Controlling who can run an executable

[x_tek]

Re: Controlling who can run an executable

I would write a companion program that works like this:

$ protector -lock filename.exe

and

$ protector -unlock filename.exe

the -lock switch would simply get the file size of filename.exe
then generate a random chunk of data the same size, xor it
with filename.exe and write the chunk data to a thumbdrive.
filename.exe would now be 'garbage'

the -unlock switch would then just read in the chunk of data
from the thumbdrive then xor filename.exe with it to restore
the file.

this will stop most anyone from getting at filename.exe
without the thumbdrive

[Cigar]

Re: Controlling who can run an executable


Myles Strous wrote:[color=blue]
> What's more, Tim Golden's wmi module (see
> http://tgolden.sc.sabren.com/python/wmi.html) makes getting at these
> numbers very easy:
>
> import wmi
> c = wmi.WMI ()
> for thingy in c.Win32_Network Adapter():
> print "Network Adaptor", thingy.MACAddre ss
> for thingy in c.Win32_Process or():
> print "Processor" , thingy.Processo rId
> for thingy in c.Win32_BIOS():
> print "BIOS", thingy.SerialNu mber
> for thingy in c.Win32_BaseBoa rd():
> print "BaseBoard" , thingy.SerialNu mber
> for thingy in c.Win32_SystemE nclosure():
> print "System Enclosure", thingy.SerialNu mber
> for thingy in c.Win32_DiskDri ve():
> print "Disk Drive", thingy.PNPDevic eID
> for thingy in c.Win32_Physica lMedia():
> print "Physical Media", thingy.SerialNu mber
>
> Regards, Myles.[/color]

Ah... thing of beauty. One of these will probably make it into my
final solution.

Thanks millions!

[Cigar]

Re: Controlling who can run an executable


Istvan Albert wrote:[color=blue][color=green]
> >was using to track clients and transactions. He couldn't demonstrate
> >the program for one reason or another because it was protected in a way
> >that neither could circumvent. (She didn't remember how it was
> >protected, she had hired this person a long time ago.)[/color]
>
> I'd venture to guess that neither of the people above knew much about
> programming. So do the same, create a security measure that protects
> against this level of 'threat'.[/color]

I could ask her, "If you can't break it is that good enough security?"
[color=blue]
> As others have pointed out the simplest way would be to detect the
> presence of a hidden file, or some hardcoded system value, mac address
> etc. Obscure this step even more by encrypting some of the information
> so that one can't just simply view it in a hex editor.
>
> Istvan.[/color]

[Istvan Albert]

Re: Controlling who can run an executable

> I could ask her, "If you can't break it is that good enough security?"

Guess not. Most non-programmers think everyone else who knows some
programming is a some sort of hacker genius.

Instead come up with a simple solution then explain her how it will
works. I think in the ensuing conversation you'll find out more on what
approach would put her mind at ease.

Istvan.

[Cigar]

Re: Controlling who can run an executable


Istvan Albert wrote:[color=blue][color=green]
> > I could ask her, "If you can't break it is that good enough security?"[/color]
>
> Guess not. Most non-programmers think everyone else who knows some
> programming is a some sort of hacker genius.
>
> Instead come up with a simple solution then explain her how it will
> works. I think in the ensuing conversation you'll find out more on what
> approach would put her mind at ease.
>
> Istvan.[/color]

Sorry I forgot to put the happy face at the end of that last sentence.
Yes I'll be a good boy. :)

[Cigar]

Re: Controlling who can run an executable


Tony Nelson wrote:[color=blue]
> In article <1128395422.904 212.318930@g44g 2000cwa.googleg roups.com>,
> "Cigar" <chrisgarland67 @hotmail.com> wrote:
>[color=green]
> > I am developing a program for a client. She runs a shop where her
> > clients bring in items for sale or short term buyback. Development of
> > the program has been going great but she's mentioned that there is a
> > 'feature' coming up in the next couple of weeks that she'd like me to
> > implement that has me a bit worried.
> >
> > My client has told me a story of how she hired someone from a competing
> > store and that person had brought a copy of the program her competition
> > was using to track clients and transactions. He couldn't demonstrate
> > the program for one reason or another because it was protected in a way
> > that neither could circumvent. (She didn't remember how it was
> > protected, she had hired this person a long time ago.)
> >
> > Now that I'm three months into the development of this program, my
> > client tells me she would like to protect her investment by preventing
> > her employees from doing the same to her. (Going to the competition
> > and using her program.)[/color]
> ...
>
> Call the competition and ask them what they used. Point out that it
> worked. If they won't tell you, just look at their software until you
> find out.
> _______________ _______________ _______________ _______________ ____________
> TonyN.:' *firstname*nlsn ews@georgea*las tname*.com
> ' <http://www.georgeanels on.com/>[/color]

Sorry. All I have is this wonderful story to tell everyone. This
employee she hired no longer works for her and the 'disk' that nobody
to could get working is gone as well.

Sadly there's nothing left for me to forensically examine.

[Magnus Lycka]

Re: Controlling who can run an executable

Cigar wrote:[color=blue]
> What I want:
> - the simplest thing that could possibly work![/color]

A splash screen that informs the user that it's
confidential data, and that unauthorized use will
lead to prosecution?

Besides, I think it's not the program you need to
protect, but the data. Think about that. Who cares
about a hardware dongle if they can access the
information you're trying to protect in notepad or
via ODBC and MS query etc.

She's as vulnerable if someone prints out a listing
of the clients and takes that, as if someone copies
the program. If you have the ability to generate
lists of data, you might not want that feature to be
accessible to "normal" users.

Finally, there's another nice trick that you can
do, now that most computers are hooked up on the
net. Make the program report when it's being used.
The easiest way might be to make it send an email,
but I'm not quite sure how you set it up to do that
on a windows box without asking the data-thief about
email settings. Virus-programs obviously do this,
so it can't be too hard. (Actually, to do something
in your program that will alert anti-virus programs
might be a good protection!)

You could also make the program "phone home" via
a socket etc, but that requires a server that can be
reached on the net.

But as others have said, you should make this a
client-server app, and make sure the server is
physically protected, difficult to break into
(a DOS box or an old MAC?) and only serve the right
kind of data to an authenticated user connected
locally.