|go ahead... be a heretic|
Re: Hide DBI password in scriptsby afoken (Abbot)
|on Jan 12, 2018 at 23:41 UTC||Need Help??|
Most of the posts I've seen say it is impossible to achieve unbreakable security in this respect.
Whatever you do, you will end with a program (C, Perl, whatever) that contains two parts:
It should be obvious that this can be broken quite easily. Start the program under control of a debugger and let it run to the place where it has decrypted or de-obfuscated the secret, break and dump the secret. Yes, there are ways to make exactly this harder. Search the web for anti-debugging techniques and how to bypass them. You can and should include the security checks in the decoder. But again, you can bypass those checks.
But if you use an external program from a perl script, it is even easier: Just make the perl script print the secret. Everything needed to make the external program happy must be present in the perl script. For a DBI application, just replace DBI->connect() with die. You don't even have to modify the perl script, a tiny module like the following, combined with perl -MDBIspy victim.pl should be sufficient.
There are several password managers available, commonly bundled with the Linux desktop environment you use. Whatever interface it uses, guess what happens when you need to call DBI->connect() with a secret from the password manager. Right, you need code that finally extracts the secret as plain text. And guess what happens when you use that ridiculously trivial DBIspy module. Your secret is no longer secret.
Today I will gladly share my knowledge and experience, for there are no sweeter words than "I told you so". ;-)