0

My company has received a command-line stand-alone (ELF) executable from a Korean company that provides a service for validating Korean users. It took them a few tries to get us a version that runs on the latest release of FreeBSD.

They will not give us the algorithm for encrypting or decrypting the data sent to/received from their service. They probably have a secret key embedded in the compiled file.

The example website code they provide indicates that this stand-alone executable only does encryption and decryption of the data sent over the wire.

As part of our security review, we would like to find out does the compiled file only do the encryption/decryption or does it send information to another site/service.

Are there any US precedents or laws governing reverse engineering of foreign company obtained code for security reviews?

Improve this question
1
  • I'm having a hard time understanding what the question is based upon what is written, in part, because there is such heavy use of the passive voice in this question. It isn't clear who is doing what to whom. How did you receive it? What is your interest in this? What are you worried about someone claiming that you have done improperly? Are you worried about violations copyright law, or trade secret theft accusations, or violations of national security laws or what? What will you do with the results once you have them?
    – ohwilleke
    Commented Oct 9, 2018 at 1:17

1 Answer 1

Reset to default
1

Are there any US precedents or laws governing reverse engineering of foreign company obtained code for security reviews?

Yes there are, and they indicate that you may reverse engineer the executable.

Regarding misappropriation of trade secrets, 18 USC § 1839(6)(B) explicitly states that "improper means" does not include reverse engineering, independent derivation, or any other lawful means of acquisition.

See also Oracle America, Inc. v. Google LLC, 886 F.3d 1179, 1200 (2018):

In Sony, the court found that the defendant's reverse engineering and intermediate copying of Sony's copyrighted software system "was a fair use for the purpose of gaining access to the unprotected elements of Sony's software." 203 F.3d at 602. The court explained that Sony's software program contained unprotected functional elements and that the defendant could only access those elements through reverse engineering.

The rest of that paragraph (omitted here) is about transforming vs. plagiarizing software, which seems irrelevant to your situation because you are essentially trying to ascertain the embedding of secret key(s) and the application's use of sockets.

You will find additional cases with queries such as http://www.leagle.com/leaglesearch?all=software&exact=reverse+engineering&crt=Federal+Circuit , maybe trying different search parameters and/or jurisdictions.

So load the ELF file with the disassembler/debugger of your choice and start setting those breakpoints on int $0x80!

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .