« previous next »
Pages: 1 2 [All] |   Go Down

Author Topic: lisp security  (Read 14067 times)

0 Members and 1 Guest are viewing this topic.

Ron Heigh

  • Guest
lisp security
« on: December 08, 2003, 09:51:15 AM »
I've been asked to research some security options for our custom lisp routines.
I'm going to compile all the routines, but I need to include a routine that checks for the correct security code in the support path.
If the security code isn't valid, the lisp routines will not run.
Has anybody done this before?  Anybody interested?
Logged

Mark

  • Custom Title
  • Seagull
  • Posts: 28762
lisp security
« Reply #1 on: December 08, 2003, 10:01:43 AM »
Sounds like fun, what about using a registry key?
Logged
TheSwamp.org  (serving the CAD community since 2003)

Ron Heigh

  • Guest
lisp security
« Reply #2 on: December 08, 2003, 10:32:08 AM »
A registry key to hold the begin date and the number of days to remain active would be great.  Obviously, this data would need to be hashed from within the routine so it can't be registry hacked.  If the program was compiled as well, I could call it from the start of my compiled routines.
Email me to discuss your fees.
Logged

Craig

  • Guest
lisp security
« Reply #3 on: December 08, 2003, 10:44:24 AM »
Hey hey Ron, whats up man? How's that company web site coming along. Did you guys find a host plus fix your forms?  :wink:
Logged

Ron Heigh

  • Guest
lisp security
« Reply #4 on: December 08, 2003, 10:47:13 AM »
Hey Craig, great to hear from you.
The company site is running good.  I fixed the form myself.
After getting a few quotes for hosting, they decided to stay where they were.
Turns out, the price they were paying wasn't too bad.
Things a pretty busy around here.  Big jobs with tight schedules.
Logged

SMadsen

  • Guest
lisp security
« Reply #5 on: December 08, 2003, 12:36:38 PM »
The only "security" I ever did was setting expiration dates on some VLX demo previews sent to clients. I got the orders so apparently it worked :)

I think the criteria for security have to be considered very carefully. What kind of security code did you have in mind? When is a user allowed to run the lisp routines and when is (s)he not allowed? Is it based on profiles, passwords or a key in file or registry? If the latter then keys can be copied and a checksum verification should perhaps be used.
Are all your routines to be compiled into a single file or multiple files?
Logged

Ron Heigh

  • Guest
lisp security
« Reply #6 on: December 08, 2003, 12:55:40 PM »
I'm going to be using a registry key that expires the software every month.
If I don't update the network, it won't work.
Call it, Job Security.
Now they can never fire me. lol
Logged

JohnK

  • Administrator
  • Seagull
  • Posts: 10626
lisp security
« Reply #7 on: December 08, 2003, 01:07:42 PM »
Or they fire you for industrial sabotage. ...Or whatever they want to call it.
Logged
TheSwamp.org (serving the CAD community since 2003)
Member location map - Add yourself

Donate to TheSwamp.org

Ron Heigh

  • Guest
lisp security
« Reply #8 on: December 08, 2003, 01:08:25 PM »
I sure hope not.
They've asked me to do it.
Logged

JohnK

  • Administrator
  • Seagull
  • Posts: 10626
lisp security
« Reply #9 on: December 08, 2003, 01:12:30 PM »
Why do they want to "Lock 'em down"? Are they worried about Prop. rights or something?
Logged
TheSwamp.org (serving the CAD community since 2003)
Member location map - Add yourself

Donate to TheSwamp.org

Ron Heigh

  • Guest
lisp security
« Reply #10 on: December 08, 2003, 01:32:46 PM »
I've written too much software for these guys to have it just laying around anymore.
Logged

JohnK

  • Administrator
  • Seagull
  • Posts: 10626
lisp security
« Reply #11 on: December 08, 2003, 01:46:19 PM »
I guess i dont get it, but thats cool. ...Whatever they want i guess.  

I wouldnt put it in the reg. I would create a  file in the acad dir (With a small app of course) and give it a special line in the file.  Every time your app runs, if the file dosent exist, dont run.  Besides, your avg, cracker is gonna look in the reg. first anyway.
Logged
TheSwamp.org (serving the CAD community since 2003)
Member location map - Add yourself

Donate to TheSwamp.org

ELOQUINTET

  • Guest
lisp security
« Reply #12 on: December 08, 2003, 01:48:41 PM »
yeah i could write it for you here's a start :

(Dan -full access)))

how's it look  :wink:

dan
Logged

Mark

  • Custom Title
  • Seagull
  • Posts: 28762
lisp security
« Reply #13 on: December 08, 2003, 02:04:05 PM »
>cracker is gonna look in the reg. first anyway
Maybe a "cracker" but is the CAD user going to? How will they know the program writes to the reg. Unless you know what you are doing and know of the right software to use you may or may not find the correct key, let alone the correct value. I would opt for some special file if autolisp were able to write to binary. Guess we could always write a small C++ app to handle that part.
Logged
TheSwamp.org  (serving the CAD community since 2003)

JohnK

  • Administrator
  • Seagull
  • Posts: 10626
lisp security
« Reply #14 on: December 08, 2003, 02:11:51 PM »
Just write a crap load of "^@" symbols to the file and add some text to it. Give it a goofy extension. (Thats what i would do.)

VB can write binary. (But Cpp is cooler.)
Logged
TheSwamp.org (serving the CAD community since 2003)
Member location map - Add yourself

Donate to TheSwamp.org

Ron Heigh

  • Guest
lisp security
« Reply #15 on: December 08, 2003, 02:32:51 PM »
I would be more interested in a program that had an encryption algorithim included in the source.
This would stop all users who didn't know how to "crack".
Logged

JohnK

  • Administrator
  • Seagull
  • Posts: 10626
lisp security
« Reply #16 on: December 08, 2003, 02:39:57 PM »
:? You got one! (The VL IDE) I think your taking this to the extreme. If i wanted your programs that bad Ron, I would write my own. As Mark said, the avg. user isnt even gonna check the Reg. so what makes you think that ... whatever.
Logged
TheSwamp.org (serving the CAD community since 2003)
Member location map - Add yourself

Donate to TheSwamp.org

Craig

  • Guest
lisp security
« Reply #17 on: December 08, 2003, 02:50:42 PM »
Ron, just as se7en said, I would probably just place a security file within the Autocad folder and give it an extension that doesn't stand out, you know like acad.mpi or ddvpls.tbl. Then incoporate your security into this file. Make it read every 5th or 6th character on until it gets all the characters it needs to fulfill the criteria needed. As everyone else has stated, your average CAD user won't have a clue what to look for.
Logged

JohnK

  • Administrator
  • Seagull
  • Posts: 10626
lisp security
« Reply #18 on: December 08, 2003, 02:53:46 PM »
Im sorry Ron, but i just think your being WAY to paranoid.
Logged
TheSwamp.org (serving the CAD community since 2003)
Member location map - Add yourself

Donate to TheSwamp.org

ELOQUINTET

  • Guest
lisp security
« Reply #19 on: December 08, 2003, 02:55:10 PM »
i don't have a clue so it seems to work   :roll:  

dan
Logged

Craig

  • Guest
lisp security
« Reply #20 on: December 08, 2003, 02:58:50 PM »
Ron I'll tell you, the one who should be paranoid is Se7en because in two weeks he's going to be on Minnesota nightly news covering his face with his coat because he destroyed his employers computer system and went and shot everyone at Intellicad :twisted:
Logged

ELOQUINTET

  • Guest
lisp security
« Reply #21 on: December 08, 2003, 03:02:59 PM »
yeah most cad users can't even spell encryption algorithim much less know what the hell it is... like me copy paste hehehe

dan
Logged

Ron Heigh

  • Guest
lisp security
« Reply #22 on: December 08, 2003, 04:10:20 PM »
Your suggestions won't work in our case.  We need to be able to give our routines to subs and have them expire every month.  I want a nag box to popup and stop all routines until the correct code is entered.  Just placing the code in a file is less work that using the registry though, good suggestion.  We can send the file to the user every month until their contract ends.  It would still need to be undeciferable though.  Some of our subs have programmers of their own who could crack it.
Logged

SMadsen

  • Guest
lisp security
« Reply #23 on: December 08, 2003, 04:44:20 PM »
Don't think the weakest link will be the encryption method, but how to recognize which routines to block and how to block them.
Are you going to implement a call to a main check routine within each of your routines?
Logged

Ron Heigh

  • Guest
lisp security
« Reply #24 on: December 08, 2003, 04:57:18 PM »
We have 2 major programs we are concerned with.
Each of these programs will make a call to the security routine everytime they are used.
A past employer had a similar setup that actually overwrote all *.lsp files in the support path if they expired.
Logged

Keith

  • Villiage Idiot
  • Seagull
  • Posts: 16899
  • Superior Stupidity at its best
lisp security
« Reply #25 on: December 08, 2003, 04:58:54 PM »
You counld include the API for a demo and send a VB file with it. I will look up more info on that later.
Logged
Proud provider of opinion and arrogance since November 22, 2003 at 09:35:31 am
CadJockey Militia Field Marshal

Find me on https://parler.com @kblackie

JohnK

  • Administrator
  • Seagull
  • Posts: 10626
lisp security
« Reply #26 on: December 08, 2003, 05:18:21 PM »
Undeciferable is the easy part. Make everything in there useless! Make it a garbage holder with a small key that you look for. -e.g. Find your name in this garbage.

Quote
^AL!This program cannot be run in DOS mode.^@^ MZ @^@%^^@%^^@%^^@%^^@%^^@%^^@%^MZ l^D^@^@^D^@f=Ԕ^@^@tSE h^a^@^@tFS."/^@M
^@^@B^D@^D^@^@tED^@_^][^D^@A SV WPU|^@PaQ^@0Q^@j^@2蕍Q^@;t^^N ^@%^^@%^^@%^^@^@j^@Qh"^^@^@RU|^@_^^A[_
^[Ðd^@^@^@jh+^@Pd%^@^@^@tSV
3W9(^A5t^@^^@8Z^C^@^@^@^@j[U|^@ĀO^@^
@D$TPU|^@V L$QRt{^@N D$
PQ\$ \$<{^@%^^@%^^@%^^@D$(L$ |$ T$+L$$+ϋ|$
ωT$0T$D$8D$ L$4RL$0PQ|$8{^@t
ƆY^@%^^@%^^@%^^@^@^A ^a^@^@Y^@%^^@%^^@%^^@^@^@f ^@^@VL$TfI^@%^^@%^^@%^^@^D^@
T^@$^@^@;t^AVPlU-H^@3;~T
D^@V. 526f 6e20 4865 6967 680d 0a
Rl^@%^^@%^^@%^G;|VL$D蜌Q^@^@^@Ƅ$^@ ^@^@ ^A:^@%^^@%^^@%^^@%^^@%^^@%^^
Logged
TheSwamp.org (serving the CAD community since 2003)
Member location map - Add yourself

Donate to TheSwamp.org

rugaroo

  • Bull Frog
  • Posts: 378
  • The Other CAD Guy
lisp security
« Reply #27 on: December 08, 2003, 07:05:26 PM »
Ron -

I have a program that will do what you would like...I can't remember how much I paid or where, but I will look when I get home tonight... It encrypts the lisp file that you want in to an 'AutoCAD Protected File'... If you want it, let me know, and you can at least try it out and see how well it actually works.

Rug
Logged
LDD06-09 | C3D 04-19 | Infraworks 360 | VS2012-VS2017

Keith

  • Villiage Idiot
  • Seagull
  • Posts: 16899
  • Superior Stupidity at its best
lisp security
« Reply #28 on: December 08, 2003, 07:26:08 PM »
AutoCAD protected Lisp files are not secure and can be easily unprotected. That is why the VLIDE compiler is so good. It compiles the lisp, and vlisp into machine code and gives it a .vlx extension.
Logged
Proud provider of opinion and arrogance since November 22, 2003 at 09:35:31 am
CadJockey Militia Field Marshal

Find me on https://parler.com @kblackie
Pages: 1 2 [All] |   Go Up
« previous next »