Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!


Forgot your password?

Deciphering Windows Product Activation 339

Stephen Lau writes: "Fully Licensed GmbH seems to have deciphered and analyzed the WPA code that Microsoft plans to use to protect from privacy in future products. They've got source and executables up on their site..." As well as an interesting paper which purports to describe the activation process but does not provide details on how these guys reverse-engineered it.
This discussion has been archived. No new comments can be posted.

Deciphering Windows Product Activation

Comments Filter:
  • by RelliK ( 4466 ) on Monday July 09, 2001 @09:53PM (#95927)
    You are assuming that MS would actually be able to successfully prosecute these guys for reverse engineering. Here's a newsflash: reverse engineering is legal. Europe has neither DMCA nor UCITA. The world is bigger than US.
  • When you re-activate, naturally you'll have to generate a new Installation Key and they'll be able to see exactly what components you changed out. Fun, huh?

    Oh my yes! Of course, they won't necessarily know who YOU are, since product REGISTRATION is separate from product ACTIVATION -- and not required to use WinXP.
  • I am a thinking person, and can form my own opinion.
  • After a thick perusal of the paper, I'm still at a loss: can xpdec actually *crack* anything? I've used it on my Product Key, and it does produce a proper Product ID, but has anyone actually used this to try to crack one of the RC1 copies?
  • by BroadbandBradley ( 237267 ) on Monday July 09, 2001 @09:56PM (#95934) Homepage
    Registration by phone line, you'd think most people are/will be still stuck doing this.
    Caller ID, plus a reverse phone number lookup and what more do you need to know?
    Can a MAC adress be linked to your IP by going to a site or server (windows update active X controls?)?
    Lookup a name and get a street adress, use public records to see who owns the home and it's value. you know they'll get the IP and know all about the computer, partner with doubleclick(or whoever) for tracking surfing habits..

    it's not the information that's transmitted, it's what they can do to link it to you

    who owns your data?
  • At the usual place. Click on my sig, go into the windows_product_activation directory.
  • by number one duck ( 319827 ) on Monday July 09, 2001 @08:36PM (#95936) Journal
    What is the phone number? If all they want is someone to read off 32 digits to them, I'm more than happy to play from time to time.

  • how does it hurt MS when a home user borrows their friend's Win95 CD? The more times Win95 is installed, the more people are using it and the more likely that person is to become a valuable Windows-using consumer. Buying Windows software, perhaps purchasing a new computer with Win98 preinstalled. Requiring a Windows PC at work. Purchasing upgrades.

    So you're saying someone installs windows by borrowing a friend's CD ... and then you think that person is likely to want to pay $XXX for an upgrade later on? Not likely. They'll split the cost with one or more friends, or just out-and-out steal it one way or the other ("borrowing" a CD from work, downloading it off warez, whatever).

    Now Microsoft institutes a plan that makes these practices more difficult. They don't try to make it uncrackable, because that's impossible, but they prevent your average user from borrowing the disk from a friend or from work. I bet you'd be surprised how much money we're talking about.

    Your idea that Microsoft's OS monopoly gains from piracy only has merit so long as you acknowledge that one day Microsoft must one day squeeze those pirates for their long overdue gold.

    Today is that day...
  • Mod this guy down (or the replies up), since clearly his main point has been shown to be false, yet it's getting more 'weight' than the truth of the matter, i.e. that you can cancel out of the MacOS registration and further it does not require a serial number like Windows does.
  • I'm sure that these guys probably do know how the key is done. If they were able to figure out some of the obscure techniques that was used here i'm sure that they took it 1 step further and using known wpa codes and keys provided by microsoft developed an algorithm.

    Well then...maybe not :)
  • Um... think for a second (I know, it's late...)How could businesses list their losses from piracy?

    Today we lost 4366.99 from people copying our software without us knowing.

    In case you can't figure it out, there is no way for them to know. They know how many boxes they sold, because they can count them. Not so with unlicensed copies.

  • by hammock ( 247755 ) on Monday July 09, 2001 @10:14PM (#95947) Homepage
    Here is an account of what network connections Windows XP RC1 make when it is installing itself.
    It does all this without prompting the user.
    The box was isolated at and had ALL outgoing traffic denied and logged, these are the highlights.

    device eth0 entered promiscuous mode
    device eth1 entered promiscuous mode

    Packet log: input DENY eth1 PROTO=17 L=76 S=0x00 I=5 F=0x0000 T=128 (#5)
    time.windows.com (
    This one is rather obvious, it sets the operating system clock, but don't try using netdate on it, it's proprietary to Windows only (whoops!)

    Packet log: input DENY eth1 PROTO=6 L=48 S=0x00 I=88 F=0x4000 T=128 SYN (#5)
    (microsoft.com, www.domestic.microsoft.com, and microsoft.net address pool)

    Packet log: input DENY eth1 PROTO=6 L=48 S=0x00 I=770 F=0x4000 T=128 SYN (#5)
    (wpa.one.microsoft.com try https [] to it and see the certificate yourself!)
    This is the Product Activation certificate, it attempted to connect to this server an incredibly large number of times.

    Packet log: input DENY eth1 PROTO=17 L=48 S=0x00 I=673 F=0x0000 T=128 (#5)
    Not sure what it did here, is the gateway I don't have the packet data at all, I'll do that in the near future. MAD props to brewt for some of the info!
  • I just tried it actually. XPDec DOES NOT create a Confirmation ID from an Installation ID which is what would be required to crack WPA. XPDec simply serves the purpose of allowing the user to understand what pieces of hardware affect the Installation ID sent to Microsoft.

    Read the docs - they seem to have a very high opinion of WPA and feel that alot of the "fears" about it are unfounded to say the least.

  • Right! Right?

    I'm sure one of you guys could do it. For the Fun of it of course. It would only be a tool for learning of course.

    Someone want to prove me wrong?


  • Apparently not. According the article you need to change 4 things, not just fuck around with the RAM.
  • by DNS-and-BIND ( 461968 ) on Tuesday July 10, 2001 @12:37AM (#95952) Homepage
    Silly man, Al Gore invented the Internet...

    This is a first, a businessman taking credit for something a politician did...

  • Now, call me stupid if you want, but I really don't think we can set too much store by your experiences with a release candidate version of an OS.

    Wait until you've got the real thing, then start telling people about how much better it is than they feared.

    It would be so easy to check the build number, and if it contains "RC", say "Thanks for choosing Microsoft!" and set the system death timer ticking (they are time limited, after all...), else show compulsory "life history" registration form...


  • by cicadia ( 231571 ) on Tuesday July 10, 2001 @01:05AM (#95956)

    That doesn't look like it was done in the the name of "interoperability" at all ...

    But of course it was:

    "My copy of Windows XP didn't work any more after I changed my hardware, so I took it apart to find out why! Oh, and by the way, here's what I found out..."

  • I think the problem with many of the replies here is that many argue "all you have to do is press CMD-Q". Like the registration process for XP, Apple seems to neglect giving you that information as well. People are comparing apples and oranges when really they're comparing apples and apples.
  • Thanks. That's what I kind of thought. The basic information is comforting as well (you have to change 4 hardware components for XP to balk) that definitely allays some of my fears about a majority of my upgrades (video cards and RAM).
  • It uses SNTP, a derivative of NTP. Most NTP servers seem to have problems out of the box working correctly with SNTP. To set an SNTP server in Windows XP, use the following commands:

    C:\> net time /setsntp:tick.usno.navy.mil
    C:\> net start w32time

    To get statistics on your SNTP operations and servers, use the w32tm.exe tool as such:

    w32tm /resync - Resync your SNTP time
    w32tm /stripchart - Display time differences

    Hope that helps!


  • I agree.

    Another interesting tidbit: Business are required to list losses on their financial statements, but they never list Piracy as one. Go figure.
  • In MacOS 9.1 you can just force quit the registration and rebood. If you try that in MacOS X though it just restarts it.
  • by Anonymous Coward
    Isn't this whole thing just a matter of time and programmer determination anyway?

    Isn't everything?


  • by gburgyan ( 28359 ) on Monday July 09, 2001 @08:50PM (#95971) Homepage
    The key they removed (from the source) is:

    void KeyedHash(unsigned char *Data, unsigned char *Result)
    SHA_CTX Context;
    unsigned char Digest[20];
    static unsigned char Key[4] =
    #error The key has been removed from the source code. Please obtain the executable.

    SHA1_Update(&Context, Data, 8);
    SHA1_Update(&Context, Key, 4);
    SHA1_Final(Digest, &Context);

    memcpy(Result, Digest, 8);

    Doing a quick disassembly of the code:

    00401590 KeyedHash proc near ; CODE XREF: sub_4015F0+19p
    00401590 var_74 = dword ptr -74h
    00401590 var_70 = dword ptr -70h
    00401590 var_60 = byte ptr -60h
    00401590 arg_0 = dword ptr 4
    00401590 arg_4 = dword ptr 8

    ...stuff deleted...

    004015AE push 4
    004015B0 lea eax, [esp+88h+var_60]
    004015B4 push offset dword_40A034 ; ********** MAGIC!
    004015B9 push eax
    004015BA call sub_402170

    ...more stuff deleted...

    004015E8 retn
    004015E8 KeyedHash endp

    And the location they referenced:

    0040A034 dword_40A034 dd 0D45EC86Ah

    Thusly, the key should be 0xD45EC86A.

    More than one can play this game.

    Enjoy! (Sorry for the formatting, /. doesn't allow <pre>'s)
  • by mpe ( 36238 ) on Monday July 09, 2001 @10:28PM (#95975)
    I haven't seen any of the license agreements concerning Windows installs that have WPA, but I assume that there's something against reverse engineering.

    What if there is? Anything in an EULA which against the law is automatically void. Germany still appears to have laws protecting free speach in the area of software examination.
  • Didn't you notice the CANCEL button in the installer when it went to send your information?

    You know what happens when you press that button? It doesn't send the info and moves along its way...

  • by jeko ( 179919 ) on Monday July 09, 2001 @08:52PM (#95980)
    Like the rest of us, I've started passing out tapes loaded with my 90 minute speech to answer my non-geek friends and relatives when I hear them ask "Why won't the gov'mint just leave that nice Gates man alone? He invented the Internet, didn't he..."

    I was actually looking forward to the day when I could say, "Well, Grandma, I could change your busted hard drive for you, but that would mean that nice Gates man would want another $300. Maybe you should just buy another computer..."

    "Buy another computer?! What's wrong with you, boy? I'll just shop around for a cheaper copy of Windows! Someone'll will have it on sale..."

    I was so looking forward to listening to Grandma on MS tech support demanding another activation code, and chewing them out when they inevitably refuse to give it to her...

    XP activation was going to be the wake-up call for Joe EndUser. Now that it's been publicly hacked, I'm really rather torn...

  • I think people really are missing this point. It's the same with the Comet cursor and Amazon monitoring where you go. Who cares if you can't tell who's who and it's not a privacy issue. IT IS a privacy issue for the GROUP of us users as a whole - and I don't think Microsoft has a right to know what hardware we have just because we use XP.
  • Okay, so the Ethernet card would be reported as changed in hardware database stored on your computer. What other hardware do you expect to change on a daily bases? Remember, you only have reactivate your copy of Windows when morethen three pieces of hardware change. Also, it seems that MS is more lenient towards laptop users.

  • And then there's the user base argument. When people are pirating your software, they're strengthening your monopoly.

    Well, now that Microsoft's monopoly position has become so strongly entrenched, the marginal value of piracy to them has been reduced. However, their stock price is now embarrassingly low, so pirate users represent a good untapped resource to help reinflate their stock bubble. (Doubling costs to businesses is another good strategy.)

    In fact, this is urgently important to Microsoft, since it hasn't actually turned a profit on software sales in a while ("The Bank of Microsoft" is solely responsible for Microsoft's good looking bottom line), and since it can't use its stock price as currency like it used to. In many ways, Microsoft looks like a falling empire, which it likely is, and pumping up its stock price is a good defence.

    Now be good c1t1z3n5 and pay your Microsoft tax! (Or use something else...)
  • by sometwo ( 53041 ) on Monday July 09, 2001 @09:04PM (#95989)
    I can see the same thing happening with this as what happened with DeCSS. People will start mirroring this file all over the internet. Microsoft will sue everyone who posts the file under the DMCA and also anyone who knows someone who posted the file. The people who made this will get a ton of publicity and it will make MS look even stupider. I wonder if anyone will get this tatooed on themselves or sing it on an MP3. This is gonna turn into a huge mess for MS.

    On a similar note, check out a Salon article on MS's bullying tactics on poor schools: http://www.salon.com/tech/feature/2001/07/10/micro soft_school/print.html [salon.com]

  • In contrast to many critics of Windows Product Activation, we think that WPA does not prevent typical hardware modifications and, moreover, respects the user's right to privacy.

    Typical hardware modifications....

    If you change more than three things, you have to go through whatever hoops Microsoft wants to put you through to use something you've already paid for...

    I don't know about you (or the guys who did this), but the last time I upgraded a machine, I increased the memory (1 change), added a hard drive (2 changes), replaced both the modem and the video card (3 and 4 changes)... Whoops... Went too far, must now cope with Mr. Bill and the XP nonesense...
  • Sure you only have to call in to get a new id when you install three or more items, but what does this say about Microsoft's bet on the stability/longevity of XP? Is Microsoft betting that most people won't have to replace/re-install XP before they replace hardware (in which case they'll have to call anyway)? Or they'll just wait until Windows 2005 comes out while their fragmented hard disk slugs around? Come on ...

    <troll-material>If Win98 is an indication, the 32-bit (kinda) MS OSes benefitted from a re-install every year or so</troll-material>. If I had XP the last two years, I would have had to call them 3 times already!

    But seriously, is the amount of Microsoft investing in over-friendly tech support people that dole out ids going to be worth it for all of this hassel to them and consumers? I could see the XP reg. tech. support staff getting quite large ...
  • It'll take about five minutes for someone (probably many) to figure out that all you have to do to avoid M$ (re)activation hassles is let it figure out your "new" hardware configuration key, then replace the saved "original" with that, and you're nearly done - just cycle through all the possible combinations of a couple of "random" bytes, and all their fancy cryptography is finally toast - as it should be.

    Asia will be cloning millions of copies of WinXP the morning after its released, and M$ won't be getting any product activation calls.

    WinXP and OfficeXP CD's will cost about $1 each in Asia (and that's more than they're really worth). M$ code is just a commodity.

  • I have used the same CD/key of Office 2K on 4 different computers. Each time it has required activation. It has never required dialing the 800 number. On my primary computer I have added ram changed CD drives changed harddrives multiple times(adding etc.) changed video cards rtemoved modems added lan cards...blah blah blah... Mine was the educational version so your milage may vary..
  • Or, like myself, you could just sign on for the WinXP beta program with more than one email address and get all the keys you want. :)
  • This becomes annoying when upgrading machines or replacing them.

    I had a $5 academic license for Office. When the new computer got built I couldn't install it since this copy was already registered. Even after a call to them, they said I had no way to prove I owned the license.

    I think I got brushed off because I only paid $5 for it. The sick thing is, someone else paid big bucks for me to get it that cheap in the first place. Fuck 'em.

    I just installed an older version, and really haven't used it since I started using star office and the like.

    I actually backed up wma files and not realized that is was pointless since I could no longer play them. No one told me that a file I encoded needed a license to play it. Of course trying to play it got my information send to MS, along with the song name etc. Windows Media Player does this automatically.

    I simple don't let that app access the internet anymore. With more MS software that wants to access the internet, the smaller that partition gets.

    XP, not for me. Even if it's 'more stable', it's not going to touch my PC. The first time a window pops up saying I'll need XP, all of windows is gone. Adios Red Alert, adios Kazaa, I'll miss you.

  • by anticypher ( 48312 ) <anticypher&gmail,com> on Tuesday July 10, 2001 @03:05AM (#96006) Homepage

    The hash function can be extremely complex, but given a small range of inputs M (only 2 double words), a hash table of possible values can be pre-calculated. The actual number of possible values for M will be very small, on the order of a few thousand, up to possibly 25,000. The input M to the RC5 hash will be a known, limited number of drive IDs, video card IDs, CD-ROM IDs, etc. micr~1.oft is in the position to have a list of every drive manufacturer and video card identification string, and could use those lists to obtain the original string from the hash.

    This is what password cracking programs do, instead of trying to reverse the hash, pre-compute dictionaries and compare the outputs.

    the AC
  • An often ignored concept ... is that most pirated copies would NOT have been purchased anyways.

    While this may be true about the latest cool game, a computer without an operating system is a very expensive paperweight.

    Microsoft's anti-trust punishment should be a compulsory and immediate donation of $5-billion to the Free Software Foundation. This would shortly spell the end of Microsoft's tyranny.
  • "Well, Grandma, I could change your busted hard drive for you, but that would mean that nice Gates man would want another $300."

    Huh? You mean that (insert expletive) Son of Satan Gates wants you on the phone for 10 minutes to get another key. There's a big difference.

  • My god, think of how much those metrics alone are worth... A snapshot on DVD adoption, SCSI cards, % of laptops out there? Almost seems like the anti-copy stuff is just a smokescreen.
  • I have one thing to add and it may or may not be relevant.. the thing is microsoft arent the only company who do it and the XP asks for less info than the others.

    Install PC anywhere or most virus scanners and they ask for more info, or as one poster pointed out try installing on a mac.

    The fact is that WPA isnt the evil nemesis it is pointed out to be.... yet

    the thing that worries me is not what might be in the product now but what they may have up their sleeve for later.. why not a product that wont work unless you enter a valid credit card (for ID purposes only) or a drivers license number, or a product that is only installable once without you going back and getting another software key (can be done easily you know)... what about a product that appends an invisible piece of code in a watermark that indicates the details of the machine and copy that made it (this is already being done or has been tried)

    these are the things that make me worried - we should be fighting this not beacuse its MS or because it mayb a way to make money, we should be fighting it because it may be the last chance we can.
  • Although judging by the techincal contact of their domain registration, they have some connection to America. Maybe M$ will bring pressure to bear on their ISP? Then again, given that the registration information was updated yesterday, maybe they already prepared for such an event?
  • by jmcmurry ( 3759 ) on Monday July 09, 2001 @07:06PM (#96023) Homepage
    Interesting that they removed the key in their source, but included it in the binaries.

    Kinda like: "Here are the plans to build a nuclear bomb, but we took out the part about where to get plutonium. But if you want one pre-made with plutonium ready to go, we can hook you up with that, too."

    Isn't this whole thing just a matter of time and programmer determination anyway?
  • "Gesellschaft mit beschraenkter Haftung"

    Those nutty Germans! Always with the lots of words, when a single word would do!

    Literally, it translates to "Society with More Limited Adhesion." I'm not sure if that's "more-limited adhesion" or "more limited-adhesion," mind you, but either way sounds like a run-in with a UHU glue stick...

  • What if he had already made three previous hardware changes to his laptop since he last installed Office XP? Unbeknownst to him, his copy of Office XP would be due to become deactivated with just one more change.

    So, he goes on the road, upgrades his RAM, and boom, Office no longer works.

    I don't have a problem with Microsoft requiring that he call a toll-free number or use the Internet to reactivate application; however, I do have a problem when they require that he reenter the serial number to do it. What's the purpose of that? The solution, of course, is to always keep a list of your Microsoft serial numbers on both your computer and in paper form just such a situation happens to you.
  • No matter how many bits you chance, Metallica will never forgive you.
  • "Of course, they won't necessarily know who YOU are since product REGISTRATION is separate from product ACTIVATION"

    And you completely trust MS to never cross-reference this information? We know how well that worked out with the ad agencies *cough*.

    Anyway, even if they don't know WHO you are, they still can track what modifications and upgrades you've done to your system, and all the serial numbers of your equipment. That itself is alarming. I bet it's not that hard to find out from equipment manufacturers, where their products ended up, especially if those parts are individually registered.

  • You do realize that it said simply re-installing XP would necessitate re-activation. I'm one of the unfortunate few that has been stuck with Windows ever since 286's became obsolete, and I'll say that for some strange reason (maybe cosmic rays!) Windows becomes unstable after ~5 months of regular usage and needs a full HD format & reinstall in order to run properly

    This brings up another point about Microsoft's licensing schemes: 'Upgrade' CDs. As many of you know, MS offers upgrade CDs in retail stores that upgrade you to the latest flavor of Win9x, and they offer them for less than the full version of the same flavor. While this is fine, of course, the install program checks your hard drive to see if you have a previous flavor of Win9x installed. If you don't, then you don't get the new flavor.

    Here's where the problem comes into play -- what if a particular user has, through some sort of magically lucky stability, upgrade versions (and only upgrade versions) of everything up to, say, WinME? I.e. Win 3.1 upgraded to Win95 upgraded to Win98 upgraded to WinME. Or, in a more likely scenario (this one has happened to me personally), what if they have a full version of Win95 and upgrades up the rest of the chain? If they need to reinstall WinME, are they to start all over again by installing Win 3.1, and working their way up the chain? And, what if -- oops -- they lose their Win95 CD? Then, although they are legally entitled to install and use Win98/WinME, they cannot do so. I know of people this has happened to, and needless to say it was incredibly frustrating for them not to be able to install an OS they had a legal copy of.

  • by EvlG ( 24576 ) on Monday July 09, 2001 @09:19PM (#96034)
    An often ignored concept (that George Broussard from 3D Realms seems to have understood) is that most pirated copies would NOT have been purchased anyways. There are lots of users that will not use the software unless they can get it for free. So in effect, they can either not pay for the software and use it, or not use it at all. Note that such users dont give ANYTHING to the company anyway; it is just a question of whether or not they will use the sotrware. In this case, the software company enjoys a larger installed base.

    This is most of the reason why I see the Y Company lost $X to piracy as a BS argument. I've always noticed that lots of people won't pay for software at all; if they had to pay they would do without. IN that case, the Y Company is losing $X in potential sales because their price is too high/marketing not good enough/etc... How different is that from any other company in the tangible good and services industries that loses sales because consumers dont want to pay that much for the product? Why, then, should we treat software companies any differently from those that have poor sales policies?
  • Now, it's not only the name of the law that will send Jenna Bush to jail if she looks cross-eyed at a cop, it's the new slogan for Windows! Cool.
  • Wow, you've taken uneducated comments to a whole new level. lol
  • by khym ( 117618 ) <matt&nightrealms,com> on Monday July 09, 2001 @07:09PM (#96037)

    I haven't seen any of the license agreements concerning Windows installs that have WPA, but I assume that there's something against reverse engineering. Not only have these people reverse engineered (part of) the WPA process, but they've published the source code. While they didn't put the cryptographic key in the source, they did put it in the executable, and even clearly proclaim this, almost a wink wink nudge nudge to the people out there who are sure to take the executable appart, get the key, put it back into the source code, and then re-publish the complete, non-crippled source.

    Given all this, it seems like their really asking for MS to sue them. Is something like this covered under an "academic research" clause that allows reverse engineering for research purposes?

    Suppose you were an idiot. And suppose that you were a member of Congress. But I repeat myself.
  • What it does say is that someone knows Microsoft's code well enough to develop a "cracked" version of Windows that would either bypass the check entirely or always generate the same hardware ID number. This hardware ID could be an ID that someone previously had used to activate their copy of Windows. Therefore, if you used his serial number and the activation code that he was given, you could unlock your cracked copy of Windows without ever contacting Microsoft.
  • by mosch ( 204 ) on Monday July 09, 2001 @07:10PM (#96040) Homepage
    I'm so surprised, copy protection that annoys the honest users, and doesn't do anything to stop piracy. Who could've seen it coming?

  • This is ridiculous. Out of all the so-called "mirrors" here, only one link actually bothered to copy more than one page.

    If you're going to "mirror" something, do the whole thing, otherwise when MS forces them to bring their site down, you'll have more than just a page of broken links.

  • by Tom ( 822 ) on Monday July 09, 2001 @11:13PM (#96043) Homepage Journal
    since they are a GERMAN company, and (contrary to the DVD CCAs assumptions in that california lawsuit) germany is not an american state, they are pretty much immune from DMCA-like bullshitting.

    there are two things that could make things ugly for Fully Licensed GmbH. one is a license agreement, but so far, the validity of click-through, shrink-wrap or similiar licenses is highly doubted in germany. AFAIK, none has ever been enforced in a court.
    second, there is a provision against reverse-engineering in the german copyright law. however, it also allows for a number of exceptions.

    one way or the other, since they are a GmbH, the worst that can happen is that they'll be sued out of business, but with no loss to their private capital. so they'll immediatly start a new company under a similiar name and harvest all the free publicity advantages.

    because lastly, sueing them would be the equivalent of saying "yes, we feel guilty. yes, we've done wrong. and no, we can't stand that you found us with the hand in the cookie jar." - a pretty dumb publicity stunt, even for M$ standards.
  • deciphered and analyzed the WPA code that Microsoft plans to use to protect (users?) from privacy in future products.

    Need I say more?

  • True, having a database of the precise hardware used by all your potential customers would be quite nice. IDC and Gartner watch out!

    But also, imagine how useful it would be to have a database of the precise hardware used by each of your competitors' systems. Or the startups you were potentially interested in acquiring?

    It sounds like script kiddie heaven- when any security vulnerability becomes known you have a nice map of the hundreds, thousands, millions of systems having the vulnerability.

    I'm sure Microsoft is so ethical they would never use a black ops team to take advantage of such information.... ;)


    Nightmare essay question for Bill Gates: Explain why new economy rules don't apply to software dot-coms, but do apply to software anti-trust enforcement. Describe what a hypothetical software monopoly's obligations would be under the Sherman Anti-trust Act, as you interpret it. Defend your interpretation with Supreme Court citations.

  • Your post would have been a lot funnier if your thoughts on activation were actually ... true.
  • Yes, but they will probably ask anyway. The conversation will go something like:

    MS: Hello, sir, how may I help you?

    Induhvidual: I'd like an activation key.

    MS: OK, can I have your name, address, mother's maiden name, social security number, daytime phone, evening phone, Fax, and a note from your mother?

    Induhvidual: OK, here goes...

    Although, the scary thing is what if they refused to give you the key if you refused to give them the information they require?
  • My god, think of how much those metrics alone are worth... A snapshot on DVD adoption, SCSI cards, % of laptops out there? Almost seems like the anti-copy stuff is just a smokescreen.

    Ummm, except that Microsoft does not actually find out what hardware you have. They simply use the ID information from the hardware to generate a unique key for your system. Then they receive that KEY. Later on, when your hardware changes, that key will change. If it changes by too much, then you have to call them to get another activation code.

    If Microsoft really did require the hardware information be sent to them, how exactly would activation over the phone work?
  • It's always the same story : security through obscurity doesn't work. We already saw that with DeCSS.
    When people need to close sources and algorithms of a crypto system, it's almost always because it's flacky. They don't trust their own algorithms. They don't want other people know how they are working, because they know the algorithms can easily be broken when you know their mechanics.

    -- Pure FTP server [pureftpd.org] - Upgrade your FTP server to something simple and secure.
  • do you block caller id?

    What does it matter? I'm already connected to the internet when I activate XP. Even people with dialup connections can just establish their connection first, and then start the activation process. Those without an internet account but with a modem can call Microsoft if they are really paranoid enough to think that Microsoft is going to track caller ID.
  • by Wakko Warner ( 324 ) on Monday July 09, 2001 @07:12PM (#96058) Homepage Journal
    I have a feeling it won't be around [bitey.net] for long.

    - A.P.


  • Fully Licensed GmbH seems to have deciphered and analyzed the WPA code that Microsoft plans to use to protect from privacy in future products.
    It works on so many levels...


  • by acceleriter ( 231439 ) on Tuesday July 10, 2001 @04:02AM (#96062)
    (I expect VMware would make these user configurable if they are not already)

    Or they might not. VMWare is in bed pretty deep with MS--maybe they have to be, since it'd be pretty easy for MS to make the EULA invalid in a VM (legal or not, no corporation would run it in a VM if the EULA denied that right). Or MS could take technical countermeasures (see also DR-DOS and Windows 3.1) to keep XP from running in a VM, essentially putting VMWare out of business.

    One thing I noted is that about a year ago, there was an announcement with much fanfare that VMWare would sell bundles of MS licenses with VMWare. At roughly the same time, OS/2 support, which had been worked on and tested for some time, was suddenly dropped. Can I prove cause and effect? No. Are there lots of other reasons support can have been removed? Sure. But the timing's awfully suspect.

    Also, VMWare is hard coded to use a certain OUI (Organizational Unit Identifier) for VM network card NIC addresses--meaning they'll always start with a known prefix. VMWare provides no way to change this, meaning that MS or any other organization with access to the NIC address (or even a hash, probably) will know one is running a VM. (Imagine a typical Georgia network nazi reaction to seeing that with a sniffer.)

    I'm not confident VMWare's going to be allowing anyone to change hardware serial numbers in VMs--I'll bet they randomize them just to avoid jepoardizing their "strategic relationship" with Microsoft.

  • "...always keep a list of your Microsoft serial numbers on both your computer..."

    right, i'll just open up the spreadsheet that they are in...

    wait, no.

    no problem, i'll just open the word docum...

    that's all right, i've got another copy in an access datab...

    hang on, it's sitting in a folder in outl...

  • And you completely trust MS to never cross-reference this information? We know how well that worked out with the ad agencies *cough*.

    I don't need to trust Microsoft -- I just won't register XP. That's the point ... registration is not required to activate the software.

    Anyway, even if they don't know WHO you are, they still can track what modifications and upgrades you've done to your system, and all the serial numbers of your equipment.

    I don't think so. They just get a huge number that is generated from hashing the various ID's of your hardware. There is a big difference. They would not be able to tell the hardware installed, but rather, whether or not the hardware that is installed has changed since the last time you activated.
  • MSFT looses $X Billion to piracy each year

    Sort of a tangential point, but to fill in the $X: According to the SPA, software piracy has saved consumers worldwide over $59.2 billion in the last five years, and $12 billion last year alone [siia.net]. The linked document also details which regions saved the most.

  • They won't have to be attacked directly. All MSoft needs to do is court a powerful ally in Germany, stuff them full of company perks/exclusive deals/whatever and then lean on them to silence their noisome neighbors. Wait 'n see, and I'll bet you that if these guys get spanked, they'll get spanked by one of their own.

  • by bryan1945 ( 301828 ) on Monday July 09, 2001 @07:18PM (#96081) Journal
    After reading the article, which half the time lost me, all I can say is "damn, those guys know their shit" and "how many different levels of encryption and checking does MS need to do?"

    Really, checking the amount of RAM in a system? Of course, no one EVER adds RAM, right?

    MS has perfected the art of "incremental monopoly." Each step is not too bad, and after 10 steps, you are used to the last 3 steps, so it still seems ok. Eventually, you have .Net and subscription based systems, with all data handled by MS, and suddenly you realize your are totally fucked, but it is a bit too late.
  • "How many bits of 'Metallica - Unforgiven.mp3' can you change out with identical bits before it isn't 'Metallica - Unforgiven.mp3' anymore?"
  • by Saltine Cracker ( 116414 ) on Monday July 09, 2001 @07:19PM (#96088) Journal
    I thought M$ only cared about money...isn't this supposed to be about piracy not privacy?
  • They don't need you to give them your name. With Caller ID and other software, if you called from home, they've got your name and address. Doh!
  • by nyet ( 19118 ) on Monday July 09, 2001 @07:19PM (#96090) Homepage
    Onstensibly, the paper's purpose is to analyze the privacy impact of the registraction procedure; i.e. how much information about YOU Microsoft can glean from the hashed system info.

    In this light, the paper itself is relatively benign; enough so that Microsoft shouldn't be overly worried about it.

    The fact that it can be used to spoof WAP isn't even mentioned in the paper ;)

    I am guessing this is entirely intentional.
  • by lostchicken ( 226656 ) on Monday July 09, 2001 @07:20PM (#96092)
    I think you are looking at it backwards.

    I know how to pick locks, but I'm not a theif. I know how to hack, but I'm not a cracker. I can decrypt DVD's with DeCSS, but I don't pirate films. Same thing here. No security system should rely on common (the same for all users) secrets to maintain strength.

  • That is different.
    You can't take the hash and generate the original hashed string.
    You can take strings and try them until you find the right hash.
    For such a small hash, there are going to be a lot of possible matches.

    Two witches watched two watches.
  • Nope, I'm the only one on my network, plus I actually do read all the other comments before posting.
  • by SilentChris ( 452960 ) on Monday July 09, 2001 @07:20PM (#96102) Homepage
    It's easier to do through social engineering. See my previous comment [slashdot.org].
  • Insert obligatory reminder from Free Software advocates that "piracy" is a corruption of the language.

    Insert obligatory rebuttal that those very same advocates often refer to Windows users as slaves, thus corrupting the language in the same fashion.

    Insert obligatory cry for moderation and civility in public discourse.

    Go AFK to ponder futility.

    Return like you always do.

  • If I run WTS or Citrix on a server somewhere deep in the network and Jane sysadmin unplugs one of the SCSI drives for maintenance or because it broke and now I need to run XP-ish office apps off the network for 30+ people who log onto that server, then what?
  • by VertigoAce ( 257771 ) on Monday July 09, 2001 @07:22PM (#96114)
    That's quite an in-depth explanation. It surprises me that they could figure it out. How many hours did they sit there going: "Hmm... maybe if we added those numbers together and then added the odd ones again... no wait... lets do the even ones. And to finish it off lets to the sum % 3. Oh wait... that should be sum % 7... Yeah, that gives us the check digit!" -Sean
  • by www.sorehands.com ( 142825 ) on Monday July 09, 2001 @07:23PM (#96115) Homepage
    How long until Microsoft will file a lawsuit and have storm troopers kick down the door? It didn't take the MPAA long to do that. It didn't take Mattel long to do that.

    Will they change the algorithm before the next build? Probably not, their lawyers need the money.

  • by bl968 ( 190792 ) on Monday July 09, 2001 @07:25PM (#96117) Journal
    As the game publishing companies have discovered a long ago any security system can be cracked given enough time. It is time Microsoft learned this fact as well. No amounts of law suits can put the genie back into the bottle once it is released which the MPAA has learned the hard way and at extreme cost. If any portion of the system is located on the users system, it will be able to be hacked. While I do not agree with software piracy, I also do not believe in copy protection whose sole purpose is to complicate the situation for the end users that buy software and expect specific uses from it.

    When I'm good I'm very good, when I'm bad I'm better, But when I'm evil you better run :P
  • by Enigma2175 ( 179646 ) on Monday July 09, 2001 @07:27PM (#96119) Homepage Journal
    Publishing how to pick a lock isn't going to keep the door locked long.

    I beg to differ. There are countless articles written on how to pick locks. Here is one that is written on the level of the layman:

    How Stuff Works: Lock Picking. [howstuffworks.com]

    There are methods for doing many untasteful things(i.e. building bombs, cooking methamphetamine, etc) freely available, but this does not mean that everyone is blowing up buildings. I don't think it causes harm to simply have the information available. Security by obscurity is no securtity at all.


  • by vslashg ( 209560 ) on Monday July 09, 2001 @07:37PM (#96153)
    There is a wicked table in there. While it's not surprising to see from Microsoft, it's still a tad bit scary and impressive at the same time.

    Various strings are run through a hashing function and are stored in the key you read to the Microsoft rep over the phone (the Installation key). They are:

    • Your network card's MAC address
    • Amount of RAM installed
    • Processor model
    • Processor serial number
    • Volume serial number
    • Hardware ID strings from
      • Your CD-ROM drive
      • Your hard drive
      • Your video card
      • Your SCSI host adapter
      • Your IDE controller
    These values are thrown together (along with some other values) into a huge bit field. Also, a three-digit random number is thrown into the mix. Because the end result that you read to the phone rep is encrypted, this three digit number causes your code to be entirely different on each install.

    Here's the real fun part: The OS also stores a snapshot of your hardware configuration. If you change more than three of these hardware components out? It's time to call Microsoft and re-activate your license.

    When you re-activate, naturally you'll have to generate a new Installation Key and they'll be able to see exactly what components you changed out. Fun, huh?

  • Many commercial software developers like to list piracy as a reason for high costs. Microsoft included.

    But when did Microsoft ever sell, say Win95 for $35 ? So, how has piracy raised the price? It's always been sold for one price (~$80) and hasn't gone up or down depending on how many copies are purchased.

    And then there's the user base argument. When people are pirating your software, they're strengthening your monopoly. Just as it's good for FreeSoftware everytime a Linux/*BSD CD is given to someone new, how does it hurt MS when a home user borrows their friend's Win95 CD? The more times Win95 is installed, the more people are using it and the more likely that person is to become a valuable Windows-using consumer. Buying Windows software, perhaps purchasing a new computer with Win98 preinstalled. Requiring a Windows PC at work. Purchasing upgrades.

    Now, I must admit that most people who are going to borrow a Win95 CD will be unlikely to turn 100% legal overnight. But then, when has Microsoft ever been struggling. Well, only when EVERYONE ELSE has been struggling. Back when the economy was booming, Microsoft wasn't struggling to survive due to piracy. Only when everyone else has been struggling has MS even started to feel the pinch.

    Like I said, it's the same old cookie-cutter answer to "MSFT looses $X Billion to piracy each year", but it's always a fun argument :-) .

    kickin' science like no one else can,
    my dick is twice as long as my attention span.
  • by shyster ( 245228 ) <brackett@nOsPAm.ufl.edu> on Tuesday July 10, 2001 @06:20AM (#96172) Homepage
    When you promise someone (IBM) a piece of sofware you don't have, then pay someone $50,000 for a piece of software without telling them you're going to turn around and sell it for millions, then I think you're in ethically murky waters.

    Well, then, I guess my employer is going ot hell after all! He promises customers something he doesnt't have (a functioning network), then pays me peanuts to fix it/install it/etc. without telling me how much the customer is paying him (obviously, more than he pays me).

  • by alannon ( 54117 ) on Monday July 09, 2001 @08:11PM (#96199)
    While I'm not entirely happy with what Apple has done with their registration system, it's also entirely optional. If you're on broadband, simply unplug your machine from your network while you fill out your registration. It then tells you that you can send it later if you want to once you get online, but it doesn't enforce anything.

    Also, may I point out:

    --Apple Doesn't Require Serial Numbers For MacOS X!-- (It does for OSX Server, though)

    I think that kinda beats out a small annoyance with the registration.

    Just my $0.02CDN.
  • Now, I swap out video cards, CD's, NIC's, and CPU's fairly often. I also use removable HDD chassis to ease swapping drives in my primary box.

    For this purpose, the double words are divided into twelve bit-fields. The relationship between the computer hardware and the bit-fields is given in the following table.

    double word | offset | length | bit-field value based on
    H1 | 0 | 10 | volume serial number string of system volume
    H1 | 10 | 10 | network adapter MAC address string
    H1 | 20 | 7 | CD-ROM drive hardware identification string
    H1 | 27 | 5 | graphics adapter hardware identification string
    H2 | 0 | 3 | unused, set to 001
    H2 | 3 | 6 | CPU serial number string
    H2 | 9 | 7 | harddrive hardware identification string
    H2 | 16 | 5 | SCSI host adapter hardware identification string
    H2 | 21 | 4 | IDE controller hardware identification string
    H2 | 25 | 3 | processor model string
    H2 | 28 | 3 | RAM size
    H2 | 31 | 1 | 1 = dockable 0 = not dockable

    Bit 31 of H2 specifies, whether the bit-fields represent a notebook computer that supports a docking station. If docking is possible, the activation mechanism will be more tolerant with respect to future hardware modifications. Here, the idea is that plugging a notebook into its docking station possibly results in changes to its hardware configuration, e.g. a SCSI host adapter built into the docking station may become available.

    When judging whether re-activation is necessary, the bit-field values of a) are compared to the bit-field values of b), i.e. the current hardware configuration is compared to the hardware configuration at the time of activation.

    Typically all bit-fields with the exception of the unused field and the 'dockable' field are compared. If more than three of these ten bit-fields have changed in a) since product activation, re-activation is required.

    This really will be a pain for those who have rigs used for a lot of testing.

  • You can quit the setup program by hitting command-Q. The OS won't complain if you do, and you can run the Internet setup assistant separately.

  • by FFFish ( 7567 ) on Tuesday July 10, 2001 @11:03AM (#96207) Homepage
    Well, okay, so the Germans are bipolar or schizophrenic: they either go with lots of words when one would do (the "limited" example above), or one humungous mofo of a word that's damn near impossible to parse.

    Like "neunhundertneunundneunzigtausendneunhundertneunun dneunzig" -- because, hey, it's just so handy to have to read your Really Big Numbers as a single word.

    Or "Rindfleischetikettierungsüberwachungsaufgabenüber tragungsgesetz," (hell, Slashdot inserts a space!) which more or less directly Alta-vista translates as "British beef labeling monitoring function transfer law" and actually means "watching out for Mad Cow disease."

    I look at it sort of like a user interface issue: what's going to increase comprehension and decrease error rates -- using spaces between words, ornotusingspacesbetweenwords?

    The former, obviously. So why on earth choose the latter?!

  • by autechre ( 121980 ) on Monday July 09, 2001 @07:56PM (#96217) Homepage
    Bothered by filling out that Apple registration form? Lie.

    I think that when I registered the iMac a certain company bought to do web compatibility testing, it wound up being used primarily for scientific research. In an elementary school.

    They ask you for _your_ email address. But all they require is _an_ email address. Besides, you have a throwaway webmail account for everything that asks for your address where there's a slight chance that they might actually need to use it to achieve something you want, right?

    On the other hand, the WinXP product verification collects true information about your computer. Perhaps the one for OS X does also, but they haven't mentioned anything about not being able to install that copy of OS X on another Mac. There are indications that changing your hardware "too much" will invalidate your XP product verification. People have asked Microsoft, "How much is too much?", and they're not telling. That certainly seems worse to me.

    I suppose this would bother me more if I were ever going to use one of these operating systems at home, but I'm not. This is one of the main reasons I use free software. If I see an operating system or program that looks useful, I download it and use it. If I like it, I continue to use it. If not, I discard it with no sense of loss. The most invasive thing I've ever encountered was when someone wanted me to send them a postcard for using their software.

    Sotto la panca, la capra crepa
  • by scriber ( 89211 ) on Monday July 09, 2001 @08:02PM (#96227) Homepage

    A CD key is ideally a random piece of data (numbers, digits, etc) that includes some hard-to-compute checksum information. For a good key, it would be extremely difficult to determine the algorithm used to find this cheksum. Note that these keys have become progressively more complex over the years, getting longer and using more digits/letters. Note that all the keys will work on any copy of that specific release of the software, so they only add a minor annoyance to pirates.

    Starting with Office 2k, MS required actual activation of the product in much the same way as Win XP. Office generates a hardware ID for your system and submits it to Microsoft. MS then gives you another product key specifically for that hardware ID. They allows you to register online once, and you're required to call an 800 number each time after that to get your key.

    Office required a new key on a hard drive upgrade and on a motherboard upgrade. The fourth time I installed it (on my laptop), I also had to submit my serial number (generated from the CD Key I assume) to receive my activation key.

    Though this might be new for MS, other companies have been doing it for years. Much of the engineering software we use here for classes (Mentor Graphics, Orcad, etc) has much more intrusive licensing, since a license for the software can cost several times the price of a low-end workstation. This software can often get away with tough licensing restrictions because of the small market served. Because windows is so widespread, however, Microsoft will have a hard time keeping their progressively more complex protection schemes from being thwarted.

  • Primary Harddrive Ethernet card CDROM Drive Graphics adaptor CPU Harddrive SCSI controller IDE controller RAM Changing any of these items will result in you needing to call up Microsoft and beg for a new key.
    No. Changing four of them (sequentially or all at once) will result in you needing to call up - and changing hard drives four times doesn't count.
    TheGreenReaper (Laurence Parry)
  • by BarefootClown ( 267581 ) on Monday July 09, 2001 @08:25PM (#96243) Homepage

    I don't know about the online activation (haven't run a sniffer on it, yet), but I tried the telephone activation today, and there was no personal information exchanged. I called the toll-free number, waited on hold for about 10 minutes (and we're still in the beta stage--just wait until this thing hits mainstream), then finally talked to a patronizing tech support drone. He asked me for the product activation key, a numeric string that makes MS CD keys look sane--32 digits, IIRC. He then read back a 36-digit numeric string to be entered in the activation window. That was it--no e-mail address, no name, phone number/address, etc. I suppose it could have been a hash code containing my name, but that's all it could have contained, as I had not entered any other information to that point. Probably just a hardware ID.

    Incidentally, I recommend everybody register every copy of Windows by phone. First of all, you know what you're telling them, at least directly, but more importantly, it costs them more money. Think about it: ten minutes on hold on a toll-free line (their expense), five minutes of techie-time. Even at a modest $10/hr for the techie, that's almost a dollar spent on him, plus the phone charge. Now, imagine ten million copies of Windows being registered by phone. The infrastructure cost alone would be enormous--you know they haven't planned for that many people to call. Just one more example of my favorite form of vengeance: use their own weapons against them.

  • Surely this is just a call for clone equipment manufacturers to just start producing hardware that identifies itself as "CD-ROM" or "DISK" for the registration process.

    Then you can change whatever you like, whenever you like.

  • by legLess ( 127550 ) on Monday July 09, 2001 @09:44PM (#96263) Journal
    Oh, come on, postcard-ware is awesome. I've seen photos of guys who have walls of their houses covered with postcards they've received from all over the world. What's wrong with this?

    All the postcard-ware licenses I've seen simply ask you to send a postcard if you like the software. No registration, no details, just a postcard from where you live. I think it's cool.

    "We all say so, so it must be true!"

Don't tell me how hard you work. Tell me how much you get done. -- James J. Ling