0

From some posts I read here:

Regarding keygen protected software:

As long as the user has full control of the hardware where the software is running on (i.e. typical PC) it is impossible to fully protect the software.

Regarding password protected zip files:

No, as far as I'm aware, there are no current viable attack vectors other than brute forcing the password.

It doesn't seem quite clear why for the software, you could inspect the binaries and potentially bypass the protection, but for a file, you couldn't?

frt132
  • 3
  • 2

1 Answers1

1

It is less about the technology itself, but more what it needs to protect and from whom.

In software licensing you want to make sure only authorized users can run the software and that they will adhere to the license restrictions. If one simply gives the user some encrypted software and the decryption key, then they can decrypt the software to run it. But the user can also redistribute the decrypted software or redistribute the software together with the decryption key. And they might do this to bypass licensing restrictions in order to save money or make money by reselling the software to others. Thus the authorized user is considered untrusted by the vendor. That's why vendors add hooks into the application to check the license and attempt to attest software and device to make sure that the software is not modified to remove these license checks. But as long as the vendor has not sufficient control over the users device they can only make it harder to redistribute some hacked software (and also make valid use harder as collateral damage) but not fully prevent it.

With an encrypted file the goal is to allow prevent unauthorized users from getting to the content of the file. Only authorized users have the decryption key for the file. While similar to the case of software licensing they could simply decrypt the file and redistribute the decrypted version, it is not the security target to prevent this in the first place. Instead these authorized users are considered trusted (in contrary to software licensing) to keep the decryption key secret. Sure, if the authorized user cannot be trusted then this protection will fail too, similar to how license restrictions fail.

Steffen Ullrich
  • 190,458
  • 29
  • 381
  • 434
  • Thanks very much for the answer. However, I also want to know why (based on the linked answers) although an encrypted file is secure against code inspection, the said software would probably be vulnerable to that? – frt132 Feb 21 '23 at 08:05
  • @frt132: With file encryption the whole file is encrypted and can only be decrypted with the key. No inspection of the encrypted file will find this key - since it is not inside the file. License checks are instead are incorporated into the code and can be found with reverse engineering. If the software is encrypted it somehow needs to be decrypted for execution and can be stolen in this form. – Steffen Ullrich Feb 21 '23 at 08:46