XAMLEmbedded XAML Other ResourcesOther Resources SDK Assemblies Optionally deployed ControlsOptionally deployed Controls Other.dll Your LibrariesYour Libraries Other Assets ImagesImages FontsFonts YourApp.zip Main Assembly CodeCode Embedded XAMLEmbedded XAML Other ResourcesOther Resources SDK Assemblies Optionally deployed ControlsOptionally deployed Controls Other.dll Your LibrariesYour Libraries Other Assets ImagesImages FontsFonts

Securing Silverlight: Knowing the Enemy  Client Security Considerations ◦ Code ◦ XAML ◦ Assets ◦ Secrets ◦ Isolated Storage ◦ Data

Securing Silverlight: Knowing the Enemy  Code ◦ Limited Protection ◦ Even with Obfuscation  XAML ◦ Almost No Protection ◦ Stored as Text  Assets ◦ Almost No Protection

Securing Silverlight: Knowing the Enemy  Secrets ◦ Obfuscation Helps ◦ Not Complete – Must Be Loaded Into Memory  Isolated Storage ◦ No Protection ◦ Accessible to Users – Keep Your Secrets Out of Here  Data ◦ Limit Surface Area ◦ Send Summary Data ◦ Data Services’ Projections Are Helpful

Securing Silverlight: Knowing the Enemy  Silverlight does not protect your Algorithms ◦ Unlike.NET:  Obfuscation only protects against decompilation  Code runs in the client  Client must be able to download assemblies

Securing Silverlight: Knowing the Enemy  What is worth protecting? ◦ Labor? No… ◦ Unique implementations? Yes… ◦ Sensitive data? Yes…

Securing Silverlight: Knowing the Enemy  Hide it on the Server ◦ Generate the XAML on the Server ◦ Send only summary data to the client

Securing Silverlight: Knowing the Enemy  Silverlight Apps Are Just Files ◦ Protect like any other web file  Forms Authentication  Windows Authentication  Etc.

Securing Silverlight: Knowing the Enemy  For Apps with Login ◦ XAP needs to be anonymous accessed ◦ Compose at Runtime  Bootstrapper App or Composition (Prism, MEF, etc.)

Securing Silverlight: Knowing the Enemy  Only Secure Methods in Silverlight ◦ Token Based ◦ Cookie Based ◦ NTLM Based

Securing Silverlight: Knowing the Enemy BrowserBrowser SilverlightAppSilverlightApp Network Call with Browser State (cookies, Session ID, NTLM) Network Call with Browser State (cookies, Session ID, NTLM)

Securing Silverlight: Knowing the Enemy  Why Not Basic Auth? ◦ Insecure across the wire  (though could secure with SSL) ◦ Uses Headers  Specifically forbidden using the HTTP Stacks

Securing Silverlight: Knowing the Enemy  Integrated Windows Authentication ◦ Just Works ◦ Assumes NTLM on the Platform  OSX is Problematic

Securing Silverlight: Knowing the Enemy  Cookie Based Auth ◦ ASP.NET’s Forms Based Auth ◦ Custom Encrypted Cookies  Never decrypt on client  Expire Cookies Frequently

Securing Silverlight: Knowing the Enemy  Token-based Security ◦ Can use expiring tokens ◦ Pass them in on web services ◦ Not fool proof or ‘secure’ ◦ Must also expire

Securing Silverlight: Knowing the Enemy  Add Service Reference Problem ◦ Doesn’t play well with security ◦ Must disable security when adding/refreshing ◦ Trouble for building references at build-time

Securing Silverlight: Knowing the Enemy  ClientCredentials MyServiceClient client = new MyServiceClient(); client.ClientCredentials.UserName.UserName = "Frank"; client.ClientCredentials.UserName.Password = "P2ssw0rd"; client.GetNameCompleted += (s, args) => { theText.Text = args.Result; }; client.GetNameAsync(); MyServiceClient client = new MyServiceClient(); client.ClientCredentials.UserName.UserName = "Frank"; client.ClientCredentials.UserName.Password = "P2ssw0rd"; client.GetNameCompleted += (s, args) => { theText.Text = args.Result; }; client.GetNameAsync();

Securing Silverlight: Knowing the Enemy  Using Forms Authentication Service ◦ AuthenticationService (pre-built WCF) ◦ Simple SOAP call to authenticate ServiceHost Language="C#" Service="System.Web.ApplicationServices.AuthenticationService" %> ServiceHost Language="C#" Service="System.Web.ApplicationServices.AuthenticationService" %> var proxy = new AuthenticationServiceClient(); proxy.LoginCompleted += (s, args) => { if (args.Result) { // Succeeded } }; proxy.LoginAsync("Frank", "P2ssw0rd", null, false); var proxy = new AuthenticationServiceClient(); proxy.LoginCompleted += (s, args) => { if (args.Result) { // Succeeded } }; proxy.LoginAsync("Frank", "P2ssw0rd", null, false);

Securing Silverlight: Knowing the Enemy  Standard network stack goes through Browser ◦ Good:  Uses cookies and NTLM  Looks and feels like the browser ◦ Bad:  Only GET/POST are supported  Typically limited to two outbound requests

Securing Silverlight: Knowing the Enemy  Alternative: Client HTTP Stack ◦ For specific scenarios:  Need PUT/DELETE  Need Custom Cookies  Need more control  status codes, bodies and headers

Securing Silverlight: Knowing the Enemy  Create New Request ◦ Use WebRequestCreator’s ClientHttp property: ◦ Non-event-based, APM style WebRequest req = WebRequestCreator.ClientHttp.Create(new Uri(" UriKind.Absolute)); WebRequest req = WebRequestCreator.ClientHttp.Create(new Uri(" UriKind.Absolute)); req.BeginGetResponse(new AsyncCallback(r => { var res = req.EndGetResponse(r); var strm = res.GetResponseStream(); }), null); req.BeginGetResponse(new AsyncCallback(r => { var res = req.EndGetResponse(r); var strm = res.GetResponseStream(); }), null);

Securing Silverlight: Knowing the Enemy  Specify all Client HTTP Stack ◦ Call WebRequest’s RegisterPrefix to specify: ◦ Then all calls become client, even WebClient: bool httpResult = WebRequest.RegisterPrefix(" WebRequestCreator.ClientHttp); bool httpResult = WebRequest.RegisterPrefix(" WebRequestCreator.ClientHttp); WebClient client = new WebClient(); client.DownloadStringCompleted += new DownloadStringCompletedEventHandler(OnDlComplete); client.DownloadStringAsync(new Uri("/template.xaml", UriKind.Relative)); WebClient client = new WebClient(); client.DownloadStringCompleted += new DownloadStringCompletedEventHandler(OnDlComplete); client.DownloadStringAsync(new Uri("/template.xaml", UriKind.Relative));

Securing Silverlight: Knowing the Enemy  WebRequests Credentials Supported ◦ For ClientHttp stack only, adds Authentication header var request = WebRequestCreator.ClientHttp.Create( new Uri(" UriKind.Relative)); request.Credentials = new NetworkCredential("shawn", request.UseDefaultCredentials = false; var request = WebRequestCreator.ClientHttp.Create( new Uri(" UriKind.Relative)); request.Credentials = new NetworkCredential("shawn", request.UseDefaultCredentials = false; WebRequest.RegisterPrefix("http", WebRequestCreator.ClientHttp); var client = new WebClient(); client.Credentials = new NetworkCredential("shawn", client.UseDefaultCredentials = false; client.DownloadStringCompleted += (s, a) => a.Result.ToArray(); client.DownloadStringAsync( new Uri(" UriKind.Relative)); WebRequest.RegisterPrefix("http", WebRequestCreator.ClientHttp); var client = new WebClient(); client.Credentials = new NetworkCredential("shawn", client.UseDefaultCredentials = false; client.DownloadStringCompleted += (s, a) => a.Result.ToArray(); client.DownloadStringAsync( new Uri(" UriKind.Relative));