Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Can Crack Your App With Just A Shell (And How To Stop Me)

kswizz.com

Post reply on HN
Print view View original

41–50 of 93 posts

Re: I Can Crack Your App With Just A Shell (And How To Stop Me)

#41

Post by EGreg »

I personally like the idea of an application "unlocking" itself every time based on a hash of its binary. You would have to find all the places these hashes are computed -- if you missed even one place, you wouldn't be able to unlock the app.

Of course, such an app could still be cracked -- as could any app... because all you have to do is

1) purchase a legitimate copy and enter a fake name 2) take a snapshot of a working, unlocked app 3) remove all the code that cripples that state

The only way to really prevent cracking of apps that run locally is either challenge-response dongles or requiring people to provide a strongly verified identity in order to unlock the app (that way the cracker can't distribute the app without compromising the identity of the original buyer). And that is just too inconvenient for the actual buyers. Once again, security at the price of convenience.

Re: I Can Crack Your App With Just A Shell (And How To Stop Me)

#43

Post by kennet »

Hey SeoxyS,

Another fan of your writings. I like the occasional quote you throw in there. However:

I don't agree with the way you phrased your headings. Verging on linkbait, even.

RCE is a hobby of mine and I crack all sorts of shit; it's fun and challenging. I know quite a few people who do.

This is the first time I have read such a blunt "I can crack your..."/"How to stop me" approach. It sounded very arrogant at first. No one else that I know bothers with this direct attitude. I am sure Mac devs are more than aware (Anticipating an article on this as a followup to your post).

"[...] but implementing a bare minimum of security will weed out 99% of amateurs. [...]"

I am not sure where you pulled that number from but it's false. RCE is not as difficult as you make it out to be, and amateurs can overcome the usual barriers quickly. Communities thrive on teaching amateurs the art, and they pick up these skills very quickly. I taught a few.

Re: I Can Crack Your App With Just A Shell (And How To Stop Me)

#44

Post by pygy_ »

eps wrote: post #29
TheAmazingIdiot wrote: post #6

Gah, this is your standard 2 byte change_je_to_jne. Perhaps, to people who program in higher languages this is not evident, but old assembly programmers know this stuff well. Even for the newer ASM programmers, we had Fravia+ (may he rest in peace) to teach us the ropes on reverse engineering and unprotecting 'nasty' code. And those students of Fravia+ know something well: if it is viewable, executable, listenable on…

Fravia materials are great, but they are outdated. Techniques are still valid, but the users have changed. Perhaps Mac users are still naive and ignorant when it comes to running random stuff on their machines, but on the Windows side anti-virus companies were fairly successful in educating people on this matter. Scaremongering works :) So signed executable + few simple validity checks + a couple of well-hidden timeb…

Subtly crippling the app may not be the wisest move, unless you make it obvious that it happens because the crack has been detected.

Otherwise, the pirates will get the impression that your program is buggy and will look at alternatives rather than opening their wallet.

And still... Even if you announce that the crack has been discovered before crippling, you may upset them and send them to your rivals anyway.

==> Potential good word of mouth replaced by bad one.

You may improve your "conversion" rate by being implicitly nice rather than hostile to pirates. Don't clamor it on the roofs, of course, there's no need to incite your paying customers to pirate.

Wait... Do clamor the lack of DRM! Protected programs are often more cumbersome to use than their pirated counterparts. This is especially true for music, movies and video games where drastic copy protection measure are taken. Punishing your customers for paying you is not a good idea (unless you hold a monopoly but it is probably not sustainable).

Re: I Can Crack Your App With Just A Shell (And How To Stop Me)

#45

Post by Someone »

jmillikin wrote: post #23

Near the end of the article, the author mentions that storing a digest of the binary is an effective means of protection. I've heard this before, but I've never understood how it works. There's two ways I can think of: One is it just builds the binary, runs it through SHA1 (or whatever), and stores that digest somewhere in the installation directory. But what's stopping attackers from just changing the digest? They h…

They have access to the application, so they can know exactly how to generate the digest

Traditionally, the way of doing this is by making that 'can know' step very difficult. Techniques to accomplish that include refusing to run under a debugger, multiple layers of protection, self-modifying code, loading the digest code from disk block checksums, from between tracks on a floppy disk or from blocks marked bad (back in the day when there weren't that many layers between application code and hardware), etc.

A lock does not have to be unbreakable; it just has to make breaking it costly enough to discourage even attempting breaking it.

With hackers, though, that does not quite work. They see even attempting to break the lock as enough of a reward in itself.

Re: I Can Crack Your App With Just A Shell (And How To Stop Me)

#46

Post by muppetman »

snorkel wrote: post #20

The most stealth cracking countermeasure I ever witnessed was the application would XOR some of its UI messages with the hash sig of the application binary file, so if you edited the application binary file directly the crack seemed to work just fine ... but then the application would gradually go insane. The cracker who finally posted a working crack was impressed with how simple and devious the countermeasures were…

Forgive my numbness, but how does this work? How do you know the right signature to be verifying against? It seems (to my not-much-of-a-programmer mind) that you've got a chicken and egg scenario here.

But that's obviously not the case, so you can explain briefly how it works? Or just paste a link.

Thanks!

Re: I Can Crack Your App With Just A Shell (And How To Stop Me)

#47

Post by moopark »

The fact that most simple copy protection can be broken by someone that knows a bit of assembly shouldn't surprise anyone writing applications, and this post is just self-congratulatory silliness that doesn't actually help someone that wants to protect their software.

It wouldn't be any more responsible/ethical/useful of me to post a "I Can Crack Your Non-Mac App With Just A Copy Of IDA Pro and HexRays" tutorial. I could show you how I can press 'F5' and decompile your code back to surprisingly readable pseudo-C, but that's not going to help you secure your application, it's just patting myself on the back and showing you how cool I am.

On top of that, the author is still flogging the PT_DENY_ATTACH horse, despite the fact that it's been documented over, and over, and over again as trivial to bypass. PT_DENY_ATTACH was added to meet the minimal contractual requirements Apple had to movie studios and record companies by preventing users from attaching a debugger to DVD Player and iTunes. It's not a real security solution. There's a simple open source kext (that was first implemented for Mac OS X 10.3!) that simply disables it across the board:

https://github.com/dwalters/pt_deny_attach

Re: I Can Crack Your App With Just A Shell (And How To Stop Me)

#48

Post by moopark »

jmillikin wrote: post #23

Near the end of the article, the author mentions that storing a digest of the binary is an effective means of protection. I've heard this before, but I've never understood how it works. There's two ways I can think of: One is it just builds the binary, runs it through SHA1 (or whatever), and stores that digest somewhere in the installation directory. But what's stopping attackers from just changing the digest? They h…

When Mac OS X updates the signature on a binary (for instance, when you configure a firewall rule for a previously unsigned binary), the actual Mach-O file will be changed -- and your digest will be incorrect.

Skype (which has notoriously complex obfuscation) had this problem for a short time when Mac OS X 10.5 was released:

http://securosis.com/blog/leopard-firewall-code-signing-brea...

You can work around this by validating only the important subset of the Mach-O contents, but it's probably not worth it. Cracked applications (rather than, say, reverse engineered serial number generators) are an annoying thing to use -- you'll have to refrain from applying updates until you get a new crack, trust the person distributing the crack, etc.

It's not something I (or, afaik, most other small Mac developers) really worry about.

Re: I Can Crack Your App With Just A Shell (And How To Stop Me)

#49

Post by malnourish »

pygy_ wrote: post #44
eps wrote: post #29

Earlier quoted context omitted.

Fravia materials are great, but they are outdated. Techniques are still valid, but the users have changed. Perhaps Mac users are still naive and ignorant when it comes to running random stuff on their machines, but on the Windows side anti-virus companies were fairly successful in educating people on this matter. Scaremongering works :) So signed executable + few simple validity checks + a couple of well-hidden timeb…

Subtly crippling the app may not be the wisest move, unless you make it obvious that it happens because the crack has been detected. Otherwise, the pirates will get the impression that your program is buggy and will look at alternatives rather than opening their wallet. And still... Even if you announce that the crack has been discovered before crippling, you may upset them and send them to your rivals anyway. ==> Po…

You bring some valid points. As long as we don't go back to the nag-screens of shareware, I'm excited to see conversion attempts made in novel ways.

If a product is of value to me I will indeed pay for it, if I can connect to the developers, I will pay even more. That's where choose your own price really gets me, I often pay more than typical.

However it isn't true across the board.

Regardless, I have read that many companies which experience vast piracy of their products, e.g. Adobe, make much of their revenue from other businesses. Is this true?

Re: I Can Crack Your App With Just A Shell (And How To Stop Me)

#50

Post by jbri »

ugh wrote: post #38
jbri wrote: post #5

Earlier quoted context omitted.

The challenge then is to write a script that automates the cracking.

But does that actually matter? As far as I can see, it’s already easy to pirate any app you want. All you need is Google. I’m suspicious that super secure DRM really stops people from pirating, especially when considering something non-essential with many (maybe worse but often free or more easily piratable) substitutes. Super secure DRM might be more effective with something really unique you really cannot get any o…

I would actually lean the other way. If your system is far more secure than another identical system, people are less likely to bother targeting your application when they break open the other one much more easily.

It's only when you bring something unique or "better" to the table that you make it worth spending significant amounts of effort on breaking.

Post reply on HN