Re:Local License Key Verification
by justinjlynn on Tuesday April 25, 2023 @08:09AM
(#35699344)
Indeed. If you're selling a 1MM piece of scientific equipment, then that's the dongle.
>all it takes for an attacker to overcome the scheme is to replace your private keys with theirs -- or to patch a JMP for every do_license_check() call in the binary. It's fundamentally an approach that is always hackable.
That might be true in theory, but is non-trivial in practice. The code responsible for license verification is often obfuscated and tied to critical functionality, so you can't do a simple find and replace.
Re:Local License Key Verification
by angry_moose on Tuesday April 25, 2023 @09:10AM
(#35699947)
Also its still massive in anything that's licensed by the CPU core - FEA/CFD type stuff (1 license = 1 core; 16 licenses = 16 cores).
I never enjoy seeing FlexLM, but I absolutely dread seeing the homebrew license servers from companies that choose not to use it.
Of course, the obvious issue with the public key approach listed as being "best" in the article is that all it takes for an attacker to overcome the scheme is to replace your private keys with theirs -- or to patch a JMP for every do_license_check() call in the binary. It's fundamentally an approach that is always hackable.