Code Confidential

Goldman Sachs Code Theft - Mitigating the Risks

Software Protection is not the panacea for code theft issues like the one that occurred with Goldman Sachs. In fact, this case is very similar to the 2004 insider code theft of Cisco’s IOS code. However, outside of just stronger access control and perimeter security measures, these threats do suggest a closer look at how to securely share valuable IP contained within code in a distributed and rapid software development process.

Although there are few details in terms of the development platform of the application and the exact access the alleged thief had, organizations should consider a few options to mitigate the risk of theft of sensitive IP within code:

• If managed code is involved, protect it - If the development language is managed (Microsoft .NET or Java), code obfuscation and encryption most be used. Even once the applications are compiled, it is only partially compiled into an intermediate language which is easily decompiled into source code representation. Another alternative is to place the sensitive IP into an unmanaged component to minimize exposure.
• Create protected APIs - If the software development process requires the use of outsourced development partners or contractors, create an application programming interface that contains the sensitive IP within compiled application components versus sharing the source. Although this would obviously require additional work by the organization, an API option that uses compiled binaries allow more options to use software protection and harden the API against reverse engineering.
• Embed threat detection and reporting – Add threat detection and reporting mechanisms (sometimes referred to as phone home systems) to the application itself. This approach can be used to continuously test for tampering or installation in unauthorized networks, and if a threat exists, notifies the owning organization in real-time. This presumes that the enterprise application (or in the context of this discussion a protected API) is designed to be deployed within specific networks, data centers or hosting partner networks.

Gartner's Neil MacDonald blogged about this news ("Security No-Brainer #7: If You Have Intellectual Property Embedded in Software, Protect it") and Gartner's "Hype Cycle for Cyberthreats (2006) coined a term for the emergence of software IP threats as enterprise code reverse engineering (“Definition: Enterprise code reverse engineering is reverse engineering of enterprise application
code for the purposes of targeting vulnerabilities or stealing intellectual property.”).

We believe as general perimeter, application, and physical security improves, hackers, foreign governments and competitors will increasingly turn to reverse engineering tactics to access valuable software IP or alter it for malicious purposes. In these threat scenarios software protection and threat detection reporting can play an important role in mitigating these risks.

- Vic

Latest Spam uses Yahoo! Profiles and Cheap Software prices to Capture Credit Card Data

For the last month (at least from my inbox perspective) spammers have been using the Yahoo! personal profile interface to send spam with cheap software offers (see image 1).

Image 1: Email with Yahoo profile reference (click to enlarge)

The ploy attempts redirect users to an authentic looking web site offer software at prices too good to be true (image 2). The IP address of the site can tracked to an IP address assigned in China and hosted on a server that includes over 400 other gambling and software commerce sites.

Image 2: Homepage of Web site offering to sell pirated software (click to enlarge)

Further navigation of the site reveals a checkout form with all the right images to lure the unsuspecting user to enter their credit card information and buy low priced software.  However, it should be obvious to most users who purchase anything on the Web that this site is a scheme to grab credit card data.  Although a secure connection symbol is shown, the form itself asks for credit card information over a non-SSL session. Also, the BBBOnline program (which no longer is operational) VISA, and TRUSTe seals do not provide a link for verification (image 3).

Image 3: Checkout form on false commerce site (click to enlarge)

I would hope that it is completely obvious to users with some internet experience that they should not trust this site or the method used to arrive at the site. However, given that it is relatively cheap to host hundreds of these sites using virtual servers and leverage Yahoo! to promote them, it probably only takes one uninformed user to justify this criminal approach.

- Vic

Wall Street Journal: Firm Alleges Code Theft in Web Filter

This article in the Wall Street Journal illustrates the paradox that exists with doing business in China. On the one hand, their weak enforcement of intellectual property (IP) rights has resulted in high piracy rates for years with numerous examples of reverse engineering cases, but on the other hand, China is a tremendous business opportunity for U.S. software vendors that cannot be ignored.

 The numbers illustrate these issue:

• There are an estimated 15,000 software vendors in China
• China graduates more than 100,000 programmers each year (NPR)
• Packaged software revenues in China are expected to exceed $9B (Gartner)

Software developers and vendors should be worried about their software IP in China. Software protection or tracking usage through piracy business intelligence approaches may give vendors a way to proceed with caution when there is valuable software IP at stake.

- Vic

InishTech and Microsoft Software Licensing and Protection Service

Microsoft has finally spun off their Software Licensing and Protection Services (SLPS) technology:

"In a connected world, software developers of all kinds need the ability to protect their code, license their software, and track the performance and profitability of their products. To fill that need, a new Irish company called InishTech is embarking on a worldwide business venture using software protection and licensing technology developed by Microsoft."

This technology was based on an earlier acquisition of Israel based Secure Dimensions SecureLM technology. You can read more about the history of SLPS here. Late last year, Microsoft announced that no new customer orders would be accepted and then we later heard through the grapevine that most of the Microsoft SLPS team would move on. This was part of a larger reduction in force and streamlining effort going at Microsoft. When I spoke with one of the former SLPS product leads in April, he expressed how difficult it was to integrate into the Microsoft ecosystem and in many ways they were like any other independent vendor trying to partner with Microsoft.

From a V.i. Labs perspective, SLPS is a licensing system, and as we do for customers using Acresso, IBM, Nalpeiron, Reprise Software, SafeNet, and Uniloc, we offer value on top of SLPS to protect sensitive IP within .NET applications and provide Piracy Business Intelligence: 

• IP protection - While there is overlap with the SLPS code protection component, CodeArmor Software Protection for .NET offers a more scalable protection for whole assemblies. The SLPS protection technology is best focused on license methods because its virtualization technology is performance intensive.
• Piracy business intelligence – Provides piracy detection and reporting functionality that is embedded within the application operates separately from licensing to help ISV’s recover revenue from unlicensed use.

So I think it's great news that SLPS has a home and can operate independently - software developers/vendors need more options for software licensing for their .NET applications. One thing I hope that improves with the spinoff is the positioning of the solution. Microsoft had marketed this as an anti-piracy solution, a position that I considered not current or accurate. Many of the legacy licensing players have evolved their positioning based on customer reaction and focused their solutions on overuse and compliance.

Essentially, they made sure that their sales people were not positioning licensing as protecting against or combating “overt” piracy – piracy enabled via reverse engineering. SLPS in no different and although their code protection is innovative, it should be positioned as a way to harden the license functions' resistance to tampering and not a solution for stopping piracy.

- Vic

Software piracy as a way of spreading malware

Hi, my name is Uri. I'm the new Principal Software Engineer at V.I. Labs.
I was thrilled when I was invited to write on Code Confidential!

I am both a software engineer and a security researcher. I have over 15 years working on different areas of the information security spectrum, such as software engineering, researching reverse engineering proof of concepts, network security, software and hardware hacking, information security research, computer forensics, cyberterrorism and industrial espionage countermeasures.

I wanted to add a little bit of salt to the topic of software piracy.

People crack software for several reasons. The most obvious and often published are:

1- To be able to use a piece of software for free.
2- To make a profit from selling stolen software.
3- To learn how the software works and steal ideas for the competition.

The reasons behind points 1) and 2) are very clear. People want access to software and don't want to pay for it; or at least they don't want to pay the full amount. Pirated software is often available for free on any of the P2P networks or it can be bought for next to nothing in certain "specialized stores".
Point 3) is a bit more complex. Rival companies go through a lot of trouble trying to find the other company's new technology. When speaking about software this usually translates into reverse engineering and other forms of software cracking. The basic idea behind it is to unravel the competition's technology and copy their ideas.

But, we are overlooking the darker side of software cracking.

Crackers working for their own gains or other's (being a rival company, crime organizations or governments) will crack the software protection or licensing technology to use them as a carrier for malware. Malware - or malicious software - can take any form: from a simple annoyance - a nag screen telling you to buy the latest anti-virus - to backdoors that provide malicious hackers working for different "agencies" a simple way to hijack the system and use it for subversive activities - like part of a massive DDOS (Distributed Denial Of Service) attack or to penetrate government sensitive systems.   

Take for example the huge industrial espionage case in 2005 in Israel (http://www.govtech.com/gt/306767 and http://www.haaretz.co.il/hasen/pages/ShArt.jhtml?itemNo=581790&contrassID=Cd=1).

"the industrial espionage was perpetrated using a Trojan horse attached to e-mails and to hacked software, which were then subsequently installed by company employees. With the application in place, they said, information taken from corporate hard drives was sent to FTP servers located around the world. A partial list of the companies that the Trojan horse infiltrated includes the HOT cable TV company, which competes with Yes; Partner, which competes with Pelephone and Cellcom; a competitor of Hamafil in document copying — Tsilumaatik; Hewlett Packard; the Shalmor-Avnon-Amichay and Reuveni-Pridan ad agencies; and the PR agency of Rani Rahav."

The trojan was installed into the systems using two vectors; the first vector was the email, with a little bit of good old fashioned Social Engineering the attackers were able to fool the victims into installing the trojan. The second vector was an embedded version of the trojan. The copy was stealthily added to a cracked version of a music player and a file sharing program.    

Even anti-virus companies are warning their users about this: http://www.theregister.co.uk/2007/10/31/hacking_tools/
"Trend Micro warns that, for example, key generator programs designed to unlawfully activate Nero CD burning software from a trial mode into a paid mode are often packaged with a range of malware.
Nero cracker packages downloaded using P2P networks or via websites hosting illegal software expose users to risks such as the theft of personal or financial information."

These backdoors into the system are very hard to detect; they use stealth technologies such as rootkits (software running at the OS kernel level and thus will full control of the system) for hiding their presence and activities from the OS and the user, and masquerades to appear as a trusted process (either by altering the process binary or by injecting code into the running process) and thus gaining full access to that process' resources.

The backdoors can provide keyboard sniffing services (a keyboard sniffer is a special kind of malware that records the keys as they are being typed by the user, including usernames and passwords), where the data collected is then sent via the internet to a random server waiting for it. The backdoors can use the current system as a way to cover the attacker's real IP address (a technique used when the attacker wants to remain anonymous while hacking another target) while he is stealing the million dollar from the No So Secure Online Bank, Inc., backdoors can also provide the ultimate weapon when trying to steal your enemy's plans for the next war.

Protecting your software against piracy is imperative not only to prevent financial loss but also to prevent all kind of malicious activity that might, at the end of the day, be connected to your name.

- Uri

Demystifying Software Piracy at SoftSummit

So I'm almost live blogging from SoftSummit (note to self: uploading posts with a photo is painfully slow when you're not on the 3G network or wifi).

Vic's presentation was well attended and there were some great questions at the end. I've heard from the folks at SoftSummit that videos of the presentations will be online soon, so I hope to be able to update this post with links in the next few days. .

All in all a very good day with lots of great discussions with people who are on the front lines of the piracy battle.

Live Blogging from SoftSummit 2008

We're at SoftSummit and are going to try doing some live blogging.

If you're here, don't forget to stop by to schedule a free piracy analysis - the schedule is filling up, but we still have some open spots. Just stop by the table and ask.

Vic's session on "Demystifying Software Piracy" is later today at 4:00pm and I hope to be live blogging from there - stay tuned!

Is Encryption the Answer for POS Systems?

A recent Computer World article discussed a new encryption approach announced by Verifone to protect customer data transmitted from Point of Sale (POS) terminals. Of course encryption is useful, but the attack vector used in the Dave & Buster's restaurant chain breach involved two hackers who gained remote access to the POS servers and installed packet sniffing software.

Although encryption will close an easy access point, if it's implemented in software without additional code protection, then the hackers can hook or subvert the application prior to encryption or reverse engineer the keys themselves. Verifone may have considered this given that their announcement mentions "tamper resistant modules."

-Vic

Compass Bank Data Breach

A insider breach was reported at Compass Bank, see "Insider theft case at Compass Bank affected more than 1M customers". According to Compass Bank Web site, they have 420 full-service banking centers. Securing branch banking centers is an immense challenge for protecting customer data and financial applications. Branch banks may not have the security expertise and sophistication of larger institutions yet host sensitive applications.

-Vic

Security is a differentiator: Refreshing change for the software security industry

As a software security professional, it is a good thing that end users of security technology are beginning to position it as a differentiator in their own offerings. The security industry in general has had to produce subjective ROI or sell fear to support it sales. Application and data integrity will becomes increasingly important especially on the heels of a record setting year of breaches (CIO Today) . The way in which application providers add security  to their products and services will be viewed as a differentiator. This not only true of enterprises, but with traditional software application vendors. Some examples of this trend are:

- Recent article, "Banks Using Security to Increase Customer Trust and Their Bottom Lines "

- Time Warner and others choosing Blue-Ray DVD format over HD DVD partly based on the better DRM controls, AACS.

-Vic