9

I asked this question over on the reverse engineering Stack Exchange but was told to post it here instead, even though I felt the question didn't really fit here.

To recap, I'm writing some (open source) software that talks to some hardware. The communication is encrypted, but I managed to find the encryption key in their app. I know I can't distribute the key, but can I give people instructions on how to find the key?

I was planning on making it step-by-step (e.g. "go to app-downloader.example.com, type in 'com.example.app', download the file, upload it to app-decompiler.example.xyz and look in path/to/private.key"), but also wondered itf it was better to scale it back (e.g. "download the app, decompile it, look in there for the password").

I plan to chat to a lawyer when it comes closer to release time, but for now, I'd like to know if I should put the effort in documenting the process or not.

EDIT: To further clarify, my app's purpose is to achieve interoperability, or in this case, operability. The app which houses the private key is literally unusable -- I've made 30+ attempts and tried three different phones and their app won't connect to their hardware. Many others are experiencing the same (1.6/5 stars on Google Play, 16 1-star reviews out of 24 total). Early signs tells me that my code could connect, providing I can encrypt and decrypt the information necessary. Support is non-existent (they stopped replying to comments mid last year, and no updates in that long either).

U.S. Code § 1201 - Circumvention of copyright protection systems tells me that:

Notwithstanding the provisions of subsection (a)(1)(A), a person who has lawfully obtained the right to use a copy of a computer program may circumvent a technological measure that effectively controls access to a particular portion of that program for the sole purpose of identifying and analyzing those elements of the program that are necessary to achieve interoperability of an independently created computer program with other programs, and that have not previously been readily available to the person engaging in the circumvention

So as far as I can tell, I'm within my rights to create the code, as my goal is to achieve interoperability, by letting users control this hardware (a Chinese version of a Belkin WeMo WiFi switch) with their home automation system.

So my goal isn't to "stand outside a bank at midnight and offer to give away the access code to the front doors", but rather to stand out the front of a bank during opening hours and show them how to operate the door when they can't get in, and the bank refuses to fix the door.

EDIT 2: Since then, I've discovered that I can make this key extraction process even more generic. The app can be freely downloaded from their website. If I download it, read a single file in there and tell my computer to find anything that is 16 alphanumeric characters long in that file (the encryption type they use states that the password MUST be 16 characters long), then it can find it.

So now that's what I'm attempting to focus on, because I don't need to distribute anything, I just need to write code to download the file from their public website, pull out all the 16-character long strings from the file (there are a few) and try each key until the correct one is found.

Improve this question
6
  • Interesting question. One could argue that, once you distribute instructions, you have no way to ensure that other people will be using the private key just to achieve interoperability, and thus, that you may be helping people to illegally circumvent those protections. However, I'm not sure and I'm not a lawyer, so I'm not going to post this as an answer.
    – A. Darwin
    Commented May 21, 2016 at 8:34
  • The reverse engineering subsection you excerpted has FOUR paragraphs, of which you cited only the first.The other paragraphs outline the non-infringing criteria of such reverse engineering and you must follow ALL of them if you want to "make them available to others".
    – Upnorth
    Commented Aug 21, 2017 at 3:30
  • @Upnorth: I'll read over those again, as you make a good point about me not citing all four. Also see my second edit, as my tactic has now changed. Rather than looking to distribute part of the key, I've now got a script that downloads the file from their website, pulls out a single file, gets all 16-character long strings and tries those until the right one is found. Gone from billions of possibilities to 100 or so without distributing even a single part of the key.
    – Grayda
    Commented Aug 21, 2017 at 23:17
  • 1
    @grayda If challenged, someone doing as you suggest would still have the burden of proving that "such means are necessary to achieve such interoperability" and that supplying such info does not exceed the extent necessary to avoid being a copyright infringement. § 1201 (f)(2).
    – Upnorth
    Commented Aug 23, 2017 at 19:36
  • 1
    @Refineo I never found my answer. The hardware I purchased was from AliExpress so it didn't come with any kind of license in the box. Their software didn't come with any either (that I could find). In the end I uploaded some code that used a regular expression to find the key in a way that limited the amount of searching necessary without being TOO specific (e.g. /A-Za-n0-9/). As it turned out, someone else wrote some software that pretended to be their server so you could control the devices without extracting any keys
    – Grayda
    Commented Feb 20, 2019 at 19:53

3 Answers 3

Reset to default
1

So it's a confusing conundrum. In the United States, it's illegal to talk about bomb making for the purposes of committing a criminal act, but it's not illegal to discuss making the same bomb for an academic purpose (discussing the manufacture of a bomb for a terrorist attack you are going to commit is bad. Discussing how Timothy McVeigh designed his bomb for maximum damage in the Oklahoma City Bombing is good.) If someone takes knowledge gleaned from the latter situation and uses that knowledge in the former situation than it's probably going to get uncomfortable questions from the investigators, but you are not the bomber, nor was your intent malicious.

More to your own concern, I was once considering a course in hacking techniques from a professor I enjoyed (ultimately it was an elective that wasn't scheduled) and he explicitly told the group that when he has taught it he's made it explicitly clear that they were on their own if they actually used any of the techniques taught in the course for an actual computer crime. This was just advanced demonstration of how to both do this stuff and thus what signs to look for.

Improve this answer
1
  • 1
    So what's the answer? Can the OP distribute instructions on not?
    – Greendrake
    Commented Apr 19, 2019 at 0:25
0

No, you can not tell people how to break the encryption. The encryption is a form of DRM and is protected under the Digital Millennium Copyright Act. For a while, hacking your own device was illegal under that law, but doing it on your own device is now considered legal. https://www.extremetech.com/electronics/279575-its-now-legal-to-hack-drm-on-your-devices-to-fix-them

Telling others how to do it, would not fall under the exemption that allows you to modify your own devices, since you would be decimating a way to break encryption even if you do not break it yourself.

Improve this answer
3
  • Is there any relevant case law supporting that idea, that you can not publish vulnerability of the encryption scheme? It is even quite common in cipher community.
    – Pavol Travnik
    Commented Apr 18, 2019 at 19:44
  • You can publish a vulnerability. Yes that is 100% legal, that is different than telling someone how to break into something specific encrypted.
    – Putvi
    Commented Apr 18, 2019 at 19:45
  • This isn't really about breaking encryption in the typical sense (e.g. finding a vulnerability and using that to bypass encryption). This would be analogous to sitting someone down at a computer and saying "I want you to log in. I can't tell you what the password is, but I can narrow it down for you by telling you what letters and numbers the password doesn't contain" then letting them go to town.
    – Grayda
    Commented Apr 20, 2019 at 4:05
0

I am not a lawyer.

Albeit a different take on issue, but why not just distribute the private key, but not indicate how the key is used?

Facts are not copyrightable, see this answer. As long as you do not aid in copyright infringement, distributing a fact like the private key in this piece of hardware is this pair of numbers and it uses this algorithm for encryption is most likely legal and probably protected under the first amendment. Of course, asserting this could involve significant legal expense, but some states have legal provisions to prevent abuse of the courts in attempt to stop protected speech which help significantly defray costs.

Additionally, describing the factual process by which the key was obtained is also likely protected by the first amendment. Of course in doing so you may admit to other criminal/civil violations and the product of these violations would of course not be protected in that case.

Improve this answer
2
  • That doesn't sound right to me. After all, George Hotz (Geohotz) got hit pretty hard by Sony for doing just that. Even if he had just released the key without saying what you could do with it, it's a private key, so any reasonably cluey person would know it could be used to sign your own code or enable piracy.
    – Grayda
    Commented Apr 20, 2019 at 3:58
  • @Grayda I think Geohot didn’t have the will/money to challenge the suit. I don’t think the theory that a set of prime number could be considered illegal has ever been adopted.
    – Viktor
    Commented Apr 20, 2019 at 4:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .