2

I'm just curious. What if someone were to crack a program to get past a registration window/process and then bring this vulnerability to light? Can the owner/creator prosecute you for doing so, even if you were trying to help him or her?

  • 2
    Yes. Even if you did nothing illegal you can be sued. Generally I would recommend a throwaway email, with necessary precautions for maximum anonymity, to report the vulnerability. – mrexodia Jul 30 '18 at 23:46
  • 3
    One of the first questions dealt with this topic in general. Your question lacks all the relevant details such as - but not limited to - the jurisdiction you are asking about. Unsurprisingly you will hardly find lawyers among this crowd and if you happened to find one, I doubt you'd get free advice. While we tend to be aware of legal implications of our actions in jurisdictions relevant to us, advice you get from us may be severely flawed. So for example despite our saying otherwise, you may still end up being sued. – 0xC0000022L Jul 31 '18 at 7:19
  • @0xC0000022L That makes sense. I don't personally have the skill to do such a thing but I was curious what the outcome may look like for someone who did happen to come forward with this sort of thing. Thanks! – Keithers Jul 31 '18 at 21:58
4

I am not a lawyer. Basing your actions on anything I've written will be at your own risk. If searching for legal advice you should really consult an expert in the relevant legal field instead of community-driven sites

First of all, cracking a program is not the same as finding a vulnerability in it. Although cracking a program may cause financial damages to the manufacturer, it does not pose any risk to the users. Additionally, except for unique DRM-ed software and where advanced anti-theft features are in place, manufacturers do not tend to combat cracks too thoroughly, piracy is an accepted lost of revenue to some extent.

I'll start by pointing at a relevant Israeli proverb - Peeing from the diving stand:

The statement is based on the fact that everyone knows that many pee in the swimming pool. While the general public prefers to ignore this wrongful act that it can not act against, the public will not stand in silence if someone does the same thing, peeing in the pool, from the diving stand.

This goes to say if you're doing something wrongful, which you're aware might have legal implications, you should at least do it in private and not boast about it.

Now, for the legality of cracking a piece of software and reporting that to the manufacturer; Although this greatly depends on the laws in the country / state you live in, it is usually not illegal per say but does violate most End User License Agreements, which you're bound to by using the software. Most software EULAs explicitly forbid any type of reverse engineering of the provided software and any of it's components.

  • This is perfect, and makes complete sense except for one part. Why would cracking software not be finding a vulnerability? Is it more the vulnerability of the architecture, and thus not the software itself? I appreciate you taking the time to answer. – Keithers Jul 30 '18 at 23:59
  • People usually mean something that would let an attacker gain access or higher privileges in a victim's machine. This gives an attacker access to data and resources that belong to someone else. Cracking does let you use a software you're not suppose to, but does not put anyone in risk. In contrast, cracking is expected to be a cat and mouse game where the major advantage of anti-cracking is raising the bar. – NirIzr Jul 31 '18 at 0:44
  • Legislation overrules EULAs. So you may not be bound by such a restriction. As an example: within the EU it's alright to reverse engineer something for interoperability purposes. – 0xC0000022L Jul 31 '18 at 8:21
  • That's clearly not what OP's asking about, though.. – NirIzr Jul 31 '18 at 8:41
  • Nirlzr you say cracking doesn’t put anyone at risk, but for example car manufacturers have software that allows you to mess with counters and settings on a car. This software is usually protected with DRM to only give authorized dealers access to these settings (which could probably cause harm if set improperly). – mrexodia Aug 2 '18 at 9:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.