What would you say about a set of anti-piracy technologies that allows -

[Rob Harmer]

..................software developers to easily mark features as "licensable
entities"
that can later be controlled through various kinds of digital
licenses.......
........... a business or product-marketing group to create digital licenses
for certain feature bundles, where they can easily turn on and off those
features that were marked as protected and deliver only the desired
functionality to the end-user.

.........the gathering the monitoring data, which can be used for things like
billing, such as utility based billing at the end of the month, or to create
statistics on what usage has happened within the application for future
product planning. Note: Application monitoring is an optional feature, and
we expect the ........ end-user to opt in to such a process.

- the ability to fine tune software offerings even after the product has
been shipped. for example If it's five or six months after the product has
shipped, and it turns out that the .....market, for example, really wants a
package that has certain features, we can generate new licenses .......on
demand............ All they need to do is create a new digital license and
make it available, and it will unlock and enforce those features.

.................the flexible distribution and license application in any way
they want to, even after the product has been released, depending on their
business model.

.............being able to target customers in a direct way, where you're
giving them exactly what they need and only what they need.

What security implications would you see with this approach?

Rob

 

[Roger Abell [MVP]]

You imply placing on my machines a software/agent that is
network active, that can send usage profiling data out, that can
change the installed code in order to provide those new features,
etc.. and all controlled/monitored by the machine owner how ?


"Rob Harmer" <rharmer@internode.on.net> wrote in message
news:F1C3996E-2A4D-4415-B56E-D5F42BE6B3E8@microsoft.com...
> .................software developers to easily mark features as
> "licensable entities"
> that can later be controlled through various kinds of digital
> licenses.......
> .......... a business or product-marketing group to create digital
> licenses
> for certain feature bundles, where they can easily turn on and off those
> features that were marked as protected and deliver only the desired
> functionality to the end-user.
>
> ........the gathering the monitoring data, which can be used for things
> like
> billing, such as utility based billing at the end of the month, or to
> create
> statistics on what usage has happened within the application for future
> product planning. Note: Application monitoring is an optional feature, and
> we expect the ........ end-user to opt in to such a process.
>
> - the ability to fine tune software offerings even after the product has
> been shipped. for example If it's five or six months after the product
> has
> shipped, and it turns out that the .....market, for example, really wants
> a
> package that has certain features, we can generate new licenses .......on
> demand............ All they need to do is create a new digital license and
> make it available, and it will unlock and enforce those features.
>
> ................the flexible distribution and license application in any
> way
> they want to, even after the product has been released, depending on their
> business model.
>
> ............being able to target customers in a direct way, where you're
> giving them exactly what they need and only what they need.
>
> What security implications would you see with this approach?
>
> Rob

 

[Rob Harmer]

Roger,

You are almost correct, the variants that are likely to occur are as wide
and as varied as the ISV will want to make them! and they are being
encouraged by Microsoft to do this!

Microsoft are the ones who are offering this set of "code" to ISVs as of Oct
2007.

The key issue of course is the approach may be benign or it could be
malicious, and of course you have no say in the matter as its embedded
within the code.

I am sure there are some Microsoft architect sleepers on the list who will
chip in soon. It's called Software License Protection Services and it poses
a big threat to your security!

Rob


"Roger Abell [MVP]" <mvpNoSpam@asu.edu> wrote in message
news:eH2BOiiCIHA.2280@TK2MSFTNGP02.phx.gbl...
> You imply placing on my machines a software/agent that is
> network active, that can send usage profiling data out, that can
> change the installed code in order to provide those new features,
> etc.. and all controlled/monitored by the machine owner how ?
>
>
> "Rob Harmer" <rharmer@internode.on.net> wrote in message
> news:F1C3996E-2A4D-4415-B56E-D5F42BE6B3E8@microsoft.com...
>> .................software developers to easily mark features as
>> "licensable entities"
>> that can later be controlled through various kinds of digital
>> licenses.......
>> .......... a business or product-marketing group to create digital
>> licenses
>> for certain feature bundles, where they can easily turn on and off those
>> features that were marked as protected and deliver only the desired
>> functionality to the end-user.
>>
>> ........the gathering the monitoring data, which can be used for things
>> like
>> billing, such as utility based billing at the end of the month, or to
>> create
>> statistics on what usage has happened within the application for future
>> product planning. Note: Application monitoring is an optional feature,
>> and
>> we expect the ........ end-user to opt in to such a process.
>>
>> - the ability to fine tune software offerings even after the product has
>> been shipped. for example If it's five or six months after the product
>> has
>> shipped, and it turns out that the .....market, for example, really wants
>> a
>> package that has certain features, we can generate new licenses .......on
>> demand............ All they need to do is create a new digital license
>> and
>> make it available, and it will unlock and enforce those features.
>>
>> ................the flexible distribution and license application in any
>> way
>> they want to, even after the product has been released, depending on
>> their
>> business model.
>>
>> ............being able to target customers in a direct way, where you're
>> giving them exactly what they need and only what they need.
>>
>> What security implications would you see with this approach?
>>
>> Rob
>
>

 

[Roger Abell [MVP]]

"Rob Harmer" <rharmer@internode.on.net> wrote in message
news:OttIlikCIHA.4228@TK2MSFTNGP02.phx.gbl...
> Roger,
>
> You are almost correct, the variants that are likely to occur are as wide
> and as varied as the ISV will want to make them! and they are being
> encouraged by Microsoft to do this!
>
> Microsoft are the ones who are offering this set of "code" to ISVs as of
> Oct 2007.
>
> The key issue of course is the approach may be benign or it could be
> malicious, and of course you have no say in the matter as its embedded
> within the code.
>
> I am sure there are some Microsoft architect sleepers on the list who will
> chip in soon. It's called Software License Protection Services and it
> poses a big threat to your security!
>
> Rob
>

I would say that there is a potential. You know, the old
issue with most technologies - it is not the technology but
those that employ them.

It is all in the handles the machine owner has to control and
monitor actions, and in the extent of trust that owner is willing
to extend to whom.

Consider, Microsoft Update, which has been using similar
capability for some time with hundreds of millions of client
machines. More recently Sun Java and Adobe products are
finding out what is the comfort level amongst their users.

You may have a point, but until we move to totally thin
clients using a network service architecture isn't more of
this autoupdate inevitable?

Roger

>
> "Roger Abell [MVP]" <mvpNoSpam@asu.edu> wrote in message
> news:eH2BOiiCIHA.2280@TK2MSFTNGP02.phx.gbl...
>> You imply placing on my machines a software/agent that is
>> network active, that can send usage profiling data out, that can
>> change the installed code in order to provide those new features,
>> etc.. and all controlled/monitored by the machine owner how ?
>>
>>
>> "Rob Harmer" <rharmer@internode.on.net> wrote in message
>> news:F1C3996E-2A4D-4415-B56E-D5F42BE6B3E8@microsoft.com...
>>> .................software developers to easily mark features as
>>> "licensable entities"
>>> that can later be controlled through various kinds of digital
>>> licenses.......
>>> .......... a business or product-marketing group to create digital
>>> licenses
>>> for certain feature bundles, where they can easily turn on and off those
>>> features that were marked as protected and deliver only the desired
>>> functionality to the end-user.
>>>
>>> ........the gathering the monitoring data, which can be used for things
>>> like
>>> billing, such as utility based billing at the end of the month, or to
>>> create
>>> statistics on what usage has happened within the application for future
>>> product planning. Note: Application monitoring is an optional feature,
>>> and
>>> we expect the ........ end-user to opt in to such a process.
>>>
>>> - the ability to fine tune software offerings even after the product has
>>> been shipped. for example If it's five or six months after the product
>>> has
>>> shipped, and it turns out that the .....market, for example, really
>>> wants a
>>> package that has certain features, we can generate new licenses
>>> .......on
>>> demand............ All they need to do is create a new digital license
>>> and
>>> make it available, and it will unlock and enforce those features.
>>>
>>> ................the flexible distribution and license application in any
>>> way
>>> they want to, even after the product has been released, depending on
>>> their
>>> business model.
>>>
>>> ............being able to target customers in a direct way, where you're
>>> giving them exactly what they need and only what they need.
>>>
>>> What security implications would you see with this approach?
>>>
>>> Rob
>>
>>
>

 

[Rob Harmer]

Roger,

I agree the issue is in the method of deployment and who is doing the
deployment and most importantly where the software has come from.

Microsoft has been for some time pushing its Trusted Computing initiative.

In the sector area I work in, recent events led to further research which
has raised some key questions that need answering. My concerns stem from
what will flow from other vendors who adopt/adapt and pervert the SLP
approach from what Microsoft are proposing for ISVs at
http://www.microsoft.com/presspass/features/2007/jul07/07-10slpservices.mspx
and at http://www.softwarepotential.com/

There are some fundamental security issues that we mustn't lose sight of,
otherwise we are being lulled into a false sense of security by the vendor
speak through the product evangelists at Microsoft.

If Microsoft or another vendor (ISV) wants to turn on and off features and
harvest data about the usage of target systems the end user needs to know -
what hidden "features" are embedded within the software that may be turned
on / turned off at a later stage. (This is a critical issue at defense,
financial sector and other sites where security is a paramount)

In terms of feature enabling/disabling the end user needs to know -
a: under what conditions will features be turned on and off,
b: when (and what data/system protection steps need be applied),
c will they get prior opportunity/notification to allow data
security/restore points/backups to be done,
d: how often (end of license renewal/eval period/subscription/time/at whim
etc), and
e will the user have the final say about future enablement/disablement or
is it "locked up in the fine print" in the ever changing EULA (these are
never static).

In addition in terms of "phone home", telemetry or monitoring features the
user -
a needs to have this disclosed up front and be able to agree to this before
the data leaves the firewall,
b needs to be told what the data is being used for and how it will be
protected if it contains IP address details etc (we need better words than
what the spin doctor marketeers will tell us),
c needs to be given the right to accept, modify or deny any data telemetry!

Isn't this an integral part of the Trusted Computing approach surely? or is
at all one way?

I have no real problem with the Validation/Update process (other than it
breaking PCs for some users - I see some patches today broke another users
Vista PC see Microsoft.public.windows.vista.security ) and that is very
painful and not easily recovered from (some sites can't restore easily after
XP was busted a few days ago).

For big sites update/validation issues are not the same level of concern as
it is for SMEs (due to the licensing clout the big end of town has) so a
good sysadmin will harden and road test before deployment.

But, there are a myriad of small users and small businesses (SMEs) who won't
have that advantage (of having systems that don't require activation) or
technical background/resources to defend themselves against an attack vector
that could/will arise due to the approach outlined at
http://www.microsoft.com/presspass/features/2007/jul07/07-10slpservices.mspx.

Why does Microsoft for example need to harvest information for Vista as
listed in the article here?
http://news.softpedia.com/news/Forg...s-Harvest-User-Data-for-Microsoft-58752.shtml

"Microsoft has an additional collection of 47 Windows Vista features and
services that collect user data. However, not all phone home and report to
Microsoft. Although the data collection process is generalized across the
list, user information is also processed and kept on the local machine,
leaving just approximately 50% of the items to both harvest data and contact
Microsoft. Still, Microsoft underlined the fact that the list provided under
the Windows Vista Privacy Statement is by no means exhaustive, nor does it
apply to all the company's websites, services and products." So why do they
need all this data?

Doesn't this go above and beyond just the update cycle and the Trusted
Computing approach?

The approach offered by SLP is generating risky areas that concern me and
should be concerning every one else also.

PS: I do recognize that Microsoft aren't the only ones who "phone home",
it's been going in since Win95 days!

Some of the following have been turned off now after user outcry.

Apple http://www.red-sweater.com/blog/153/apple-phones-home-too PLUS
QuickTime plus Photoshop

iTunes http://simplisticton.livejournal.com/212874.html

Google http://collisionbend.com/2006/hey-google-phone-home/

Verizon DSL http://www.dslreports.com/faq/1247

Lexmark and HP
http://www.engadget.com/2004/11/12/are-lexmarks-printers-spying-on-you/

There are also other vendors - to locate Google "phone home" and then add
the name of the software vendor that you are looking at, there are some
surprises there.

Lastly Microsoft and other vendors need to realize that computers and
software in the business sector/government and defense are "an aid to
operations" and are there to help a business meet it's goals and objectives.
The potential for that focus to shift is being escalated by the piracy
approach adopted by Microsoft, patch cycles and the add ons that are
slipping in to the software in the name of marketing. The SLP approach has
serious attack vector potential when you examine what is being proposed.

Cheers

Rob

"Roger Abell [MVP]" <mvpNoSpam@asu.edu> wrote in message
news:O86HHZwCIHA.6012@TK2MSFTNGP03.phx.gbl...
> "Rob Harmer" <rharmer@internode.on.net> wrote in message
> news:OttIlikCIHA.4228@TK2MSFTNGP02.phx.gbl...
>> Roger,
>>
>> You are almost correct, the variants that are likely to occur are as wide
>> and as varied as the ISV will want to make them! and they are being
>> encouraged by Microsoft to do this!
>>
>> Microsoft are the ones who are offering this set of "code" to ISVs as of
>> Oct 2007.
>>
>> The key issue of course is the approach may be benign or it could be
>> malicious, and of course you have no say in the matter as its embedded
>> within the code.
>>
>> I am sure there are some Microsoft architect sleepers on the list who
>> will chip in soon. It's called Software License Protection Services and
>> it poses a big threat to your security!
>>
>> Rob
>>
>
> I would say that there is a potential. You know, the old
> issue with most technologies - it is not the technology but
> those that employ them.
>
> It is all in the handles the machine owner has to control and
> monitor actions, and in the extent of trust that owner is willing
> to extend to whom.
>
> Consider, Microsoft Update, which has been using similar
> capability for some time with hundreds of millions of client
> machines. More recently Sun Java and Adobe products are
> finding out what is the comfort level amongst their users.
>
> You may have a point, but until we move to totally thin
> clients using a network service architecture isn't more of
> this autoupdate inevitable?
>
> Roger
>
>>
>> "Roger Abell [MVP]" <mvpNoSpam@asu.edu> wrote in message
>> news:eH2BOiiCIHA.2280@TK2MSFTNGP02.phx.gbl...
>>> You imply placing on my machines a software/agent that is
>>> network active, that can send usage profiling data out, that can
>>> change the installed code in order to provide those new features,
>>> etc.. and all controlled/monitored by the machine owner how ?
>>>
>>>
>>> "Rob Harmer" <rharmer@internode.on.net> wrote in message
>>> news:F1C3996E-2A4D-4415-B56E-D5F42BE6B3E8@microsoft.com...
>>>> .................software developers to easily mark features as
>>>> "licensable entities"
>>>> that can later be controlled through various kinds of digital
>>>> licenses.......
>>>> .......... a business or product-marketing group to create digital
>>>> licenses
>>>> for certain feature bundles, where they can easily turn on and off
>>>> those
>>>> features that were marked as protected and deliver only the desired
>>>> functionality to the end-user.
>>>>
>>>> ........the gathering the monitoring data, which can be used for things
>>>> like
>>>> billing, such as utility based billing at the end of the month, or to
>>>> create
>>>> statistics on what usage has happened within the application for future
>>>> product planning. Note: Application monitoring is an optional feature,
>>>> and
>>>> we expect the ........ end-user to opt in to such a process.
>>>>
>>>> - the ability to fine tune software offerings even after the product
>>>> has
>>>> been shipped. for example If it's five or six months after the product
>>>> has
>>>> shipped, and it turns out that the .....market, for example, really
>>>> wants a
>>>> package that has certain features, we can generate new licenses
>>>> .......on
>>>> demand............ All they need to do is create a new digital license
>>>> and
>>>> make it available, and it will unlock and enforce those features.
>>>>
>>>> ................the flexible distribution and license application in
>>>> any way
>>>> they want to, even after the product has been released, depending on
>>>> their
>>>> business model.
>>>>
>>>> ............being able to target customers in a direct way, where
>>>> you're
>>>> giving them exactly what they need and only what they need.
>>>>
>>>> What security implications would you see with this approach?
>>>>
>>>> Rob
>>>
>>>
>>
>
>