Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

It's a topic that interests everyone. How can I protect my software against stealing, hacking, reverse engineering?

I was thinking: Do my best to protect the program for reverse engineering. Then people will crack it and seed it with torrents. Then I download my own cracked software with a torrent with my own torrent-software. My own torrent-software has then to seed incorrect data (bytes). Of course it has to seed critical bytes.

So people who want to steal my software download my wrong bytes. Just those bytes that are important to startup, saving and loading data, etc... So if the stealer download from me (and seed it later) the stealer can't do anything with it, because it is broken.

Is this idea relevant? Maybe, good torrent-clients check hashes from more peers to check if the packages (containing my broken bytes) I want to seed are correct or not?

share|improve this question

migrated from stackoverflow.com Jun 11 '10 at 0:10

This question came from our site for professional and enthusiast programmers.

3  
I've read the RIAA has already done this for music files. –  Amardeep Jun 9 '10 at 15:17
26  
you are wasting your time, you aren't losing any money from thieves, by definition they would never buy your software to begin with. –  Jarrod Roberson Jun 9 '10 at 15:20
27  
Discarding the fact that it wouldn't work due to CRC checks etc, I'd suggest that it might be a bad idea for another reason. The people who steal the software probably won't pay for it anyway, but if it doesn't work they might tell their friends or bosses that your software is bad quality so that they don't buy it either. –  ho1 Jun 9 '10 at 15:25
9  
In most cases, a pirated copy is not a lost sale. –  baultista Jun 9 '10 at 15:58
13  
Whatever you do, make sure you don't make it hard for paying customers to use your software –  user6863 Jun 9 '10 at 17:00
show 5 more comments

6 Answers

up vote 42 down vote accepted

Their torrent app (the pirates) will simply discard the bytes you are seeding as bad due to CRC checks. Then you will get banned by that IP for being a repeat offender.

share|improve this answer
    
What CRC does bit torrent use? Could a garbage packet be generated that had the correct CRC? There are apps to do this for MD5 and I'm sure a true CRC would be just as easy. –  deft_code Jun 9 '10 at 16:10
15  
It could be generated, in theory; however, the BitTorrent protocol uses SHA-1 hashing; it is harder to find hash collisions (which is what we're after, here) in SHA-1 than in MD5. Practically, it's not feasible at present. –  Piskvor Jun 9 '10 at 16:21
    
@Caspin In essence, no. It would take at least a week under ideal, conditions, a really fast computer (super computer), and a team of cryptographers to break the CRC hash for a single file. Good luck with that. –  Evan Plaice Jun 15 '10 at 9:15
add comment

bittorent and most other good p2p software protects itself from such kind manipulation by using file hashes, e.g. md5.

share|improve this answer
1  
The hashing algorithm is SHA-1, according to Wikipedia: en.wikipedia.org/wiki/… - slightly safer than MD5 –  Piskvor Jun 9 '10 at 16:23
add comment

I'd suggest to approach the problem from the other end. Embed a unique identification code into each copy of your software that you give to your clients. In case somebody is seeding, you can at least identify who did it and take legal actions.

share|improve this answer
5  
Only if they can find it. –  user12925 Jun 9 '10 at 15:23
2  
@Developer Art: If they have access to multiple copies of the software, they may be able to do binary comparisons to figure out how exactly the copies differ from each other and where they differ, so unless you set up a way for the parts of the identifier to be obfuscated in a random fashion it might not be that hard to figure it out. –  JAB Jun 9 '10 at 15:27
2  
It's not done with a single variable. You could spread the information around all modules of your app, pretending as though you're really using it for some purposes. It's somewhat art how to make it unobtrusive to prying eyes. Maybe ask a separate question about techniques to achieve that. Would be interesting. –  user12925 Jun 9 '10 at 15:28
18  
You can check different builds for whether the mark is optimized away or no. But so can the users! In fact, no professional cracker uploads stuff without first obtaining several copies and comparing them, because they want to protect their sources. In the end, you are fighting against windmills; much better to spend the effort on writing great software, which encourages users to pay you, than on stopying the copying, which just encourages them to try harder not to pay. –  Kilian Foth Jun 9 '10 at 15:30
2  
You're fighting an uphill battle. Whatever your encryption/password scheme is, chances are, the cracker organisations have seen it and know how to break it. They have years of experience and much better programmers than you do. Sorry. –  Evan Plaice Jun 15 '10 at 9:18
show 5 more comments

t's a topic that everyone interests. How can I protect my software against stealing, hacking, reverse engineering?

The only way (I can think of) to do it is to run software completely on your server, and have no useful code in client application - because if you can't get it, you can't (easily) crack it. This way you'll have control over accounts and you'll know who uses your application. Users won't be happy, though. And if you'll only run copy-protection-related code on your server, someone will hack it by writing server emulator OR they'll identify code and bypass protection completely. As it happened with new Ubisoft copy-protection scheme.

Keeping software on server isn't completely bulletproof. Instead of cracking the software, someone will start attacking your server in order to break in and to get software. And there is always "social engineering" security holes. "keep everything on server" will work best if your software cannot be run on normal machine (i.e. it requires supercomputer or computer cluster). A good example of this is EVE Online - unlike WOW and Lineage there are no server emulators I know of, because it requires computer cluster to run the server.

My own torrent-software has then to seed incorrect data (bytes). Of course it has to seed critical bytes.

  1. If you'll try to "hijack" existing torrent, any sane client will report CRC errors and ignore your client. All p2p software uses hashes.
  2. If you upload "wrong" torrent, another user will report your torrent as fake, so no one will download it.

stealer

"Pirate", because it is called copyright infringement.

share|improve this answer
add comment

Q. Can I protect my software by sending wrong bytes?
A. No, it can be hacked around anyway, especially if someone gets their hands on a legit copy.

Q. How can I protect my software against stealing, hacking, reverse engineering?
A. Sell it for a fair price, this will undermine attempts to hack.

share|improve this answer
    
See plagiarismtoday.com/2010/05/26/… for point 2. Pirates pirate. Better software won't help you. –  Paul Nathan Jun 9 '10 at 17:07
1  
@Paul: There are a lot of people who don't pirate. There are many people who refuse to pay. But there are also some people who are more willing to pay for something if it's offered for a lower price than a higher one. Those are the people who would be affected by a lower price. (Though you wouldn't want to price it too low, I suppose.) –  JAB Jun 9 '10 at 19:21
add comment

Does DRM work? No. Does setting up bad BitTorrent/EDonkey2000 stuff work? No. Does anyone care about pirating your little application? No. Nobody has ever heard of it.

share|improve this answer
    
"Nobody has ever heard of it." This is a good point... –  SigTerm Jun 9 '10 at 18:06
    
If someone is willing to pirate it, then it is worth protecting. –  Ben313 Jun 9 '10 at 18:39
1  
@Ben313: a better phrase would be "If someone is willing to buy it, then it is worth protecting." –  JAB Jun 9 '10 at 19:23
1  
Unless you wrote something better than AutoCad, MS Word, etc, your software is even less worth protecting than the other people (Microsoft, AutoDesk) who have 100 smarter people working for them, than you (a single developer) have, and still they have not built a DRM that works. –  Warren P Jun 10 '10 at 15:42
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.