Code Confidential

Goldman Sachs Code Theft - Mitigating the Risks

Software Protection is not the panacea for code theft issues like the one that occurred with Goldman Sachs. In fact, this case is very similar to the 2004 insider code theft of Cisco’s IOS code. However, outside of just stronger access control and perimeter security measures, these threats do suggest a closer look at how to securely share valuable IP contained within code in a distributed and rapid software development process.

Although there are few details in terms of the development platform of the application and the exact access the alleged thief had, organizations should consider a few options to mitigate the risk of theft of sensitive IP within code:

• If managed code is involved, protect it - If the development language is managed (Microsoft .NET or Java), code obfuscation and encryption most be used. Even once the applications are compiled, it is only partially compiled into an intermediate language which is easily decompiled into source code representation. Another alternative is to place the sensitive IP into an unmanaged component to minimize exposure.
• Create protected APIs - If the software development process requires the use of outsourced development partners or contractors, create an application programming interface that contains the sensitive IP within compiled application components versus sharing the source. Although this would obviously require additional work by the organization, an API option that uses compiled binaries allow more options to use software protection and harden the API against reverse engineering.
• Embed threat detection and reporting – Add threat detection and reporting mechanisms (sometimes referred to as phone home systems) to the application itself. This approach can be used to continuously test for tampering or installation in unauthorized networks, and if a threat exists, notifies the owning organization in real-time. This presumes that the enterprise application (or in the context of this discussion a protected API) is designed to be deployed within specific networks, data centers or hosting partner networks.

Gartner's Neil MacDonald blogged about this news ("Security No-Brainer #7: If You Have Intellectual Property Embedded in Software, Protect it") and Gartner's "Hype Cycle for Cyberthreats (2006) coined a term for the emergence of software IP threats as enterprise code reverse engineering (“Definition: Enterprise code reverse engineering is reverse engineering of enterprise application
code for the purposes of targeting vulnerabilities or stealing intellectual property.”).

We believe as general perimeter, application, and physical security improves, hackers, foreign governments and competitors will increasingly turn to reverse engineering tactics to access valuable software IP or alter it for malicious purposes. In these threat scenarios software protection and threat detection reporting can play an important role in mitigating these risks.

- Vic

InishTech and Microsoft Software Licensing and Protection Service

Microsoft has finally spun off their Software Licensing and Protection Services (SLPS) technology:

"In a connected world, software developers of all kinds need the ability to protect their code, license their software, and track the performance and profitability of their products. To fill that need, a new Irish company called InishTech is embarking on a worldwide business venture using software protection and licensing technology developed by Microsoft."

This technology was based on an earlier acquisition of Israel based Secure Dimensions SecureLM technology. You can read more about the history of SLPS here. Late last year, Microsoft announced that no new customer orders would be accepted and then we later heard through the grapevine that most of the Microsoft SLPS team would move on. This was part of a larger reduction in force and streamlining effort going at Microsoft. When I spoke with one of the former SLPS product leads in April, he expressed how difficult it was to integrate into the Microsoft ecosystem and in many ways they were like any other independent vendor trying to partner with Microsoft.

From a V.i. Labs perspective, SLPS is a licensing system, and as we do for customers using Acresso, IBM, Nalpeiron, Reprise Software, SafeNet, and Uniloc, we offer value on top of SLPS to protect sensitive IP within .NET applications and provide Piracy Business Intelligence: 

• IP protection - While there is overlap with the SLPS code protection component, CodeArmor Software Protection for .NET offers a more scalable protection for whole assemblies. The SLPS protection technology is best focused on license methods because its virtualization technology is performance intensive.
• Piracy business intelligence – Provides piracy detection and reporting functionality that is embedded within the application operates separately from licensing to help ISV’s recover revenue from unlicensed use.

So I think it's great news that SLPS has a home and can operate independently - software developers/vendors need more options for software licensing for their .NET applications. One thing I hope that improves with the spinoff is the positioning of the solution. Microsoft had marketed this as an anti-piracy solution, a position that I considered not current or accurate. Many of the legacy licensing players have evolved their positioning based on customer reaction and focused their solutions on overuse and compliance.

Essentially, they made sure that their sales people were not positioning licensing as protecting against or combating “overt” piracy – piracy enabled via reverse engineering. SLPS in no different and although their code protection is innovative, it should be positioned as a way to harden the license functions' resistance to tampering and not a solution for stopping piracy.

- Vic

See You at RSA 2009 in San Francisco!

The bus is getting ready to leave for the RSA 2009 Conference in San Francisco next week! We've been busy getting ready and look forward to seeing everyone there.

If you're going to the conference, stop by our booth (#559) to see the new version of CodeArmor Software Protection.

If you're an exhibitor (or other software vendor) you can sign up now for a free piracy assessment at the conference.

Software piracy as a way of spreading malware

Hi, my name is Uri. I'm the new Principal Software Engineer at V.I. Labs.
I was thrilled when I was invited to write on Code Confidential!

I am both a software engineer and a security researcher. I have over 15 years working on different areas of the information security spectrum, such as software engineering, researching reverse engineering proof of concepts, network security, software and hardware hacking, information security research, computer forensics, cyberterrorism and industrial espionage countermeasures.

I wanted to add a little bit of salt to the topic of software piracy.

People crack software for several reasons. The most obvious and often published are:

1- To be able to use a piece of software for free.
2- To make a profit from selling stolen software.
3- To learn how the software works and steal ideas for the competition.

The reasons behind points 1) and 2) are very clear. People want access to software and don't want to pay for it; or at least they don't want to pay the full amount. Pirated software is often available for free on any of the P2P networks or it can be bought for next to nothing in certain "specialized stores".
Point 3) is a bit more complex. Rival companies go through a lot of trouble trying to find the other company's new technology. When speaking about software this usually translates into reverse engineering and other forms of software cracking. The basic idea behind it is to unravel the competition's technology and copy their ideas.

But, we are overlooking the darker side of software cracking.

Crackers working for their own gains or other's (being a rival company, crime organizations or governments) will crack the software protection or licensing technology to use them as a carrier for malware. Malware - or malicious software - can take any form: from a simple annoyance - a nag screen telling you to buy the latest anti-virus - to backdoors that provide malicious hackers working for different "agencies" a simple way to hijack the system and use it for subversive activities - like part of a massive DDOS (Distributed Denial Of Service) attack or to penetrate government sensitive systems.   

Take for example the huge industrial espionage case in 2005 in Israel (http://www.govtech.com/gt/306767 and http://www.haaretz.co.il/hasen/pages/ShArt.jhtml?itemNo=581790&contrassID=Cd=1).

"the industrial espionage was perpetrated using a Trojan horse attached to e-mails and to hacked software, which were then subsequently installed by company employees. With the application in place, they said, information taken from corporate hard drives was sent to FTP servers located around the world. A partial list of the companies that the Trojan horse infiltrated includes the HOT cable TV company, which competes with Yes; Partner, which competes with Pelephone and Cellcom; a competitor of Hamafil in document copying — Tsilumaatik; Hewlett Packard; the Shalmor-Avnon-Amichay and Reuveni-Pridan ad agencies; and the PR agency of Rani Rahav."

The trojan was installed into the systems using two vectors; the first vector was the email, with a little bit of good old fashioned Social Engineering the attackers were able to fool the victims into installing the trojan. The second vector was an embedded version of the trojan. The copy was stealthily added to a cracked version of a music player and a file sharing program.    

Even anti-virus companies are warning their users about this: http://www.theregister.co.uk/2007/10/31/hacking_tools/
"Trend Micro warns that, for example, key generator programs designed to unlawfully activate Nero CD burning software from a trial mode into a paid mode are often packaged with a range of malware.
Nero cracker packages downloaded using P2P networks or via websites hosting illegal software expose users to risks such as the theft of personal or financial information."

These backdoors into the system are very hard to detect; they use stealth technologies such as rootkits (software running at the OS kernel level and thus will full control of the system) for hiding their presence and activities from the OS and the user, and masquerades to appear as a trusted process (either by altering the process binary or by injecting code into the running process) and thus gaining full access to that process' resources.

The backdoors can provide keyboard sniffing services (a keyboard sniffer is a special kind of malware that records the keys as they are being typed by the user, including usernames and passwords), where the data collected is then sent via the internet to a random server waiting for it. The backdoors can use the current system as a way to cover the attacker's real IP address (a technique used when the attacker wants to remain anonymous while hacking another target) while he is stealing the million dollar from the No So Secure Online Bank, Inc., backdoors can also provide the ultimate weapon when trying to steal your enemy's plans for the next war.

Protecting your software against piracy is imperative not only to prevent financial loss but also to prevent all kind of malicious activity that might, at the end of the day, be connected to your name.

- Uri

Demystifying Software Piracy at SoftSummit

So I'm almost live blogging from SoftSummit (note to self: uploading posts with a photo is painfully slow when you're not on the 3G network or wifi).

Vic's presentation was well attended and there were some great questions at the end. I've heard from the folks at SoftSummit that videos of the presentations will be online soon, so I hope to be able to update this post with links in the next few days. .

All in all a very good day with lots of great discussions with people who are on the front lines of the piracy battle.

Live Blogging from SoftSummit 2008

We're at SoftSummit and are going to try doing some live blogging.

If you're here, don't forget to stop by to schedule a free piracy analysis - the schedule is filling up, but we still have some open spots. Just stop by the table and ask.

Vic's session on "Demystifying Software Piracy" is later today at 4:00pm and I hope to be live blogging from there - stay tuned!

Data Loss Prevention and .NET Code - Let us know what you think

We're excited about a webinar we're doing with Charles Kolodgy of IDC this Tuesday, October, 14 on Data Loss Prevention and .NET Code.

It's important to remember to that some of an organization's most valuable data is the intellectual property (IP) contained in their .NET applications. Whether you're an ISV or an enterprise with in-house applications, applications developed for the .NET platform are inherently easy for competitors, hackers, and software pirates to reverse engineer.

While most developers understand this aspect of .NET applications, many folks on the business side of the house still do not realize the risk to IP when releasing .NET applications without any protection.

Vic and Charles will cover this neglected aspect of protecting IP in what we anticipate will be an eye opening discussion. But what do you think? Let us know in the comments if you have any questions you'd like to see answered at the webinar and then log in on Tuesday.

- Michael

Unspoken Security Challenge with Microsoft .NET

When I was reading John Water's RedmondDeveloper article on Sandboxing and .NET it reminded me of the lack of attention to the reverse engineering challenges around using .NET. In the article, the ability to security sandboxing untrusted code within Java and .NET Frameworks was focused on and promoted as something for application provider’s leverage more. However, as vendors and application developers increase their.NET adoption they need to consider the additional risks to their software – piracy, theft, and tampering. In my experience many organizations that have or are in the process of migrating their applications from unmanaged to managed frameworks realize late in the development cycle that their sensitive code can be decompiled easily using .NET.

This is not a Microsoft only issue. The challenges for protecting .NET code from reverse engineering needs to be articulated at the same level as other code security vulnerabilities.

- Vic

Secure Offshore Development

Diana Kelley from Burton Group recently published a great article on what you should consider when outsourcing. She mentions application outsourcing. Normally organizations use NDA and threat of sudits to secure their code when outsourcing. From a security perspective there are ways to enhance protection of your organization’s IP resident within software when using off shore development resources. Rather then just providing source code, you could distribute the really sensitive components in complied form and still allow development around these. Of course if the risk of piracy or competitor access to code is high then software protection technology can be utilized to reduce these risks.

Vic