Share Your Key - Share Your Costs - wibu-systems ag

E V E N T S
Why did Not One of the 1092
Contestants Succeed?
Although the challenge was theoretically solvable,
not one of the contestants could fully
remove the protection. Most of the contestants
fell in the trap of trying to by-pass the intruder
detection and had their license locked in the Cm-
Stick. This resulted in further brute-force attacks
to the encryption. The chance of breaking the
128-bit AES encryption was slim to none. Other
contestants failed to jump other hurdles. But
we did receive some excellent partial solutions
and we awarded those contestants with 500 to
2000 Euro each. Hackers or Crackers go down
different paths than developers and the partial
solutions were important input for us. These
partial winners discovered some weaknesses
in our system which we not seen before. And
the discovery of these weaknesses allowed us
to strengthen our overall security.
The partial solutions included creating memory
dumps and also the attempt to replace the
CmStick with record-playback simulation within
the communication of the protected application
with the CodeMeter runtime. One of these
attacks is described in detail in the renowned
Germany computer magazine “c’t”, 21/2007,
describing the tools used, like IDAPro, ImpRec,
OllyDebug and NetCat. But, this attack did not
provide a completely successful solution to the
Hacker’s Contest: A second function also had
to be decrypted – its license item was already
in the CmStick, but not activated by a single bit.
Since the contest we have added enhancement
to the CodeMeter Runtime Kit – the attack of
the “c’t” is now no longer possible.
Attacking Methods
Attacking Methods and why they don’t work
with CodeMeter:
Memory Dumping: CodeMeter uses
“On Demand Decryption“, this means
there is no time after running the complete
program when code and resources are
completely decrypted in the main memory
of the PC.
Dummy Driver: By using complex
encryption, a simulation of the encryption
by dummy drivers is prohibited, because
there is no limit to the number of answers
for calling a function.
Cracking Tools: Most of the usual
cracking tools will be detected by the
protected application and this detection
1092 Contestants from 27 Countries
Germany 33%
Rest 14%
can be used to lock the license in the
hardware (CmStick), avoiding any further
attacks.
Record-/Playback Driver: The use of
randomly varied encryptions and changing
of the Encryption Code avoids a successful
use of recording and playback for a longer
time range.
Emulation of the CmSticks: The use
of strong encryption (AES) and the use of
secure hardware – a smart-card controller,
make a complete emulation of the hardware
nearly impossible.
Patching of some bytes: With CodeMeter,
protected applications are no longer
using single checkpoints. But large areas
of code and data are encrypted and such
patching is impossible, especially when
the automatic protection offered by AxProtector
is used.
Competition Program
As an example, we show the competition
program below, after the start, loading and
decryption with the correct CmStick, in the
memory of the PC: The green areas are still
encrypted. The resource data areas are always
encrypted and are only partially decrypted on
demand. The IAT (Import Address Table), which
is the connection to the called operating system
remains encrypted as well as the individual
functions – with two in the hacker’s contest. It
is easy to understand that a memory dump will
be not successful.
India 2% Spain 2%
Ukraina 2%
PE Header
Code Section
Data Section
China 18%
France 3%
Bangladesh 3%
Poland 2%
OEP
Resource Section
The Netherlands 4%
Hungary 4%
Link to new OEP
IAT
IAT redirect
Security Section
Security Code IAT
USA 10%
Operating
System
The Bottom Line
We accept that no security system is 100%
secure. But a high level of security can be
reached by:
Secure Hardware: The CmStick provides for
secure key storage and strong encryption
in a smart-card chip. The CodeMeter
System includes a crack detection, which
can lock the license key.
Secure Integration Technology: The code
and resources of the protected application
will never be completely decrypted in the
main memory of the PC. Variable encryption,
anti-debugging and obfuscation
technology as well as tools to individually
integrate the source code increase the
security level again.
The “simple to use” tools from WIBU-SYSTEMS
like AxProtector for automatic protection and
the IxProtector to individually integrate the
source code provide a maximum of protection.
These are some of the main advantages of our
solution… in addition to the high fl exibility of
CodeMeter.
13