Home > Ask the Software Quality Experts > Application Security Questions & Answers > Enforcing software licenses
Ask The Software Quality Expert: Questions & Answers
EMAIL THIS

Enforcing software licenses

Brad Arkin EXPERT RESPONSE FROM: Brad Arkin

Pose a Question
Other Software Quality Categories
Meet all Software Quality Experts
Become an Expert for this site


Software quality news and advice
Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us    Add to Google


>
QUESTION POSED ON: 19 June 2006
We have an application made entirely in VB6. We have devised a new mechanism of security for this application that checks the hard disk identification of the user and then generates the relevant serial key.

The new security requirement is that after three months the key expires and the software asks for another key. Is that possible? Is there any other way to implement a better security system?

>
EXPERT RESPONSE
Software license enforcement is a very challenging problem. People who crack software licenses are able to find ways around even the most advanced enforcement mechanisms. The use of hardware dongles or other advanced license enforcement techniques may lengthen the time required to crack the software license, but no design will withstand a concerted attempt by license crackers to remove the license enforcement.

Reverse engineering tools such as binary disassemblers allow license crackers to find the location in the code where the license check is enforced. Malicious users can then remove the check altogether or change the code so the check always returns a valid license. License crackers are able to use these tools to quickly sidestep any software-level license enforcement, even without access to the original source code for the application.

A simple license enforcement scheme that prevents casual pirating may be the best approach. Anything more complicated probably won't defeat determined software pirates.

Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us    Add to Google


RELATED CONTENT
Application Security
PCI DSS compliance: WAF, code review or both?
Application security careers have bright future
How to prevent anti-DNS pinning attacks
Open source application security testing tools
Java application security features and measures
Web application security testing basics
Password recovery with .NET 2.O using C#
Free load and performance testing tools
The most effective time to do security testing
Finding backdoor threats within applications

Building security into the SDLC (Software development life cycle)
Web application security and the PCI DSS
PCI DSS compliance: Web application firewalls (WAFs)
PCI DSS compliance: The basics
PCI DSS compliance: Code review
PCI DSS compliance: WAF, code review or both?
Application security careers have bright future
Writing software requirements that address security issues
Software Security Engineering: A Guide for Project Managers -- Chapter 3, Requirements Engineering for Secure Software
PCI DSS compliance: Web application firewall or code review?
Application security enters uncharted regions

Threat modeling
Web application security and the PCI DSS
The essentials of Web application threat modeling
How to implement security in Java EE and Java ME
Application security shouldn't involve duct tape, Band-Aids or bubble gum
Stop SQL injection attacks on applications
How to counter XSS attacks
Breaking the same origin barrier of JavaScript
Protection against "zero-minute" exploits
Denial of service and Ajax
CSRF attack vector with Ajax serialization

RELATED RESOURCES
2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems
Search Bitpipe.com for the latest white papers and business webcasts
Whatis.com, the online computer dictionary



Search and Browse the Expert Answer Center
Search and browse more than 25,000 question and answer pairs from more than 250 TechTarget industry experts.
Browse our Expert Advice

About Us  |  Contact Us  |  For Advertisers  |  For Business Partners  |  Site Index  |  RSS
SEARCH 
TechTarget provides enterprise IT professionals with the information they need to perform their jobs - from developing strategy, to making cost-effective IT purchase decisions and managing their organizations' IT projects - with its network of technology-specific Web sites, events and magazines.

TechTarget Corporate Web Site  |  Media Kits  |  Reprints  |  Site Map




All Rights Reserved, Copyright 2006 - 2008, TechTarget | Read our Privacy Policy 		  TechTarget - The IT Media ROI Experts