Share Your Key - Share Your Costs - wibu-systems ag

More documents

Recommendations

Info

Hacker´s Contest 2007 How important is software protection? Isn’t it possible that every protection scheme can be cracked? These are typical questions from nearly every software producer; because implementing a software protection system requires a lot of effort and some expense. Every Third License is a Pirated Copy The newest software piracy study, published in August 2007 by the Business Software Alliance (BSA) and IDC, showed the average worldwide piracy rate, unchanged from last year, to be 36%. The USA is low with 22%, but leads in the absolute fi nancial damage with 7.3 billion US-$, in front of China and France. Germany is number 7 on the absolute damage list and is part of the European piracy average of 36%. This means: One pirated copy for every two legitimate licenses. In established markets like the European Community and the USA, the most damage comes from under-licensing – for example, fi ve licenses are legally purchased but twenty are illegally used. In the new growing economies, Eastern Europe and Asia, nearly all licenses in use are pirated, or “self-proclaimed” dealers sell pirated copies, sometimes without the knowledge of the customers, for example when an illegal online dealer implements his own activation schema for Original Adobe software. How Safe Can Software Protection be? No protection system can be 100% safe. But we keep trying. In the past, WIBU-SYSTEMS arranged competitions to check the security quality of our products. In these previous competitions, a protected program was published and it was shown that its protection could not be cracked and made to run without a suitable license in the WibuBox. This is a serious praxisrelevant test for software producers who want to publish a protected software product for free download on their website. 1092Participants Partial Solutions 8 In our Hacker’s Contest for 2007, we went one step further and the participants in the competition received not only the protected application, but also a CmStick with the appropriate license. 1,092 contestants from 27 countries entered the contest and had up to six weeks to remove the copy protection and claim the attractive prize of 32,768 Euro (or US-$ 40,000). No one succeeded. 12
E V E N T S Why did Not One of the 1092 Contestants Succeed? Although the challenge was theoretically solvable, not one of the contestants could fully remove the protection. Most of the contestants fell in the trap of trying to by-pass the intruder detection and had their license locked in the Cm- Stick. This resulted in further brute-force attacks to the encryption. The chance of breaking the 128-bit AES encryption was slim to none. Other contestants failed to jump other hurdles. But we did receive some excellent partial solutions and we awarded those contestants with 500 to 2000 Euro each. Hackers or Crackers go down different paths than developers and the partial solutions were important input for us. These partial winners discovered some weaknesses in our system which we not seen before. And the discovery of these weaknesses allowed us to strengthen our overall security. The partial solutions included creating memory dumps and also the attempt to replace the CmStick with record-playback simulation within the communication of the protected application with the CodeMeter runtime. One of these attacks is described in detail in the renowned Germany computer magazine “c’t”, 21/2007, describing the tools used, like IDAPro, ImpRec, OllyDebug and NetCat. But, this attack did not provide a completely successful solution to the Hacker’s Contest: A second function also had to be decrypted – its license item was already in the CmStick, but not activated by a single bit. Since the contest we have added enhancement to the CodeMeter Runtime Kit – the attack of the “c’t” is now no longer possible. Attacking Methods Attacking Methods and why they don’t work with CodeMeter: Memory Dumping: CodeMeter uses “On Demand Decryption“, this means there is no time after running the complete program when code and resources are completely decrypted in the main memory of the PC. Dummy Driver: By using complex encryption, a simulation of the encryption by dummy drivers is prohibited, because there is no limit to the number of answers for calling a function. Cracking Tools: Most of the usual cracking tools will be detected by the protected application and this detection 1092 Contestants from 27 Countries Germany 33% Rest 14% can be used to lock the license in the hardware (CmStick), avoiding any further attacks. Record-/Playback Driver: The use of randomly varied encryptions and changing of the Encryption Code avoids a successful use of recording and playback for a longer time range. Emulation of the CmSticks: The use of strong encryption (AES) and the use of secure hardware – a smart-card controller, make a complete emulation of the hardware nearly impossible. Patching of some bytes: With CodeMeter, protected applications are no longer using single checkpoints. But large areas of code and data are encrypted and such patching is impossible, especially when the automatic protection offered by AxProtector is used. Competition Program As an example, we show the competition program below, after the start, loading and decryption with the correct CmStick, in the memory of the PC: The green areas are still encrypted. The resource data areas are always encrypted and are only partially decrypted on demand. The IAT (Import Address Table), which is the connection to the called operating system remains encrypted as well as the individual functions – with two in the hacker’s contest. It is easy to understand that a memory dump will be not successful. India 2% Spain 2% Ukraina 2% PE Header Code Section Data Section China 18% France 3% Bangladesh 3% Poland 2% OEP Resource Section The Netherlands 4% Hungary 4% Link to new OEP IAT IAT redirect Security Section Security Code IAT USA 10% Operating System The Bottom Line We accept that no security system is 100% secure. But a high level of security can be reached by: Secure Hardware: The CmStick provides for secure key storage and strong encryption in a smart-card chip. The CodeMeter System includes a crack detection, which can lock the license key. Secure Integration Technology: The code and resources of the protected application will never be completely decrypted in the main memory of the PC. Variable encryption, anti-debugging and obfuscation technology as well as tools to individually integrate the source code increase the security level again. The “simple to use” tools from WIBU-SYSTEMS like AxProtector for automatic protection and the IxProtector to individually integrate the source code provide a maximum of protection. These are some of the main advantages of our solution… in addition to the high fl exibility of CodeMeter. 13
Page 1 and 2: FALL 2007 14 COVER STORY Share Your
Page 3 and 4: F U T U R E Scalable DRM Solutions
Page 5 and 6: KNOW-HOW your software is running i
Page 7 and 8: KNOW-HOW HIP - High Level Programmi
Page 9 and 10: P R O D U C T unique cryptographic
Page 11: BILLBOARD Briefly Presented CodeMet
Page 15 and 16: CASE STUDY However such a technolog

Share Your Key - Share Your Costs - wibu-systems ag

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?