We are currently developing a software that is supposed to run on every computer of a world wide company which has many domains. We are thinking about security as we want the software to be used only on a company computer.

A particular remark is that we don't want any online security measure, as the software may be run offline only.

Thinking about serial key is nearly useless as a client who leaves the company may take with him the software (with an already validated serial key) with him and use it in another context.

We thought about checking certificate issuer for a specific certificate in the store each time the software is launched (as for all computers of the company, this specific certificate issuer will be the company name). However, using a fake certificate issuer from a non-company computer will also work...

We know that there is no perfect solution, but we just want the most effective solution.

Thanks !

  • 3
    Use a hardware token which need to be present for the software to run. That's what many expensive commercial software did before it got common to check online all the time. See en.wikipedia.org/wiki/Software_protection_dongle. – Steffen Ullrich Feb 10 '17 at 15:04
  • Thanks, indeed this solution perfectly meets our desires in term of security. Alternatively, do you know a cheaper solution? – Duke Nukem Feb 10 '17 at 15:10
  • Short answer: nothing, as long as the protection is within the software it can be circumvented at a point, being a physical token, a serial key, a certificate or whatever, it's just a matter of finding where to patch the binary to break the validation method. Of course a physical device is harder to copy/share, but that's all. – Tensibai Feb 10 '17 at 15:11
  • Can the software or the machine it runs on make occasional connections to a company network (say every other week) or does it exclusively work in non-networked environments? – Pascal Feb 10 '17 at 16:22
  • Yes, I know that there is no ideal solution. @Pascal It exclusively work in non-networked environments. – Duke Nukem Feb 10 '17 at 16:47
up vote 2 down vote accepted

With hardware, a TPM or hardware security token would be a possible solution, provided that an employee couldn't simply take it with him when he left the company (e.g. a TPM that was part of the processor, or soldered onto the mainboard)

If you want to work only in software and you can't connect to a network, the only way I see is some kind of serial numbers which expire. Let's say that you require the user of the software to enter a serial number. The software then stores the date at which the serial number was entered and works until two weeks later, when the next valid serial number must be entered. If the user deletes the file that stores the date, you require immediate entry of a new serial number. You'll have to consider that a user could reset the date on his computer to avoid having to enter a new serial number, so you'll have to protect your software against that (e.g. make sure that every time you start the application, time has moved forward from the last time you started it, make sure time doesn't move forward in steps that are too small, etc). This is hard and won't ever be foolproof, but should give you some protection, e.g. raise the bar a bit for thiefs.

As Tensibai said in his comment, ultimately this is all pointless, because if there is enough motivation, someone will circumvent all the safeguards you put in place to keep your software from being stolen, and once that's done, it'll probably be downloadable from somewhere on the internet like every other piece of software that does something worthwile.

Maybe a better solution to your problem would be to make it more attractive for the majority of possible thiefs to pay you to legally use the software?

First of all, there is no way to do this in a manner that is invulnerable to someone who knows how to use a debugger and modify your program's behavior. There are some basic mitigations you can do, for example checking to see if a debugger is running and shutting down if it is. But there are ways around that, too, if the hacker is determined. You can program the most fancy validation check in the world, but a hacker can just delete that part of the code. This is true of network-based verification schemes too, by the way.

That being said, if you are looking for a modicum of protection against the software moving to unauthorized boxes, you can use a mechanism like this:

  1. Create a flat file that only you can edit and only your program can read (e.g. by using encryption).

  2. When a company wishes to install the software on a computer, ask them to provide the CPU serial number, MAC address, or other immutable data item from the host machine. You might even add a feature to your program that will generate this for them and put it in a .txt file so they can attach it to an email. Call this a "machine signature."

  3. Back at your home office, add the machine signature to the file. The file can contain several delimited records if you need to support more than one machine. Send the file to the customer to drop into your program's root folder on each machine where it is authorized to run.

  4. When the program starts, decrypt the file and check each machine signature in the file against the current hardware environment. If a match is not found, shut down.

Naturally, a determined hacker can find the part of your program that checks the file and replace it with bytes that don't check anything (this would be easier than cracking the crypto). But if you're OK with that, the above mechanism will work.

  • I like this solution. It's less hassle than my own anwser. One way around it besides debugging your software might be to spoof the "immutable data". For example, it's trivial to spoof the MAC address, and it might be possible to spoof the CPU ID, for example by running a virtual machine. Collecting a large number of identifiers might make this harder to circumvent. – Pascal Feb 11 '17 at 8:42
  • Thanks, I like your answer two. Both of you provided a solution that works well, and not so hard to implement. – Duke Nukem Feb 11 '17 at 15:46
  • … and replace it with bytes that don't check anything (this would be easier than cracking the crypto). Or, just set the check-function to always return 1. – Rogem Dec 6 at 16:50

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.