🚀 go-pugleaf

Alex McDonald wrote:
> Eric Minso wrote:
> > In fact, I don't have the source code of executables I want to
> > protect.
> >
> > The company where I do my training period is a computer
manufacturer :
> > they assemble computers and install standard configurations
(Windows
> > XP + some softwares). They also give a CD-ROM with many
application
> > that the user can install.
> >
> > In order to lower the computer cost, the sofwares available on the
> > CD-ROM are locked and the customer do not pay the licence for
them. A
> > serial number allows him to unlock only three or four softwares
that
> > he can choose.
> >
> > The interest for the customer is that he installs only softwares
he
> > wants.
> >
> > A few time ago, some software editors have claimed that the
protection
> > system is too easy to hack and asked to the company a better
> > protection for their softwares.
> >
> > So I was asked to study a way to protect these executables.
> > Unfortunately, I have only access to the executables - I can't
> > recompile the softwares to protect.
>
> Are you making this up as you go along? For sure, somebody in your
> company isn't thinking straight.
>
> Let's say you'd succeeded in writing your original idea. Each user
> would need to be given a "key" to allow decryption and loading of
the
> program by your program. So they copy your CD and the key, give it
to
> their friends, and you're back where you are right now. Or am I
> missing something here?
>
> What %age of purchasers come back to buy extra software? If it's not
> significant, then my favoured solution for your problem is not to
ship
> the software on the CD in the first place. Send them the author's CD
> when they order it, and save the company CD production/handling
costs,
> hassle from software authors etc.
>
> Or, what system is your company currently using? How are people
> hacking it? Can it reasonably be beefed up?
>
> Or you encrypt the software on the CD using a strong key; there are
> plenty of descriptions of DES encryption algorithms on the web. Give
> the user another key that is "unscrambled" to the decryption key.
Base
> it on the date; allow, say, 5 days for the key to be valid. Then the
> key is useless to anyone else outside that 5 day window.
>
> Now you could put an I/O error on the CD as well; that makes it more
> difficult to copy the CD, and the "unscrambler" program can check
for
> that too. Joe Average now needs a valid key, the original CD and
needs
> to install in 5 days. Even then, he could still install it on a 100
> PCs in that period. So you could introduce a "machine key" so it
only
> works on his PC... and so on.
>
> Of course, once the software's installed on a PC it could be copied
> off. But that's true of every piece of software I've ever seen that
> doesn't have some form of extra check, such as a dongle (and even
they
> can be copied). That form of protection is the responsibility of the
> software author, not your company.
>
> You'll never stop software theft, all you can do is make it more
> difficult, but at a price. There's a balance between the cost of
> deterrence and the loss you think you're incurring. Work that out
> first, write code last.

I agree with all your observations and comments here, Alex...

Just I came up with a mad software piracy prevention idea the other
day...the idea is pretty simple...encode the customer's details -
including credit card number - into the executable...no, the
executable itself does NOT ever decode it or crack it open so there's
no way to reverse engineer how this code is stored or even where it
might be stored...the only people who can read it need a special
utility program that'll be able to see this "watermark"...the final
ingredient is to prominently make clear in BOLD TEXT and suitable
legalese that the executable contains _YOUR_ sensitive
information...so, it's in your _OWN_ interests not to copy it or let
unauthorised people at your copy...the legalese makes clear that in
running the software you accept responsibility in keeping the software
safe from piracy and that _should_ your copy be found on a Warez site
then, legally, you're culpable...

Not sure, though, that this scheme would actually be legal...although,
I don't really see why not as you're not handing someone's private
details to anyone but the individual themselves..._IF_ that individual
then copies it up onto Warez sites, that's not your doing, that's
their doing and the consequences that they're handing out their own
credit card information is upon their own heads...

Of course, you, as the software producer, have all these details and
the corresponding "watermark" codes in your customer database...thus,
when a Warez site shows up your software, you run the "watermark"
utility, find out the guilty party and then start your legal
proceedings against them...it was made perfectly clear all over the
place that the software had been "watermarked" like this and, as the
software producer, you did not send any sensitive, private information
to _anyone but the actual owner of that information (who sent it to
you to buy the software)_...goodness knows if this would actually pass
the test of the courts...but as long as the first time does, they all
will (legal precedent and all that :)...

The idea is to turn the whole thing on its head...rather than the
software producer being on the defensive all the time, you use the
customer's information to put them on the defensive that they'll NOT
pirate...

Morally, there is the slight issue that, in a sense, this could be
thought of as "blackmail" (look after my software on your computer or
else...! ;) but fully responsible users will suffer no problem or
penalty...you are only "blackmailing" them to keep within the bounds
of law, which is a social obligation and duty on them, anyway...you
can hardly complain: "they are unfairly making me comply with the law
by sending my information, that I gave to them, back to me in an
encoded form that no-one else but them can read, anyway!!"...like,
yeah, where's the problem with that? ;)

Mind you, I've only just thought of this and I've probably missed
something crucial...like some Civil Liberty or law not permitting this
kind of conduct...but, otherwise, it's a pretty sneaky way of stopping
piracy, eh?

Also, along the same lines, something else that could save a heck of a
lot of problems with viruses and running processes and stuff is a
similar "source" field, filled out by the OS indicating what program /
URL started up something or where it was downloaded from...a "file
history" attached to a file...hence, if something claiming to be a
Windows component has a history that doesn't come from
"WindowsUpdate.com" but some random IP address that whois's to
somewhere in Denmark or Sweden then say hello to Mr.Trojan Horse...if
one program tries to launch another legitimate program then the
"source" field is specified with the program / command line / registry
entry that launched it...so, at the very least, even if you were to
get stung, at least you'd have the information to disable / delete the
thing soonest possible...and, also, Email to Microsoft / McAfee and
those sort of people to help them discover the source of the problem
for them to take suitable actions (well, if they are just handed the
information about where something is coming from or how it launches
then, at the very least, it saves them all that time they must spend
working it out themselves...and if MS insist on "patches" rather than
good design, then, accepting that, we could at least get these
"patches" ASAP...mind you, the flaw in that plan is MS
themselves...they don't care sufficiently to make the effort, however
encouraged...well, not unless you attach a few million dollars to
it...they're just soulless mercenaries, after all, and always have
been ;)...

Beth :)