2

The WCF documentation says that the "Net Named Pipe" binding can be used for fast interprocess communication on a single machine. It cannot be used for communication across machines.

I would like to know if using the Net Named Pipe binding will protect my service from being attacked from outside the network. I've been told that the answer is no; that although Net Named Pipe binding is meant to be used for interprocess communication on the same machine, it can be hacked to allow access from other machines. Is that accurate?

WCF experts, please chime in. Does using the Net Named Pipe binding intrinsically protect my service from unauthorized access from other machines?

Vivian River
  • 31,198
  • 62
  • 198
  • 313

2 Answers2

4

The correct answer is YES: the NetNamedPipeBinding does intrinsically protect the service from any access from other machines across the network. The pipe which the WCF service-side stack creates carries an ACL which denies all access to any logon token which has membership of the NETWORK USERS group. This group membership is present in any network logon token.

There are some security issues with the NetNamedPipeBinding, particularly in .NET 3.5, but vulnerability to remote exploits is not one of them.

See this post and subsequent posts for details.

Chris Dickson
  • 11,964
  • 1
  • 39
  • 60
0

Per the name Net Named Pipe this binding uses local named pipes as the transport mechanism. On Windows machines named pipes are treated like files... and as such are accessible remotely like browsing to a machine with \\machinename. Therefore since the transport mechanism is accessible to remote machines the binding is inherently not immune to unauthorized access, although there may be some security advantages to named pipes as opposed to TCP or HTTP.

John K
  • 830
  • 1
  • 7
  • 18
  • It's not accessible across the Internet, and remote access can be secured with an Access Control List. I hardly think that remote access is much of a concern, given the system is configured correctly. – John Saunders Jul 07 '10 at 21:47
  • His questions was "Does using the Net Named Pipe binding intrinsically protect my service from unauthorized access from other machines". The answer to that is NO. HTTP and TCP bindings are also secure if configured properly, but again that was not the question. – John K Jul 07 '10 at 22:19
  • @Rice Flour Cookies: this answer is not correct, for the reasons explained in the answer I have posted. – Chris Dickson Dec 06 '10 at 22:58