From: Leslie Viljoen <leslieviljoen@...>
Date: 2006-05-23T17:01:29+09:00
Subject: Re: Writing a interpreter extension

On 5/23/06, Ryan Davis <ryand-ruby@zenspider.com> wrote:
>
> On May 22, 2006, at 1:17 PM, Leslie Viljoen wrote:
>
> > On 5/22/06, Kris Leech <krisleech@interkonect.com> wrote:
> >> Its an application that deals with highly sensitive data, I dont want
> >> insiders to be able to write a bit of ruby and dump the data to
> >> file/screen...
> >
> > You are talking about two different things: hiding code (algorithms)
> > and hiding data. Hiding code is useless because if it can be executed
> > by a computer it can be cracked by a person. The millions of patches
> > on the Internet prove that even little known programs are cracked
> > as soon
> > as they appear. If your data is hidden by your code being hard to
> > understand, it will be visible very soon - binaries or not.
>
> How true is that? Bypassing a license key check is a LOT different
> than reverse engineering a full binary (and being able to make sense
> of it). I'm no black hat so I'm honestly asking here. I have no clue. :P

What I'm saying is that bypassing a license key check in a binary and
bypassing a license key check in source are both very easy. Source is
obviously easier but a binary is usually also trivially easy - just
get a debugger and set some break-points, search for some strings,
some API calls... it rarely takes more than 30 minutes.

In the face of a bit of investigation entire file formats and
protocols are open for all to see - just look at the drop-in
replacements for Exchange, the many programs that can read and write
MS Word documents, the NTFS support on Linux. Protocols have been
decoded and servers hacked without having the source OR the binaries
but just by looking at the comms. With a binary, things are very easy.

Seriously: your program is visible, your strength needs to lie somewhere else.

Les