( ESNUG 330 Item 10 ) -------------------------------------------- [9/30/99]
Subject: ( ESNUG 328 #1 ) The Final Word On The "Flex-LM Cracked" Story
> Editor's Note: On Wednesday, Sept. 8, the http offering the Flex-LM
> cracking tool completely removed the Flex-LM cracking tool and any
> mention of it. I've done multiple web searches for the specific name
> of this tool and found it nowhere on the net. This Flex-LM cracker had
> been freely available on that site for 4 weeks (since August 6th.) What
> caused it to go & whether it's permanently gone, I don't know. - John
From: Chad Fasca <cfasca@cahners.com>
John,
What may have caused the Flex-LM cracking software to suddenly drop from the
Internet was that Globetrotter alerted the U.S. Commerce Department that
day about the hacker site.
Here's an interesting footnote. Globetrotter says the loophole exploited by
this hack was addressed in 1998. New FlexLM software releases carry a lag
time between initial release and widespread use in the marketplace, the firm
says. Meanwhile, one of your readers said the hack compromised software up
to the most recent release (6.1f). Globetrotter says that the earlier
versions that it tested were not compromised.
There appears to be some discrepancy here.
- Chad Fasca, Editor
Electronic News Today New York, New York
BTW, Aug. 6 (the date the hack was posted) happens to be the same day as the
bombing of Hiroshima (Aug. 6, 1944). Coincidence? Agenda? X-File?
---- ---- ---- ---- ---- ---- ----
From: Alain Raynaud <alain_raynaud@mentorg.com>
John,
The news that FlexLM was compromised is bad news for most EDA companies.
But not for those of us here at Meta Systems. We were smart enough to
deliver all of our software with a dongle. Without this crucial piece of
hardware, our software is totally useless. Oh, and I almost forgot, our
dongle is about 6 cubic meters in size,and weighs about 1 ton. For some
reason, our customers keep referring to it as an "emulator", though we never
can figure out why.
Maybe we should have stick with the concept of "dongle" a long time ago
instead of "emulator". We sure could have saved some lawyers fees. I
guess it's too late now. :-)
- Alain Raynaud
Meta Systems / Mentor Graphics Cedex, France
---- ---- ---- ---- ---- ---- ----
From: David Chapman <dchapman@aimnet.com>
Concerning my FlexLM under Windows 98 question in ESNUG 328; Globetrotter
tells me that it relies on some sort of hardware ID (parallel port dongle
in the worst case, or Ethernet number if a network card is present). I
haven't asked them directly about this hole for Windows 98 -- my contacts
with Globetrotter preceded your alert. They do have an offer on their Web
page which allows a single free FlexLM license for Windows 98, which I will
at least try out, but I am several weeks away from needing it. When I get
to that point I will press them to confirm that the security problem has
been fixed for all platforms, including the low-end ones (at least I don't
have the problem of legacy software like the other vendors.)
Thanks for publishing my request.
- David Chapman
Chapman Consulting Santa Clara, CA
---- ---- ---- ---- ---- ---- ----
> John - what were you thinking?
>
> I don't see the public benefit. I don't see the benefit for EDA vendors.
> I certainly don't see the benefit for you, unless you like the deluge of
> email. And most of all, I don't see any benefit for your users. I don't
> know who, but I'd be willing to bet that some EDA vendor is now going to
> lock down security in a way that is going to severely inconvenience you
> and your readers.
>
> If you honestly believe that publishing a hacker story benefits the
> public, you should publish it. If you believe that doing so on balance
> harms the public or encourage others to harm the public -- you should
> refrain from publishing as a matter of personal integrity -- as I believe
> you would. But please, please, think of the "law of unintended
> consequences" when you publish something like this.
>
> - Matt Christiano, CEO
> GLOBEtrotter Software, Inc. San Jose, CA
From: [ An EDA Vendor ]
John,
That email from the Globtotter CEO is absolutely hilarious. I think you
should nominate him for the pointy hair executive of the year award. If I
were the Silos guys I would be looking to sue globetrotter for damages,
at least for covering the cost of printing new CD's! The interesting
question would be how many EDA vendors were aware of this crack. It does
not appear that many of them had been notified by Globetrotter. Anon pls.
- [ An EDA Vendor ]
---- ---- ---- ---- ---- ---- ----
From: Mike Dini <mdini@dinigroup.com>
John,
Matt Christiano's scathing rebuke of your behavior in the Globetrotter mess
is the peak of hypocritical behavior of software (and related) companies.
We all have gotten use to paying exorbitant prices for testing EDA products
that don't really work, and now we are apparently expected to keep our mouth
shut when a product doesn't work at all. His email message to you in short
says "You shouldn't have reported that our product doesn't work because it
might hurt us". Well isn't that too bad. Sure seems like that once the genie
was out of the bottle then they fixed the problem in a hurry. Also, it seems
as if they weren't up front with all the users of their product about the
security compromise. Could you provide a list of Globetrotter's other products
so that I can avoid them in the future?
- Mike Dini, CEO
The Dini Group
---- ---- ---- ---- ---- ---- ----
From: [ One Of The Paying EDA Customers ]
John,
After your article the other day, I found some detailed instructions on the
web on how to crack FlexLM from a friend at an EDA vendor. It's at
[ URL Deleted ]. It appears to be complete directions for using a piece of
flexLM cracking software. Is this the same software you encountered?
I downloaded the information just in case it disappears and I wish sometime
in the future to check it out. I am not a hacker nor do I think hackers
should be allowed to steal intellectual property. Wonder if the people
doing this hack have use for the software for themselves or just to say
they were able to crack the code?
No, I am not an EDA vendor, but have experienced on a number of occasions
some dreaded message indicating that the system :
- cannot find the LM manager
- cannot find the LM manger server
- The LM manager server is down
- The LM manager server does not recognize something about my use of
the tool
- All copies of the software are checked out and not available
Novice users of software are the main source of the last message. They
somehow manage to leave process windows active that have checked out a
license, but are doing nothing with the license. On one occasion a user
managed to use 18 copies of a simulation license and 9 copies of a
synthesis license. Many other users were blocked and waited for the
problem to be corrected.
On more than one occasion a full day, evening, night, or weekend of work has
been lost due to inaccessible tools where a valid license was purchased.
Oh, to be able to instantly continue work instead of waiting for the system
admin to fix the problem!
These admin problems occur inspite of having redundant license servers, etc.
I didn't write this, OK?
- [ One Of The Paying EDA Customers ]
---- ---- ---- ---- ---- ---- ----
From: Tom Quan <tomq@mondes.com>
Hi John,
I read in Electronic News that you are forming a group to combat security
hacking of EDA software called "StealthNET". Do you have details about the
group? Monterey Design Systems is interested to join.
- Tom Quan
Monterey Design Systems Sunnyvale, CA
[ Editor's Note: Yes, Tom, I'm creating a small, controlled mailing list
of about 20 to 30 security/licensing people from the EDA Vendors with the
idea of exchanging bugs, workarounds, and plugging security holes in EDA
software. It's called StealthNET. (I'm doing it as a goodwill thing in
the industry. Plus, I'm one of the few people who can do this. That is,
I'm a truely neutral party here because of the wide free access I have to
EDA software. Teaching me how to steal EDA tools is like teaching me how
to steal sand. Not much to worry about there.) The only people that
will be on StealthNET will be EDA Vendors that I've physically confirmed
as legit, who have detailed technical knowledge of security issues, and
who are personally more motivated to keep EDA secure than they are to
tell their friends the latest ways of how to crack Flex-LM. - John ]
|
|
