• (cs) in reply to SomeCoder
    Anonymous:

    No, I didn't store time information in plain text format - it was hashed in some way.  I don't really remember.



    If it was hashed then it would be totally useless for making comparisons to the system clock except for ==. A hash, by definition, is not a monotonic function. Maybe you meant "obfuscated".

    me=crusader to teach TDWTF readers WTF a hash function is
  • (cs) in reply to Bob Jones
    Anonymous:
    "Legalese Pro" doesn't exist.  Is this article a hoax?


    All the articles are anonymized so Alex doesn't get sued.

    I'm still waiting for the day when things get posted verbatim. It will never happen, but it would make the site a lot more fun.
  • Anonymous (unregistered) in reply to lpope187
    lpope187:

    And that was the long way around entering the cheat code of 'IBETYOUCANTPRINTCUNT' which would decode the control files for editing.  I don't know how many hours I wasted playing that in the college computer labs.  That and Starcraft.  Ah the good old days.


    Wait, you played Starcraft in the college computer labs?
    Now I'm feeling old too.
  • (cs) in reply to smurf
    smurf:
    One prime example is Skype. Their code is encrypted, obfuscated and armed-against-debuggers six ways from Sunday. :-(
    And it still didn't help them when a determined researcher decided to see what's going on inside (I'd give a link to presentation, but it seems I lost it somewhere).
  • orkus (unregistered)

    "Sorry bud, I don't do that any more. Can't offer ya' any help with it, either. Gotta run. Adios!"

    Poor Brian, his hard drive crashed a while ago, and without any backups, he lost his key generator. And since it was so old, he couldn't remember how it worked. And so, what was meant as a steady flow of income for years to come suddenly stopped. And every call reminded him of that.

    Of course, he didn't remember that debug message neither, that was for debugging anyway.

    Could someone please tell him that there is a way back to the sunny side of life?

    ;)

  • rk (unregistered) in reply to savar

    My guess is that Brian put his number in there himself along with the "Expected" value for the license key right before he quit.  That way he gets a good chuckle whenever he gets a call because he will know that there is yet another person who is going to get free use of the software by figuring out what was described in this WTF too.  He gets his alert and there is plausible deniability about what he did.  That's my theory.

  • Unklegwar (unregistered)

    Most WTF worthy here is the link from the "ETTE" link.....that M$ has a "Guide to LeetSpeak"

    as if they have any idea.

    Now all the h4X0r mommies and daddies can be hip to the scene, man. Groovy.

  • (cs) in reply to GeekMessage
    GeekMessage:

    Alex Papadimoulis:
    I mean, "kr@xx0rs." Err, I think. I don't know. I got that from my "3773 Speek" guide.

    Err, shouldn't that be 1337?  Or what might "Ette" possibly mean?  Or were you just trying to be funny?



    Trying? TRYING?!?

    Thanks for this one, Alex, it really made me laugh. In fact, after seeing the second dialog box with the Expected: value, now I have to clean off my monitor!

    Cheers!
  • JL (unregistered) in reply to Maurits
    Maurits:
    Isuwen:
    That 1337 ?p34k article was hillarious. And it totally failed to address the form's real orgins in gaming. The point was that you could type stuff in a game without taking your hand off the mouse. Most 1337 ?p34k can be typed with the left hand using the number pad and characters near the arrow keys.


    Gaming?  I thought l33t predated online gaming, and the main purpose was to defeat keyword searches.


    I recall seeing 1337 in the text files accompanying demoscene releases in the BBS days, before ISPs were big.  At that point, most keyword searching was done in university library catalogues.
  • Anonymously Ignorant (unregistered) in reply to elwood_j_blues
    elwood_j_blues:
    Captcha what?


    What's all this 'captcha' stuff about?? Am I supposed to know what it means? I think I've only ever seen it on this site!


  • anonny (unregistered)

    I remember the first program I ever cracked.  ZZT.

    The level files you weren't allowed to edit, when looked at with a hex editor, contained the word SECRET.  I just blanked it out with nulls, and suddenly all the built-in levels became editable.

  • billyun (unregistered) in reply to Steve

    Remember older Microsoft cd key systems.. any number worked if the sum was 27. .. funny times.

  • (cs) in reply to Isuwen
    Isuwen:
    That 1337 ?p34k article was hillarious. And it totally failed to address the form's real orgins in gaming. The point was that you could type stuff in a game without taking your hand off the mouse. Most 1337 ?p34k can be typed with the left hand using the number pad and characters near the arrow keys.


    I suspect anyone who claims to know the 'real' origins of 1337.

    And real gamers use RDFG ;)
  • (cs) in reply to Sch3lp

    Sch3lp wrote the following post at 08-30-2006 9:03 AM:
    Was "3773" a deliberate mistake? :) (I don't know about you guys, but I haven't heard of "ette-speak" up until now)

    Took a while until the penny dropped...

    Of course, Alex was obviously making the point that you don't have to be an 1337 cr4x0r at all to defeat that l4m3, inept "Leet" licensing scheme.

    --

    "It was deliberate," said the dwarf as he fell from his horse.

  • AlexM (unregistered)

    Wow, there's a lot of kind of weird posts in this thread. Let's just cut to the chase and make things absolutely clear: It is impossible to secure the integrity of any program. Not just the "practically impossible" kind of impossible, but the hardcore "mathematically proven to be impossible" kind.

    Okay, while I haven't actually seen a formal proof (one probably exists though), it's a fairly intuitive consequence of Turing-completeness. (To put it in less abstract terms, it means I can always create an emulator that runs your program and tricks it or modifies it to do what I want, and the program can never detect it doing so because the emulator can fool or modify that behaviour. Et sic de similibus.)

    So don't be too high-and-mighty over how 'crackable' programs are. It's all just a question of practicality, after all. As some people have pointed out, (and I've experienced personally) this program isn't even the most easily-defeatable scheme out there, either. However it's still wonderfully stupid, since the hash is rendered utterly pointless by displaying the expected value.

    Now a few responses to 88831 , who says:

    Because the enconding was somewhat hard. But I notice that you can feed some data to carmageddom, and he will encode it, I tried with encoded data and the result whas clear text!... so the carmageddom encoding whas very good with a fatal error: work like rot13, double encoding result on the source text.
    Well, first, I'm a bit doubtful the encoding really was that hard; most likely it was just the data XORed against some key-string, which is the most popular and obvious way when you want to obfuscate something and don't really care too much about security. XOR has the symmetric property you describe. Had they really cared about stopping modification, they could have signed the data files with an assymetric key. (Which is still more breakable than it may seem*). But I disgress.

    The statement above is very wrong. (and makes the poster look bad, since he seems to think he knows what he's talking about).

    The first misconception: Having an algorithm where encryption/decryption is performed the same way has little relevance to the security of the encryption method, and is certainly not a "fatal error". This is very simple to demonstrate: XOR the cleartext/cyphertext against a one-time pad to encrypt/decrypt. This is unbreakable. Unless, of course, you have the key. You always have the key. The key is in the software. So is the decryption algorithm. So while they may have made it particularily easy in this case, it's never really very hard either.

    *Ah, but what if they don't need to modify the data, and use an asymmetric method? Also very simple to defeat. You can always obtain the cleartext, either by finding the key in the software, or simpler, by using the program itself to do the job and obtaining the cleartext from the program's memory, through ordinary debugging/cracking techniques. Then you can modify the software to skip decryption of the data files and replace them with their cleartext versions.

    The second misconception: That the first misconception is the reason why ROT13 is insecure. All Caesar ciphers are insecure for all the well-known reasons monoalphabetic substitution ciphers are insecure, and they have a unicity distance of 1.0, meaning you only need one character of cleartext to break it, as opposed to ~27.6 for English monoalphabetic ciphers in general. That's the worst possible case (brute forced in 25 attempts at worst, should you choose that method) and ROT13 isn't worse off than any other. ("Double ROT13!" jokes aside).

    Of course, in this case the intent is only to make sure that the data isn't easily and casually modified. For that intent, their method was probably sufficient.  Of course, that's all changed alot in the last decade now that game devs have realized that 'modders' are nothing to be feared, but rather encouraged.

  • Matt (unregistered)

    You'll probably get sued for "violating" the DMCA.

  • KNordrum (unregistered) in reply to GoatCheez

    I'm Noah's wife and the lucky user of "LegalEase" and I couldn't help but comment... this wonderful program is made by one of the main legal publishers - 2 national offices with distribution in every state. Also, sadly, it continues to be sold for $80 a pop. Before getting in contact with Brian we had to talk to 8 different people and then wait 2 days for him to call us back with his shining jem of helpfulness. An independent developer would have known his product and cared about customer support. Brian did neither, but he assured us if we wanted to buy a newer version of the software he could have it at our doorstep in 24 hrs.. I'm pretty sure he was just some bottom-of-totem-pole sales guy charged with making us go away.

  • (cs)

    That's funny, my girlfriend had a subscription to 3773 magazine, apparently it has lots of fashion ads in it for some reason.  I just love it when a security dialog says basically, "wrong password, the right password is 12345, (but don't tell anyone) click OK to retry."

  • blank (unregistered)

    Noah! The program will expire in less than two weeks now!

  • DarrickPiero (unregistered)

    Hello Guys, Glad to Join! :)

  • (nodebb)

    cool

    Addendum 2024-09-25 12:55: I was on the hunt for no-deposit bonuses and found a fantastic deal offering a $10 free chip at various New Zealand casinos. You can learn more at Slotozilla NZ . The page provides detailed information on how to claim this no-deposit bonus, as well as the terms and conditions. It's a great way to start playing without having to deposit any money upfront.

Leave a comment on “Lock In Key Security”

Log In or post as a guest

Replying to comment #:

Log Out

« Return to Article