22

You all know there are people out there that use reverse engineering techniques to do bad things; this ranges from being able to use paid software for free (cracker) to finding vulnerabilities that allow them to do what they want when they want without permission (hacker). Of course, there is also a good side to it; we can use this to protect software against such people, use it to learn from things.

But where does one know if he is allowed? How does one ensure he conforms to laws and licenses?

Software and services do not always list this in their license or come with a NDA, I don't know if the law explicitly states anything about this; so, this would leave one to often be clueless ...

  1. whether he is allowed to reverse engineer.
  2. whether he may use his findings, for which goals.
  3. under which conditions he may or may not publish his results.

What to do when it is not stated? Does one have to explicitly ask it, or is their some rule on this?

It is wise to just ask; though a canonical answer would benefit the majority and spare out asking.

closed as not a real question by asheeshr, APerson, 0xC0000022L, Jesper.Reenberg, Brendan Dolan-Gavitt Mar 27 '13 at 18:40

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    Did you mean "do what they want when they want without permission"? – Ken Bellows Mar 19 '13 at 19:26
  • Oops, skipped a few characters there; thanks. – Tamara Wijsman Mar 19 '13 at 19:44
  • 1
    I voted to close this question as too broad: there's just no way to cover all situations and locales. There have been a couple of good answers, so I'd like to salvage this question, but I can't see a good way to edit it to make it useful. If anyone has an idea, please step in. – Gilles Mar 19 '13 at 22:15
  • Yes, it has been asked in an attempt to help shape the community; and because it jumps on someone's mind sooner or later anyway, I think it is valuable and should be salvaged if possible. If not, we're one step closer to having defined a broad sense of what the borders of this community should be. – Tamara Wijsman Mar 19 '13 at 22:45
  • 1
    This is just too broad at the moment. It needs to be made more specific or needs to be reduced to cover just one of the many aspects that its trying to cover. – asheeshr Mar 20 '13 at 13:01
22

The answer, as in most things, is "it depends". Firstly, it depends on the country you are in, different countries have different rules with respect to reverse engineering.

Now in the United States reverse engineering is generally considered to be a legitimate form of discovery mainly due to the fact that it encourages innovation. There is legal precedence for reverse engineering being lawful:

Most major companies do buy and reverse engineer products of competitors once they are available, my source for that is myself as I worked for a cell phone company that engaged in that exact practice. Typically speaking, if you buy a device you're free to do whatever you want with it; trade secret law only protects the owner of the secret from others improper acquiring of that secret (you don't break into someone else' place of work and take a prototype)

The scope of a NDA is totally different. If the company tells you about un-patented trade secrets, you can't disclose that information. Once the company patents the secret, it's no longer a secret (you don't even have to reverse engineer at that point, the details are available from the patent office)

As there is legal precedence to allow reverse engineering, you can publish your results. It happens all the time. When a company doesn't want you doing this, they put layers and layers of security in the code to protect it. Again... the cell phone company I worked for did this with the bootloader.

....that said, bypassing anticircumvention devices is a separate issue covered by section 1201 of the DMCA which forbids reverse engineering if it involves circumvention of a technological protection measure.

So if you want to learn how something works, if you want to make sure you have interoperability with a product, if you want to do encryption research or security testing... go for it. If you want to reverse engineer some software to make a key gen so people don't have to buy it... I would keep that to yourself.

Hope that helps.

  • 1
    Wait, so "bypassing anticircumvention devices" is not allowed? How does this work in theory and practice? I'm going to say that this can't be true because there are tons of people who reverse engineer obfuscated code (think: obfuscated javascript). Also, there are stuff like DeDRM (cf.) which had to be legal as Github hasn't been forced to take it down. – Pacerier Jan 23 '16 at 3:11
15

The book Reversing: Secrets of Reverse Engineering by Eldad Eilam provides some guidance on the legality of reverse engineering within the United States. The book recommends seeking legal counsel before starting any "high risk" reversing project, and then gives the following sections as guidelines as high risk.

Interoperability

Using reverse engineering for interoperability purposes has been supported in the US judicial system. Accolade, A California-based game developer was sued by for copyright infringement in 1991 by Sony after reverse-engineering the Sega Genesis programming interface and publishing games for the Sega Genesis. Accolade won the court case because the Accolade games did not contain any of Sega's code and because of the public benefit resulting in the increased competition.

Competition

Reverse engineering may be considered illegal when used to steal code from a competing process.

Trade Secrets and Patents

Reverse engineering patented technology would not make sense since the patent information is already public. Trade secrets exist to protect developers in the case where a malicious employee may attempt to sell of a secret to a competitor. A product being a trade secret does not protect its the developer in cases where a competitor reverse engineers the product as long as the product is available on the open market and was obtained legitimately.

Digital Millennium Copyright Act

The DMCA legally protects copyright protection systems from circumvention. The DMCA does not apply to any other type of copyrighted software, and therefore many reverse engineering efforts will not be subject to rules and exceptions granted by the DMCA. The things that are explicitly prohibited under the DMCA:

  • Circumvention of copyright protection systems
  • Development of circumvention technologies. The book mentions specifically that a keygen would be a good example of a circumvention technology. But the book does not mention how tools use to create circumvention technologies (IDA Pro, for instance) are covered.

However, there are exceptions in which circumvention is allowed.

  • Interoperability "reversing and circumventing DRM technologies may be allowed in circumstances where such work is needed in order to interoperate with the software product in question. For example, if a program was encrypted for the purpose of copy protecting it, a software developer may decrypt the program in question if that's the only way to interoperate with it."
  • Encryption Research Circumvention is allowed so long as the protection technologies interfere with the evaluation of the encryption technology
  • Security Testing Reversing and circumvention is allowed for the purpose of "evaluating or improving the security of a computer system"
  • Government Investigation
  • Regulation The DCMA allows for DRM technologies to be subvereted for the purposes of regulating the materials accessible to minors on the internet.
  • Protection of privacy "Products that collect or transmit personal information may be reversed and any protection technologies they include may be circumvented."

License Agreement Considerations

With regard to the anti-reverse-engineering clauses found within software license agreements, Eilam says there is no single, authoritative answer and that it all depends on the specific circumstances of the reverse-engineering effort.

Wikipedia also has a section on the legality of reverse engineering which claims that "courts have found such contractual prohibitions to override the copyright law which expressly permits it; see Bowers v. Baystate Technologies"

It should be noted that Bowers v. Baystate Technologies established that license agreements can preempt fair use rights as well as expand the rights of copyright holders beyond those codified in US federal law.

  • I'd add an endorsement of Eilam's book, it was well worth the time to read. – WPrecht Mar 20 '13 at 18:36
9

It may also be worth considering how laws can be abused to pressure those engaged in reverse engineering to stop and withdraw their findings - the anti-circumvention provisions on the DMCA is often abused for this reason.

A great example is the factoring of the TI-83+ signing key - the intent wasn't to enable piracy, but TI used this claim to try and stop the research.

The EFF has documented a number of cases of such abuse - it's a disturbingly common tactic to stop researchers. Even in cases where you are fully within your rights, it's hard to fight an army of lawyers.

6

If you have a legal issue you consult with a lawyer. Even a lawyer will never ensure you of anything. They will provide legal advice based on precedent. If you want to explore the matter in depth you need to go to trial.

That said, and this is not legal advice, in the USA you are generally allowed to publish anything which is not covered under a agreement between you and another party stating that you will not do so and which is not classified information. This is because of your first amendment rights.

Not the answer you're looking for? Browse other questions tagged or ask your own question.