Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

It is possible for virtual machine guests to bypass the software expiration timers for paid software. This example shows one way to do this on VMWare. A simpler method is for the user to "revert to snapshot".

How can a software publisher still protect their content and enforce the expiration of the software installed on virtual machines? What can be done to maintain the state of elapsed time in spite of attempts by the user to modify the system time?

share|improve this question

DRM is a notoriously difficult problem to solve. One should always assume that whatever code is in the hands of an uncontrolled client can never be fully protected.

One solution to the simple "rollback snapshot" bypass will be to have the client "dial home" to a server once in a while. Another good method can be to tie the license key to a user account and have the user authenticate whenever he wants to use the software.

However, this can still be bypassed by reverse engineering the binary and removing the portion of code that dials home. This is an unavoidable problem unless you want to host the bulk of the application on your servers and simply let the client be a "dumb client" that displays whatever the server tells it to. If this is acceptable to you, you might want to looking into providing a SaaS business model.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.