Black Hat Hackers vs Programmers? [closed]

Question

This came up with another question I had here, I have decided on a programming verification system that requires a hardware verification system, a software key, and a name/password system.

Now people are saying that hackers will bypass any new security, which may be true, but I have a few questions.

There has to be a balance between programmers programming and hackers stealing software, otherwise programs wouldn’t be made, and we wouldn’t be where we are today. What is that balance? 5%, 10%, 20%, 50%?

1. What is too much security for the end user?
2. What is too little security so the hacker can just push through without issue?
3. If your software becomes popular, what should you expect or accept as acceptable loss?
4. Why should we accept black hat hackers as a way of life?

Answer 1

They'll crack your keys and spoof the passwords. It will happen, it's just a question of whether your stuff is worth the trouble.

1. You've got too much security when your end users start leaving because your security makes the NSA look lazy. It really is dependent on what you are actually storing on your end. I've heard it argued that security is impossible to over-engineer. I'd say that's true, provided that your end user never notices it.

2. Too little is doing things like storing things in plaintext or not using parameters for your table inputs to stop SQL injection.

3. That's a hard question. I think World of Goo made a profit with a piracy rate of like 90%.

4. We accept Black Hats because they exist and there are more of them than you think. You have the internet. They have the internet. Thus, there be Black Hats. Even a world-wide police state wouldn't be able to fully kill them off (and would have horrifying drawbacks for the rest of us). It's an arms race to the bitter end (and it will never end), so just keep your measures up to date and keep going.

I recommend IT Security.SE if you have some more specific questions.

Answer 2

World Engineer's answers are pretty good, but I think you're not talking about security as such, but piracy and counter-piracy measures. In that sense:

What is too much security for the end user?

Anything which the user considers too visible / obtrusive. This is highly dependent on the nature of your software - specialised software typically gets away with having stricter activation requirements. E.g. I may put up with a dongle for a 10 00$ application, but have refused to purchase 50$ games and applications because of DRM / "always online" requirements.

What is too little security so the hacker can just push through without issue?

If we're going down this path, I would say no activation at all, or incorrectly implemented checks (e.g. having everything boil down to a single if in your code.

If your software becomes popular, what should you expect or accept as acceptable loss?

How do you propose to measure this loss, exactly? Remember that a pirated copy is not necessarily a lost sale - there's a good chance that your software is being pirated because that person didn't think it was worthwhile paying for it.

To actually answer the question, nobody knows. Estimated piracy rates are generally pretty high. One example is Ubisoft claiming a piracy rate of 93 to 95% and this list by country showing it to be quite high in general. Yet somehow, they are still in business. I also believe that purchasing power inequalities play a large role in it, and unfortunately there's no easy way to deal with that. Basically, 100$ for Windows may seem cheap for someone in the US, but may be a year's savings for a Zimbabwean. Do you really think they will buy it, and is that pricing fair in the first place?

Why should we accept black hat hackers as a way of life?

Well, for one, it's the nature of computing at the moment. If you are handing out your application to be run on other people's hardware, there isn't much you can do to avoid them messing with it. There will always be people who crack software for fun, profit, social standing, political motivations, whatever. And more importantly, it's an uphill battle - nothing is uncrackable, and by investing in stopping piracy, you may irritate legitimate users and waste your valuable time.

So basically, it's in your best interest to play along - it's a "battle" you can't win.

Some alternatives / solutions to consider:

• Make the application web-based, and sell it as a service, or make it partially dependent on some hosted service (the actual meat of the app, not just activation). Edit: coincidentally, the latter part is what dongles actually attempt to do; given time, it can also be reverse engineered and emulated.
• Incentivise users to buy the real thing by offering them value-adds. Frequent updates and new features can make your app a moving target, even if it runs on the client.
• Alternatively, if played cleverly, "DRM-free" can also be a powerful marketing tool. You gain goodwill from the community, and some free marketing. A good example was Galactic Civilisations, a relatively unknown game which enjoyed stellar success after a huge publicity boost for being DRM-free.

Edit: as a final summary, I'd put it this way: either turn your application into a service, or (if that's not possible), put in the minimum amount of DRM to make it "good enough" and move on. Rather invest your time and energy into giving your real users value-adds, etc.

Answer 3

Actually, I get paid to solve problems. Some of the places I worked couldn't care less if the software I wrote for them was GPL'd or stolen afterwards. As long as it continued to solve their problems, they were cool. So, even if we lived in a world where all software was instantly available to the masses, there would still be a lot of work for programmers.

To most of your questions, it depends on the users and the business case. So far, painless DRM is a myth and anything you do to thwart pirates is going to cause your customers stress. Any amount of effort that gets between users and doing what it is they want to do will dissuade a percentage of users from using your software and/or paying you. For lightweight things like... say... impulse gaming during a coffee break, any amount of effort will put off the majority of your user-base. For important things that are crucial for the lifestyle of the user, like it's their job to run this software, or it literally keeps their heart beating, then a far smaller percentage will be put off when you have them jump through DRM hoops.

And yes, any security measure you put in place has a chance of being circumvented. Usually there's a direct correlation to how off-putting it is to how hard it is to circumvent. It's a business decision to decide how angry you want to make your users and pirates.

Why should we accept black hat hackers as a way of life?

Because you don't have the option not to? Malicious people don't go away if you ignore them.

As for pirates, you should balance overzealous DRM against losing business. At some point your product becomes easier (monetarily and usability combined) to pirate than to pay for. At some point you lose money. And because there's a culture which absolutely despises DRM and won't give you a bent penny for restrictive software. For some applications, letting people freely take your software yields more revenue then stopping them from doing so.

Answer 4

First off I think you're talking about crackers not hackers.

Personally I have refused to use certain software due to the DRM. Generally users will use your software as long as it does not require a constant connection to the publisher's servers as this causes users to accuse the company of spying.

You've also got to consider whether it's worth the cost, hardware verification isn't worth it unless your software is along the lines of AutoCAD as crackers will virtualise the device within a few months so unless the devices are locked to an individual copy of the software.

I think the best method is added value, Steam uses this by making downloading legal games easier than illegal and providing cloud backup of all purchases. You could also provide your software for free but then charge for training and support.

Answer 5

Customers arent criminals. So if you are starting off with the assumption that every customer is a potential criminal, you've already broken the trust between vendor and customer. Nicely done.

Now a good rule of thumb is, if you positively insist on some sort of copy protection, implement enough copy protection that it dissuades a casual or accidental copies of your software from being made, but don't implement anything that may risk a legitimate end user not being able to use the software they paid for. Unfortunately, there's a lot of stupid companies out there that do the latter, and ultimately it pisses off the exact people they want to keep happy - paying customers. Unlock codes that locally and permenantly unlock an application, or one time activation for a specific copy would be 'acceptable'. Hardware restrictions, constant calling home, and the like - not so much. If you do use an online activation, you better damn well be sure that activation will always be available. Or do you want a customer to miss a deadline because they couldnt get their software installed at 2am on a Sunday night?

Ultimately, if you think all your protections will actually stop a cracker from cracking your software, you're delusional. All it takes is one successful crack, and its as available online as if there was no copy protection at all. Also, I'd point out... so what if they do? Are you actually losing sales because of it? I know a lot of authors get their shorts in a bunch when their software is copied 'illegally'. But the truth is, in most cases those copies would not have been a new sale anyways. Focus on making your paying customers happy and things will be good. Focus on stopping copying over customer satisfaction, and you'll come across poorly.