Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
It is possible for virtual machine guests to bypass the software expiration timers for paid software. This example shows one way to do this on VMWare. A simpler method is for the user to "revert to snapshot".
How can a software publisher still protect their content and enforce the expiration of the software installed on virtual machines? What can be done to maintain the state of elapsed time in spite of attempts by the user to modify the system time?
DRM is a notoriously difficult problem to solve. One should always assume that whatever code is in the hands of an uncontrolled client can never be fully protected.
One solution to the simple "rollback snapshot" bypass will be to have the client "dial home" to a server once in a while. Another good method can be to tie the license key to a user account and have the user authenticate whenever he wants to use the software.
However, this can still be bypassed by reverse engineering the binary and removing the portion of code that dials home. This is an unavoidable problem unless you want to host the bulk of the application on your servers and simply let the client be a "dumb client" that displays whatever the server tells it to. If this is acceptable to you, you might want to looking into providing a SaaS business model.
