Anti-tamper software is software which makes it harder for an attacker to modify it. The measures involved can be passive such as

obfuscation Obfuscation is the obscuring of the intended meaning of communication by making the message difficult to understand, usually with confusing and ambiguous language. The obfuscation might be either unintentional or intentional (although intent ...

to make

reverse engineering Reverse engineering (also known as backwards engineering or back engineering) is a process or method through which one attempts to understand through deductive reasoning how a previously made device, process, system, or piece of software accompl ...

difficult or active tamper-detection techniques which aim to make a program malfunction or not operate at all if modified. It is essentially

tamper resistance Tamperproofing is a methodology used to hinder, deter or detect unauthorised access to a device or circumvention of a security system. Since any device or system can be foiled by a person with sufficient knowledge, equipment, and time, the term " ...

implemented in the software domain. It shares certain aspects but also differs from related technologies like

copy protection Copy protection, also known as content protection, copy prevention and copy restriction, is any measure to enforce copyright by preventing the reproduction of software, films, music, and other media. Copy protection is most commonly found on vid ...

and trusted hardware, though it is often used in combination with them. Anti-tampering technology typically makes the software somewhat larger and also has a performance impact. There are no

provably secure Provable security refers to any type or level of computer security that can be proved. It is used in different ways by different fields. Usually, this refers to mathematical proofs, which are common in cryptography. In such a proof, the capabilit ...

software anti-tampering methods; thus, the field is an

arms race An arms race occurs when two or more groups compete in military superiority. It consists of a competition between two or more State (polity), states to have superior armed forces, concerning production of weapons, the growth of a military, and ...

between attackers and software anti-tampering technologies. Tampering can be malicious, to gain control over some aspect of the software with an unauthorized modification that alters the

computer program A computer program is a sequence or set of instructions in a programming language for a computer to Execution (computing), execute. It is one component of software, which also includes software documentation, documentation and other intangibl ...

code and behaviour. Examples include installing

rootkits A rootkit is a collection of computer software, typically malicious, designed to enable access to a computer or an area of its software that is not otherwise allowed (for example, to an unauthorized user) and often masks its existence or the exist ...

and backdoors, disabling security monitoring, subverting authentication,

malicious code Malware (a portmanteau of ''malicious software'')Tahir, R. (2018)A study on malware and malware detection techniques . ''International Journal of Education and Management Engineering'', ''8''(2), 20. is any software intentionally designed to caus ...

injection for the purposes of data theft or to achieve higher user privileges, altering control flow and communication, license code bypassing for the purpose of

software piracy Online piracy or software piracy is the practice of downloading and distributing copyrighted works digitally without permission, such as music, movies or software. History Nathan Fisk traces the origins of modern online piracy back to similar ...

, code interference to extract data or algorithms and counterfeiting. Software applications are vulnerable to the effects of tampering and code changes throughout their lifecycle from development and deployment to operation and maintenance. Anti-tamper protection can be applied as either internally or externally to the application being protected. External anti-tampering is normally accomplished by monitoring the software to detect tampering. This type of defense is commonly expressed as malware scanners and anti-virus applications. Internal anti-tampering is used to turn an application into its own security system and is generally done with specific code within the software that will detect tampering as it happens. This type of tamper proofing defense may take the form of runtime integrity checks such as

cyclic redundancy checksum A cyclic redundancy check (CRC) is an error-detecting code commonly used in digital networks and storage devices to detect accidental changes to digital data. Blocks of data entering these systems get a short ''check value'' attached, based on th ...

s, anti-debugging measures, encryption or

. Execution inside a

virtual machine In computing, a virtual machine (VM) is the virtualization or emulator, emulation of a computer system. Virtual machines are based on computer architectures and provide the functionality of a physical computer. Their implementations may involve ...

has become a common anti-tamper method used in recent years for commercial software; it is used for example in

StarForce The Starforce is a supervillain team appearing in American comic books published by Marvel Comics. Its first appearance was in the comic ''The Avengers (comic book), Avengers'' #346 released in 1992, as part of the "Operation: Galactic Storm" st ...

and

SecuROM SecuROM is a CD/ DVD copy protection and digital rights management (DRM) system developed by Sony DADC and introduced in 1998. It aims to prevent unauthorised copying and reverse engineering of software, primarily commercial computer games run ...

. Some anti-tamper software uses

white-box cryptography In cryptography, the white-box model refers to an extreme attack scenario, in which an adversary has full unrestricted access to a cryptographic implementation, most commonly of a block cipher such as the Advanced Encryption Standard (AES). A varie ...

, so cryptographic keys are not revealed even when cryptographic computations are being observed in complete detail in a debugger. A more recent research trend is tamper-tolerant software, which aims to correct the effects of tampering and allow the program to continue as if unmodified. A simple (and easily defeated) scheme of this kind was used in the

Diablo II ''Diablo II'' is a 2000 action role-playing game developed by Blizzard North and published by Blizzard Entertainment for Microsoft Windows, Classic Mac OS, and OS X. The game, with its dark fantasy and horror themes, was conceptualized and des ...

video game, which stored its critical player data in two copies at different memory locations and if one was modified externally, the game used the lower value. Anti-tamper software is used in many types of software products including: embedded systems, financial applications, software for mobile devices, network-appliance systems, anti-cheating in games, military, license management software, and

digital rights management Digital rights management (DRM) is the management of legal access to digital content. Various tools or technological protection measures, such as access control technologies, can restrict the use of proprietary hardware and copyrighted works. DRM ...

(DRM) systems. Some general-purpose packages have been developed which can wrap existing code with minimal programing effort; for example the SecuROM and similar kits used in the gaming industry, though they have the downside that semi-generic attacking tools also exist to counter them. Malicious software itself can and has been observed using anti-tampering techniques, for example the

Mariposa botnet The Mariposa botnet, discovered December 2008, is a botnet mainly involved in Confidence trick, cyberscamming and denial-of-service attacks. Before the botnet itself was dismantled on 23 December 2009, it consisted of up to 12 million unique IP add ...

References

{{reflist Computer security software

See also

References