Alternative for Obfuscation in the .NET world

Question

Are there any alternatives for obfuscation to protect your code from being stolen?

Answer 1

An ultimate protection is the SaaS model. Anything else will expose your precious secrets one way or another.

See: http://en.wikipedia.org/wiki/Software_as_a_service

Answer 2

A short answer is:

• Obfuscation has nothing to do with theft protection.
• Obfuscation's only purpose is to make it harder to read and understand your code so that in best case reverse engineering is economical unattractive.

It is still possible that someone steals your source code. Even if you use the best available obfuscation technology or if you think about SaaS scenarios.

You normally have your source code at least at two places together with all meta files necessary to build the project:

1. Your development computer
2. Your code repository

If you want to protect your code against theft, these are the first places where must be active. Even the biggest players on the market like Adobe, Microsoft Corporation, Symantec have lost source code as a result of a theft but not as a result of reverse engineering. And in bigger companies it does not need an external attacker - an leaving employee is sometimes enough.

So you might be interested in:

• Strong machine encryption
• Anti virus, Anti rootkit, Anti malware
• Firewall and Intrusion Detection
• Digital Property Protection
• Limited internet access on development computers
• Managed remote development environments so that source never leaves secured servers and infrastructure
• Etc. pp.
• Clear processes and consitent rights management

Today in many cases it is a bigger risk that some bad guy manages to get access to your repository or development system or that a leaving employee has a "backup copy" of your code than that some company invests time in reverse engineering of existing applications to create a 1:1 copy or to make modifications (both is in most countries illegal and may lead to big damage of reputation and expensive sentences and they also have no possibility to get professional support on such hacked and modified software)

Obfuscation does also not mean that your intellectual property is safe against beeing stolen or copied. Depending on the obfuscator you use it is still possible to analyze logic.

If you want to make analyzing logic harder, you need some kind of control flow obfuscation. But cfo can produce a lot of funny and hard to debug problems. I'm sure that's in most cases more an additional problem than an solution.

The bad reality is, that obfuscation solves not the problem of reverse engineering. It solves te problem of 1:1 (or close to 1:1) code copies. That's because most software has an recognizeable user interface or behavior and in nearly all cases it is possible to reproduce user interfaces and behaviors (or to be more exact: The results) and there exists no tool to protect software against this.

If you want to nag casual coders from understanding your code, open source tools like obfuscar may be good enough. But i bet, that you run into problems if you are using technologies like reflection, remoting, plugins, dynamic assembly loading and building etc. pp.

From my point of view - and that's also my experience - obfuscation is expendable in most cases.

If you really want to make it hard for others to access your code (while "really hard" is relative) you have in general two choices:

1. Some kind of a cryptographic container with a virtual execution environment and a virtual file system which protects not only your code but the complete application and it's structure. Attack vector is e.g. the memory during runtime or the container itself.

2. Think about SaaS which means, that you deliver the access to your software but not the software itself. But keep in mind that SaaS-Solutions can be hard to develop and expensive depending on the service level, security and confidence you want or must provide. Attack vector is e.g. the server infrastructure.

That ultimate 100% bullet proof solution does - in fact - not exist on this planet.

Last but not least it might be necessary to provide complete source code to customers in some situations. E.g. if you develop individual software and delivering code is part of your contract or if you want to make business in critical segments like aerospace, military industry, governmental systems etc. pp.