Protect Delphi Connection String From Hack - sql-server

Question

we have an delphi application that using tadoconnection for connecting sql server database
a problem is when we open a resource hacker on running exe file it show's connectionstring clearly and any one can connect to our server
a sample code shown below describe problem

Answer 1

You are not using a resource hacker. If your strings were stored in resources, they would be even easier to find and view.
You are using a memory scanner instead, one that looks at the program's raw memory while it is running. Eventually, you would have to create a connection string in memory to pass to the database engine. If a hacker has access to the app and its memory, they have app to its data. A dedicated hacker with such access will be able to grab that string at the time it is being used.
But there are things you can do to make things harder for casual hackers.
For one thing, don't allow non-admin users to have access to your app. When a user runs the scanner app, it is likely to have access to memory in other apps run by the same user. Run your app in a different user context, or in an elevated process. Apps run by a user cannot access the memory of other apps being run by other users, unless he/she is explictly granted permission to them, or he/she is an admin to begin with. If a hacker has permissions to access your app, all bets are off.
Also, break up the string into smaller substrings that you have to concatenate when needed. Build up the connection string dynamically. That way, the substrings are not stored in one place, should the hacker try looking through the EXE file itself on disk.
And by all means, don't store sensitive credentials within the app code to begin with. Store them externally, and keep them encrypted. Retrieve them to memory only when absolutely needed, and securely destroy the content of that memory using SecureZeroMemory() when you are done using it. If you need to hold on to the credentials, or the connection string, in memory for more than a few milliseconds, consider using CryptProtectMemory() to encrypt that memory when you are not actively using it.
The more work it takes you to piece together the connection string, the more work a casual hacker will have to do, too. But a dedicated hacker will just wait until you do all the work, and then just pluck the final string from memory at the moment it is used, so you have to do what you can to prevent access to memory in the first place.

Answer 2

Ensure your password is stored separately and as securely as meets your requirements.*
Ensure you do not persist your password with your connection. I.e. Connection.Properties must include 'Persist Security Info=False'
Set Connection.LoginPrompt to True.
Implement a handler for the OnLogin event in which you load, decrypt and provide your password to the Connection.Open call.
As a final security step, ensure you erase your decrypted password from memory.
*There a plenty of simple encryption libraries available that you might as well encrypt your password. Microsoft's Data Protection API is worth considering. Bear in mind that perfect security is impossible if someone has access to your application. The best you can do is add layers of obfuscation making it more difficult for a hacker to crack your database login credentials.
Some sample code
procedure TAbc.HandleOnLogin(Sender: TObject; Username, Password: string);
var
LPassword: string;
begin
LPassword := GetDecryptedPassword; //Your choice how you do this
Connection.Open(Username, LPassword);
//The next line ensures memory is erased before it is deallocated
//which would otherwise leave the password hanging around.
SecureZeroMemory(Pointer(LPassword), Length(LPassword) * SizeOf(Char));
end;

Answer 3

In addition to other answers what you can do is remove permission to read process memory, this is useful if you control user permissions (say in enterprise environment).
Calling following procedure at the start of your process prevents non-admin user from reading process memory. (You'll need JEDI API units for missing API calls)
uses JwaWinNT, JwaWinBase, JwaAclApi, JwaAccCtrl;
//...
{$SCOPEDENUMS ON}
function ProtectProcess(): DWORD;
type
TSidType = (Everyone, CurrentUser, System, Admin);
var
// Released on exit
ProcessToken: THandle;
TokenInfo: PVOID;
SidCurUser: PSID;
SidEveryone: PSID;
SidSystem: PSID;
SidAdmins: PSID;
ACL: PACL;
SecDesc: PSECURITY_DESCRIPTOR;
Size: DWORD;
TokenSize: DWORD;
BResult: Bool;
SIDAuthEveryone: SID_IDENTIFIER_AUTHORITY;
SIDAuthSystem: SID_IDENTIFIER_AUTHORITY;
SIDAuthAdministrators: SID_IDENTIFIER_AUTHORITY;
SIDArray: array[TSidType] of PSID;
I: TSidType;
const
// Mimic Protected Process
// https://msdn.microsoft.com/en-us/library/windows/desktop/ms684880%28v=vs.85%29.aspx
// Protected processes allow PROCESS_TERMINATE, which is
// probably not appropriate for high integrity software.
DeniedPermissions =
{READ_CONTROL |}
WRITE_DAC or WRITE_OWNER or
PROCESS_CREATE_PROCESS or PROCESS_CREATE_THREAD or
// PROCESS_DUP_HANDLE or // this permission is needed for printing
PROCESS_QUERY_INFORMATION or
PROCESS_SET_QUOTA or PROCESS_SET_INFORMATION or
PROCESS_VM_OPERATION or
PROCESS_VM_READ or PROCESS_VM_WRITE
// In addition to protected process
// or PROCESS_SUSPEND_RESUME or PROCESS_TERMINATE
;
// Standard and specific rights not explicitly denied
AllowedPermissions = ((not DeniedPermissions) and $1FFF) or PROCESS_TERMINATE or SYNCHRONIZE;
begin
ACL := nil;
TokenInfo := nil;
SecDesc := nil;
try
TokenSize := 0;
ProcessToken := 0;
// If this fails, you can try to fallback to OpenThreadToken
if (not OpenProcessToken(GetCurrentProcess(), TOKEN_READ, ProcessToken)) then
begin
Result := GetLastError();
Exit;
end;
BResult := GetTokenInformation(ProcessToken, TokenUser, nil, 0, TokenSize);
Result := GetLastError();
Assert((not BResult) and (ERROR_INSUFFICIENT_BUFFER = Result));
if(not ((BResult = FALSE) and (ERROR_INSUFFICIENT_BUFFER = Result))) then
begin
// failed;
Exit;
end;
if (TokenSize > 0) then
begin
TokenInfo := HeapAlloc(GetProcessHeap(), 0, TokenSize);
Result := GetLastError();
Assert(Assigned(TokenInfo));
if (nil = TokenInfo) then
begin
// failed;
Exit;
end;
end;
BResult := GetTokenInformation(ProcessToken, TokenUser, TokenInfo, TokenSize, TokenSize);
Result := GetLastError();
Assert(BResult and Assigned(TokenInfo));
if not (BResult and Assigned(TokenInfo)) then
begin
Exit;
end;
SidCurUser := (PTokenUser(TokenInfo)).User.Sid;
SIDAuthEveryone := SECURITY_WORLD_SID_AUTHORITY;
BResult := AllocateAndInitializeSid(#SIDAuthEveryone, 1,
SECURITY_WORLD_RID, 0, 0, 0, 0, 0, 0, 0, SidEveryone);
Result := GetLastError();
Assert(BResult and Assigned(SidEveryone));
if not (BResult and Assigned(SidEveryone)) then
begin
Exit;
end;
SIDAuthSystem := SECURITY_NT_AUTHORITY;
BResult := AllocateAndInitializeSid(#SIDAuthSystem, 1,
SECURITY_LOCAL_SYSTEM_RID, 0, 0, 0, 0, 0, 0, 0, SidSystem);
Result := GetLastError();
Assert(BResult and Assigned(SidSystem));
if not (BResult and Assigned(SidSystem)) then
begin
Exit;
end;
SIDAuthAdministrators := SECURITY_NT_AUTHORITY;
BResult := AllocateAndInitializeSid(#SIDAuthAdministrators, 2,
SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS,
0, 0, 0, 0, 0, 0, SidAdmins);
Result := GetLastError();
Assert(BResult and Assigned(SidAdmins));
if not (BResult and Assigned(SidAdmins)) then
begin
Exit;
end;
SIDArray[TSidType.Everyone] := SidEveryone; // Deny most rights to everyone
SIDArray[TSidType.CurrentUser] := SidCurUser; // Allow what was not denied
SIDArray[TSidType.System] := SidSystem; // Full control
SIDArray[TSidType.Admin] := SidAdmins; // Full control
// Determine required size of the ACL
Size := SizeOf(ACL);
// First the DENY, then the ALLOW
Size := Size + GetLengthSid(SIDArray[TSidType.Everyone]);
Size := Size + SizeOf(ACCESS_DENIED_ACE) - SizeOf(DWORD);
for I := TSidType.CurrentUser to High(SIDArray) do
begin
// DWORD is the SidStart field, which is not used for absolute format
Size := Size + GetLengthSid(SIDArray[I]);
Size := Size + SizeOf(ACCESS_ALLOWED_ACE) - SizeOf(DWORD);
end;
Size := Size + SizeOf(DWORD);
ACL := PACL(HeapAlloc(GetProcessHeap(), 0, Size));
Result := GetLastError();
Assert(Assigned(ACL));
if not Assigned(ACL) then
begin
Exit;
end;
BResult := InitializeAcl(ACL, Size, ACL_REVISION);
Result := GetLastError();
Assert(BResult);
if not BResult then
begin
Exit;
end;
BResult := AddAccessDeniedAce(ACL, ACL_REVISION, DeniedPermissions,
SIDArray[TSidType.Everyone]);
Result := GetLastError();
Assert(BResult);
if not BResult then
begin
Exit;
end;
BResult := AddAccessAllowedAce(ACL, ACL_REVISION, AllowedPermissions,
SIDArray[TSidType.CurrentUser]);
Result := GetLastError();
Assert(BResult);
if not BResult then
begin
Exit;
end;
// Because of ACE ordering, System will effectively have dwAllowed even
// though the ACE specifies PROCESS_ALL_ACCESS (unless software uses
// SeDebugPrivilege or SeTcbName and increases access).
// As an exercise, check behavior of tools such as Process Explorer under XP,
// Vista, and above. Vista and above should exhibit slightly different behavior
// due to Restricted tokens.
BResult := AddAccessAllowedAce(ACL, ACL_REVISION, PROCESS_ALL_ACCESS,
SIDArray[TSidType.System]);
Result := GetLastError();
Assert(BResult);
if not BResult then
begin
Exit;
end;
// Because of ACE ordering, Administrators will effectively have dwAllowed
// even though the ACE specifies PROCESS_ALL_ACCESS (unless the Administrator
// invokes 'discretionary security' by taking ownership and increasing access).
// As an exercise, check behavior of tools such as Process Explorer under XP,
// Vista, and above. Vista and above should exhibit slightly different behavior
// due to Restricted tokens.
BResult := AddAccessAllowedAce(ACL, ACL_REVISION, PROCESS_ALL_ACCESS, SIDArray[TSidType.Admin]);
Result := GetLastError();
Assert(BResult);
if not BResult then
begin
SiMain.LogWin32Error('AddAccessAllowedAce failed: ', Result);
Exit;
end;
SecDesc := PSECURITY_DESCRIPTOR(HeapAlloc(GetProcessHeap(), 0, SECURITY_DESCRIPTOR_MIN_LENGTH));
Result := GetLastError();
Assert(Assigned(SecDesc));
if not Assigned(SecDesc) then
begin
Exit;
end;
// InitializeSecurityDescriptor initializes a security descriptor in
// absolute format, rather than self-relative format. See
// http://msdn.microsoft.com/en-us/library/aa378863(VS.85).aspx
BResult := InitializeSecurityDescriptor(SecDesc, SECURITY_DESCRIPTOR_REVISION);
Result := GetLastError();
Assert(BResult);
if not BResult then
begin
Exit;
end;
BResult := SetSecurityDescriptorDacl(SecDesc, TRUE, ACL, FALSE);
Result := GetLastError();
Assert(BResult);
if not BResult then
begin
Exit;
end;
SetSecurityInfo(
GetCurrentProcess(),
SE_KERNEL_OBJECT, // process object
OWNER_SECURITY_INFORMATION or DACL_SECURITY_INFORMATION,
SidCurUser, // Owner SID
nil, // Group SID
ACL,
nil // SACL
);
Result := GetLastError();
Assert(ERROR_SUCCESS = Result);
finally
if (nil <> SecDesc) then
begin
HeapFree(GetProcessHeap(), 0, SecDesc);
end;
if (nil <> ACL) then
begin
HeapFree(GetProcessHeap(), 0, ACL);
end;
if (SidAdmins <> nil) then
begin
FreeSid(SidAdmins);
end;
if (SidSystem <> nil) then
begin
FreeSid(SidSystem);
end;
if (SidEveryone <> nil) then
begin
FreeSid(SidEveryone);
end;
if (nil <> TokenInfo) then
begin
HeapFree(GetProcessHeap(), 0, TokenInfo);
end;
if (0 <> ProcessToken) then
begin
CloseHandle(ProcessToken);
end;
end;
end;