Software Watermarking Deterring Software Piracy Beaux Sharifi CS591 Fall 2005

CS591 Software Watermarking - Beaux Sharifi Problem of Piracy 35% of all PC software pirated in 2004 $33 Billion dollars in losses in 2004 Software piracy is expected to rise due to increase in Internet usage 11/24/2018 CS591 Software Watermarking - Beaux Sharifi

What is Software Watermarking? Software Watermarking is the technique of embedding a secret message (digital rights) into a cover message (program). A form of Steganography Does not prevent piracy. Rather, deters it. (P+W) W Key P (P+W) (P+W) WSN’s have a variety of applications Golden Gate has motes used to study the effect of wind, traffic, and earthquakes on the structure of the bridge (use 50-100 accelerometers on a small section) (P+W) 11/24/2018 CS591 Software Watermarking - Beaux Sharifi

Software Watermarking Types Static Software Watermarks: Embedded within the static structure of the program. Static Data Watermarks Static Code Watermarks Dynamic Software Watermarks Embedded within the execution state of the program. Easter Eggs Execution Trace Dynamic Data Structure WSN’s have a variety of applications Golden Gate has motes used to study the effect of wind, traffic, and earthquakes on the structure of the bridge (use 50-100 accelerometers on a small section) 11/24/2018 CS591 Software Watermarking - Beaux Sharifi

Example Static Watermark Static Data Watermark: char copyright[] = “Property of XYZ Corporation, 2004”; Can Extract using GNU Strings: $> strings program.exe | grep XYZ $> Property of XYZ Corporation, 2004 WSN’s have a variety of applications Golden Gate has motes used to study the effect of wind, traffic, and earthquakes on the structure of the bridge (use 50-100 accelerometers on a small section) 11/24/2018 CS591 Software Watermarking - Beaux Sharifi

Example Dynamic Watermark Dynamic Easter Egg Watermark: Start Microsoft FreeCell Press Ctrl+Shift+F10 Click Abort Double-click Cards You Win! WSN’s have a variety of applications Golden Gate has motes used to study the effect of wind, traffic, and earthquakes on the structure of the bridge (use 50-100 accelerometers on a small section) 11/24/2018 CS591 Software Watermarking - Beaux Sharifi

De-watermarking Attacks Several types: Distortive: Destroy the watermark Subtractive: Remove the watermark Additive: Add additional watermarks Collusive: Compare the watermark Statistical: Analyze the watermark WSN’s have a variety of applications Golden Gate has motes used to study the effect of wind, traffic, and earthquakes on the structure of the bridge (use 50-100 accelerometers on a small section) 11/24/2018 CS591 Software Watermarking - Beaux Sharifi

CS591 Software Watermarking - Beaux Sharifi Example Attack Distortive Attack: char copyright[] = “Property of XYZ Corporation, 2004”; char a[] = “Prop”; char b[] = “erty”; char c[] = “ of “; char d[] = “XY”; char e[] = “Z”; … char m[] = “04”; char copyright[MAX]; copyright = a + b + … + m; Can no longer extract using GNU Strings: $> strings program.exe | grep XYZ $> WSN’s have a variety of applications Golden Gate has motes used to study the effect of wind, traffic, and earthquakes on the structure of the bridge (use 50-100 accelerometers on a small section) 11/24/2018 CS591 Software Watermarking - Beaux Sharifi

CS591 Software Watermarking - Beaux Sharifi Desirable Properties Desirable Properties of Watermarks: Resilient to Attacks Stealthy Efficient Have a High Data Rate Easy to Embed & Retrieve Mathematically Deliberate WSN’s have a variety of applications Golden Gate has motes used to study the effect of wind, traffic, and earthquakes on the structure of the bridge (use 50-100 accelerometers on a small section) 11/24/2018 CS591 Software Watermarking - Beaux Sharifi

Limitations of Software Watermarks Problem: All traditional software watermarking techniques except easter eggs are susceptible to distortive attacks. WSN’s have a variety of applications Golden Gate has motes used to study the effect of wind, traffic, and earthquakes on the structure of the bridge (use 50-100 accelerometers on a small section) 11/24/2018 CS591 Software Watermarking - Beaux Sharifi

Dynamic Graph Watermarking A new type of Dynamic Data Structure Watermark. Embeds watermark in the topology of a dynamically build graph structure. Result: Watermark embedded within pointer semantics of program. Therefore, it is resilient to distortive semantic-preserving attacks! P + W if (input == I) { P = new Node(); Q = new Node(); addEdge(P, Q); … } P P = new Node(); Q = new Node(); addEdge(P, Q); … Prime Number Q I also chose to study positioning algorithms based on sheer curiosity. 11/24/2018 CS591 Software Watermarking - Beaux Sharifi

CS591 Software Watermarking - Beaux Sharifi Attacks on DGW Dynamic Graph Watermarking (DGW) is still vulnerable to advanced types of distortive attacks. Can make DGW stronger by: Adding tamperproofing: Integrity Checking Check the integrity of DGW structure periodically. Constant Encoding Substitute program constants with DGW sub-tree. Opaque Predicates Create false dependencies on DGW structure Adding obfuscation: Obfuscate each copy of DGW program to protect against collusive attacks. Combining multiple approaches achieves the best results! 11/24/2018 CS591 Software Watermarking - Beaux Sharifi

CS591 Software Watermarking - Beaux Sharifi Future Work No software watermarking technique is immune to all types of attacks. There are no known defenses against Additive Attacks. 11/24/2018 CS591 Software Watermarking - Beaux Sharifi

CS591 Software Watermarking - Beaux Sharifi References Business Software Alliance, “Sixth Annual BSA global software piracy study”, http://www.bsa.org/globalstudy/upload/2005-Global-Study-English.pdf, undated, (Accessed: 7 Dec, 2005) C. Collberg and C. Thomborson, “Software Watermarking: Models and Dynamic Embeddings”, presented at POPL ’99. 26th ACM SIGPLAN-SIGACT. Symposium on Principles of Programming Languages. ACM, New York, NY, USA, 1999. Y. He, “Tamperproofing a Software Watermark by Encoding Constants”, Masters Thesis, University of Auckland, 2002. J. Palsberg, S. Krishnaswamy, K. Minseok, D. Ma, S. Qiuyun, and Y. Zhang, “Experience with Software Watermarking”, presented at 16th Annual Computer Security Applications Conference (ACSAC’00). IEEE Comput. Soc., Los Alamitos, CA, USA, 2000 11/24/2018 CS591 Software Watermarking - Beaux Sharifi