Keygens, Protection, Encryption Panel Software Protection Methods SIC 2003 - PowerPoint PPT Presentation

About This Presentation
Title:

Keygens, Protection, Encryption Panel Software Protection Methods SIC 2003

Description:

Strong encryption helps - but a dedicated, skilled cracker can eventually get in. ... 4,500 visits to my 'naughty pirate' since blacklisting in May. ... – PowerPoint PPT presentation

Number of Views:68
Avg rating:3.0/5.0
Slides: 12
Provided by: christh5
Category:

less

Transcript and Presenter's Notes

Title: Keygens, Protection, Encryption Panel Software Protection Methods SIC 2003


1
Keygens, Protection, Encryption PanelSoftware
Protection Methods (SIC 2003)
  • Chris Thornton
  • Thornsoft Development, Inc.
  • chris_at_thornsoft.com
  • www.thornsoft.com/sic.htm

2
Anti-Piracy Concerns
  • The crackers will still crack you. Thats just
    the way it is.
  • Strong encryption helps - but a dedicated,
    skilled cracker can eventually get in. (We used
    to be cracked within days of a new release - now
    its months.)
  • Use secondary defenses (integration) with any
    wrapped solution.
  • With strong encryption, expect to see more CC
    fraud, and keys passed around on the net.

3
Strategy
  • Use blacklisting to lock out stolen keys.
  • Use Partial Key Verification to detect forged
    keys. (Absolutely necessary if you dont use
    strong encryption.)
  • In both cases, dont simply quit the program.
    Youve got a potential customer here - try to
    sell them.
  • Goal Make the crack experience less enjoyable.

4
Blacklisting
5
Piracy Marketing
  • DaRkAnGeL appears in 4 threads on usenet.
  • 4,500 visits to my naughty pirate since
    blacklisting in May.
  • We tracked 96 of those visits to the order page,
    using cookies.
  • We answered 26 how do I get around the piracy
    message to enter my new key? requests by e-mail,
    and 20 more by phone.
  • The error 411 page is currently ranked 8 out of
    our about 90 FAQ pages, with 460 hits.

6
Partial Key Verification
  • Dont give the cracker enough information to
    build a complete key.
  • They can only build a keygen against what they
    see in the program. So, leave some of the checks
    out, and add them back into future releases.
  • Each release only checks part of the key (Details
    on next slide)
  • Each release of your software requires crackers
    to make a new keygen.
  • Users arent impacted, as their keys have all
    correct digits.

7
Example of obsolete keygen.
8
The Mechanics
  • I use If SampleKey UserKey then
    RegisteredTrue algorithm. (standard stuff)
  • To generate the SampleKey, first, I generate 10
    decoy digits, from the users name.
  • Ex for i 0 to 9 do RegKeyi
    (Ord(CleanStringi) 2) Mod 10
  • Then, in the positions that Im actually
    checking, I overwrite the decoys with digits
    generated by the actual algorithm, leaving decoys
    in the unchecked digits.
  • Ex RegKey7 ((Ord(CleanString1)3) -
    Ord(CleanString4)) Mod 10

9
Mechanics (cont)
  • In the previous example, the middle 5 digits are
    not checked. I dont check the decoys.
  • In the next release, Ill add another digit, and
    take one more away. Forged keys can now be
    detected.
  • Forged keys launch an URL to our error 511
    page, which logs their IP address, the name/key
    that was used, and the date/time.
  • But my customers keys, generated with all
    correct digits, will be just fine.

10
PKV with Strong Encryption
  • Strong encryption (RSA, Armadillo, ASProtect,
    etc.) usually encrypts some information about the
    user, hardware, etc.
  • Add another layer inside, so that in case the
    main gate is breached, you still have your
    secondary key within a key to use with PKV.
    Like an onion.

11
PKV Example
  • my_pkv(chris thornton) 10011101
  • Encrypt (chris thornton 10011101) with
    strong encryption (RSA, ARM, ASProtect, etc.)
  • In the program, you have the whole 10011101
    sequence - but only check a couple of the digits.
  • Next version, check another digit. Now youve
    got PKV within a stronger package, and the
    cracker can never build a complete keygen without
    a crystal ball.
Write a Comment
User Comments (0)
About PowerShow.com