[Tutor] How to obfuscate a database password.

Danny Yoo dyoo at hkn.eecs.berkeley.edu
Wed Apr 20 05:36:02 CEST 2005

> I am not necessarily talking about passwords for users but about the
> password that is used for connecting to the database.

Hi David,

Ah, ok, I misunderstood the problem then.  Hmmm... I agree with the others
who have said that this is difficult.  *grin* Eventually, you'll need to
decrypt whatever you're using to talk to the database, and once it's
decrypted, it can be grabbed.

A common approach that I've seen is to separate that connection
username/password strings out into a separate file, out of the source
code.  One can then use the operating system's permissions system to
ensure that only authorized users can see the file.

I'm not sure if this approach will work for you.  Let me try to understand
the situation better: are there multiple clients who will talk to your
database, or is there just one central client to the database?  How much
do you plan to control?

> In a compiled language you would have to look pretty hard in a dll to
> find where the password had been encoded.

You may be underestimating your audience, and you may be overestimating
the obfuscation that compilation does: it's actually very easy to look at
strings that are encoded in binaries.

For example:

mumak:~ dyoo$ cat hello.c
#include <stdio.h>
int main(void) {
  printf("hello world");
mumak:~ dyoo$
mumak:~ dyoo$
mumak:~ dyoo$ gcc hello.c
mumak:~ dyoo$
mumak:~ dyoo$
mumak:~ dyoo$ strings a.out
The kernel support for the dynamic linker is not present to run this
hello world

This is a quick and dirty example, but I hope it's clear that you can't
treat compilation as some magic scrambler.  Most compiled languages don't
do funky things to their string literals, and it's really easy to pull
them right out again.  There are dedicated tools to do code obfuscation,
but I don't believe they'd deter a determined attack.

Best of wishes!

More information about the Tutor mailing list