8 ms·

Receiving FLEXlm Error -88,309: System Clock Has Been Set Back (2020)

256 points by parsecs 5y ago

SV_BubbleTime 5y ago
Ha. Files that won’t be made for >24hr according to your system clock in important directories will flag for abuse. Good to know how to screw with your users I guess? I don’t know much about DRM methods, but I assume this is a Windows95-level weak one?
- aetherspawn 5y ago
  People assume that DRM is way stronger than it actually is. Most DRM for engineering software (>$20k per license) is easily defeated by just changing your MAC ID to match. Using a special MAC ID is way more convenient each time you buy a new workstation, or i.e. get it back with new components on warranty, or whatever, than waiting days or weeks for support to generate new keys. But yeah, it's 2021, and most DRM is pathetic. Hardware keys are honestly the only truly effective DRM. (Although re hardware keys: Very annoying when you have 5+ softwares and need 5+ USB ports ... perhaps someone should create a bluetooth based DRM dongle or something like that.)
  - tschwimmer 5y ago
    I'm curious to hear what you think of the video game DRM DeNuvo, which has shown itself to be somewhat more robust to cracking in recent years.
    - parsecs 5y ago
      There's been lots and lots of titles with Denuvo cracked by scene groups like CODEX and CPY/Conspiracy and EMPRESS[1]. There's also controversy with the DRM's highly excessive and arguably wasteful use of resources. Some games were much more performant after Denuvo was removed [1]: I would link CrackWatch but they seem to be down atm. https://www.reddit.com/r/CrackWatch/comments/lnbi5a/crack_watch_games/ https://www.reddit.com/r/CrackWatch/comments/lnbi5a/crack_wa...
  - marcan_42 5y ago
    Can confirm. I looked at DRM for a certain FPGA vendor's EDA tools once. The license is MAC-tied, and on Linux, sometimes it picks the MAC of tun0 or some other virtual interface... which is the same on every host. Then your license works everywhere. Or you can just LD_PRELOAD a library that hijacks the relevant glibc function to always return a static MAC. They also use encryption for their IP cores. It's RSA. The private key is conveniently called "rsa_key" in their binary. Which they shipped with symbols. Once you decrypt the IP cores you get the full source code, with original comments, to do with as you please. It's all for show; the DRM in these "professional" tools is sillier than what games used in the 90s.
  - no_time 5y ago
    >is easily defeated by just changing your MAC ID to match. HA I may or may not have cracked something similar back in the day. It was using GetIfTable() which meant that you'd need to have a NIC with the exact same name and mac address. Of course just dumping the output from a licensed machine and injecting it into the memory when needed did the trick.
  - azalemeth 5y ago
    Is flexlm comprehensively cracked yet? It seems like a juicy target. Honestly, I hate all of these things. My employer spends multi-millions on software licenses every year. All these DRM schemes are painful, insulting, and inevitably break at the worst possible moment. We have one box -- legally acquired -- with a hardware dongle, plugged in the back of the machine. Someone smashed it when moving the thing accidentally. Were we inclined, with SEM, TEM, AFM and plenty of x-ray facilities, I'm sure that it's not beyond our ken to crack the sodding thing, and honestly, after that experience I was sorely tempted. I'm fed up of being treated as a rich criminal by businesses. They want an un-get-out-able subscription agreement, for life, and with "markets made" at every available opportunity, i.e. $METRIC_FUCKTON_OF_MONEY for $MINIMAL_INCREMENTAL features. One commercial FEM solver I use charges per GPU, per CPU, and per year. The whole thing is based on maths invented in my university!
    - eitland 5y ago
      > Someone smashed it when moving the thing accidentally. And that's one of the reasons why I'm glad we used HP servers with internal usb ports for this.
    - dsr_ 5y ago
      I worked at a company which made heavy use of a math library that had license enforcement via a method rather like FlexLM. After enough complaining, we got them to send us an unenforced version -- and they became a little more proactive in sending us annual bills and asking if we needed a new number of licenses. If you're paying bigbucks, try asking for better terms. Explain how painful it is for you, not to pay them, but to not be able to use their software. Maybe it will work.
      - azalemeth 5y ago
        I tried that once. The quoted annual price was increased by a factor of ten...
        dsr_ 5y ago
        "Oh, OK. We will investigate alternatives at price points above what we currently pay you but less than 10x. Thanks for letting us know how much you value this relationship."
- DaiPlusPlus 5y ago
  > I don’t know much about DRM methods, but I assume this is a Windows95-level weak one? Checking for files-from-the-future as evidence of clock-tampering is certainly not a new technique - and I'm sure it predates Windows 95. I am familiar with a slightly improved version of the technique: rather than checking actual filesystem files, instead the DRM opened the HDD as a raw device and would write multiple redundant copies of timestamps and usage logs to unallocated parts of the disk - so even restoring a HDD (at the filesystem level) wouldn't be enough to make the DRM system think it was back-in-the-past. You'd have to do a raw low-level HDD restore that included the state of unallocated - but written - disk contents. I gather it would also raise a fuss if it couldn't find any of its previously written logs either. ...I don't know what happens if you try to run the software on a disk with zero free disk space, however. I think it was used by some Macromedia titles in the late 1990s - or software of that variety.
  - gruez 5y ago
    >...I don't know what happens if you try to run the software on a disk with zero free disk space, however. It will still work, at least on windows. That's because it reserves some sectors at the end as hidden sectors that applications can't directly access. source: https://en.wikipedia.org/wiki/Microsoft_Reserved_Partition https://en.wikipedia.org/wiki/Microsoft_Reserved_Partition
    - p_l 5y ago
      The DRM schemes actually used the "no man's land" between MBR and start of cylinder 1, which was supposed to be unused. This craps itself when you run Grub, which happily scribbles itself to the same area
  - josephcsible 5y ago
    > the DRM opened the HDD as a raw device Why does [insert random program here] need admin rights? Now you know!
    - zinekeller 5y ago
- geofft 5y ago
  The target audience of FLEXlm is large companies with the ability to pay for many licenses of expensive per-seat software. For instance, MATLAB, AutoCAD, and various commercial FPGA and hardware design tools (Altera, Xilinx, Synopsis, etc.), etc. use FLEXlm. So the threat model isn't really folks who are pirating any of this software off random warez sites and finding a crack - those users wouldn't be able to pay for a legitimate license anyway, so it's not like you're really losing profit from them. This is more of a "locks keep honest people honest" licensing scheme. Your IT department is unlikely to set up a large-scale system for distributing cracks, so it makes sure that a company that can afford it and is willing to pay for it is paying for the right number of licenses. But just like mostly-well-meaning people might wander into a place without locks, mostly-well-meaning people might "temporarily" forget to get a proper license for a new hire and then forget to ever fix it, or put the software on a shared drive, or never get around to doing the paperwork to buy a renewal, or whatever. Having any license-checking scheme at all makes them remember to do that. MATLAB, for instance, currently sells a "standard" license for $2,150, not counting annual support costs. They also sell a "home" license for $149. By doing that, they're already banking on the fact that no serious company's IT department is going to just buy a bunch of "home" licenses and save themselves 93% of the licensing cost. They clearly don't need the DRM for the last 7% to be foolproof.
  - hakfoo 5y ago
    I'd think the strongest answer for "keep honest people honest" is to streamline licensing as much as possible. In a fundamentally well-intentioned organization, what's the ratio of "dishonest" to "doesn't understand the license specifics?" (i. e. not recycling licenses properly when a user replaces his machine) Vendors should be pushing for organization-level licensing. Anything per-user/core/project/etc. is going to require a lot of tracking overhead, and create much more incentives to game and gimmick it. I'm picturing the shops which stagger shifts at sites in different time zones so as to keep the simultaneous user count low, or people buying specific weird hardware to keep core counts low on per-core-licensed software. If you're just doing organization-level licensing, you can scale all the counting back to a less disruptive and intensive "analytics-only" level, and just use it to inform the next round of negotiated pricing. "We know you have 500 simultaneous users, so we know this package is worth $50,000 per year to you."
I_Byte 5y ago
Archived in case it is deleted. https://web.archive.org/web/20210829234321/https://community.flexera.com/t5/FlexNet-Publisher-Knowledge-Base/Receiving-FLEXlm-Error-88-309-System-Clock-Has-Been-Set-Back/ta-p/5825 https://web.archive.org/web/20210829234321/https://community...
- SilverRed 5y ago
  Archive.org respects the original sites takedown. archive.is does not.
  - zaik 5y ago
    https://archive.is/N4FZh https://archive.is/N4FZh
dane-pgp 5y ago
When I see the word "security" used like this, I wish the person who used it would be honest about whose security they have in mind. (Also, they should be clear about whether they are talking about cyber security, or financial security, or personal security.) It's like the word "protection" in the terms "copy protection" or "content protection". Those at least make clear that it is not the user who is being protected, but it's still disingenuous to suggest that a file is somehow harmed by being copied. If anything, having more copies of a file only makes it safer.
- chasil 5y ago
  I don't use any licensed software with enforcement methods like this, but it looks trivial to defeat. A string dump of the binary would likely show these directories, and even if they were obfuscated, an strace would reveal them as they probed the file dates.
  - zinekeller 5y ago
    It's "trivial" to you, for sure, but as many have noted it's not intended for "advanced" users, but for a target audience who happens to be not computer-savvy.
    - Espressosaurus 5y ago
      And not just not computer-savvy, it's also about making it painful enough a business will pay the license fee rather than trying to jump through hoops to work around licensing problems. If it has to execute on a PC, there is a way to break the protection. It's simply about making it too difficult to bother trying to break the protection.
      - zinekeller 5y ago
        ... well, except for having a separate executable for function-limited trial program, I guess.
- da39a3ee 5y ago
codetrotter 5y ago
Simple but probably effective. In terms of protecting against regular end users fiddling with the system time I mean. On a related note I remember many years ago when I was using Windows, and there was a third-party utility to monitor the registry for changes. I only had the trial version of the utility, but using the utility itself I found that they were storing information in the registry about when the trial would expire. So I was able to use the utility to discover and defeat the trial protection of itself. So that was cool in and of itself. But I also found that, even though this was in a time before most software would do online checks, many pieces of software were able to know that the trial had expired even if I tried things like setting the clock back or removing registry entries they had created. Probably some of those pieces of software were doing similar things to the one mentioned in the OP. But it never occurred to me at the time. I’m not even sure I would have thought of this even today if I were to try it. But these days I use software that’s open source for a lot of things instead, and where I need proprietary software I pay for it instead. If it’s proprietary and not worth the money then it’s not worth using either. Though I am still sad that Adobe switched to a subscription based payment which I ended up not being able to afford and don’t want to sign up for again because of their horrible billing practices. So I am stuck not being able to run Adobe software even though I would have liked to.
- Causality1 5y ago
  You're giving me flashbacks to the bad old days when Opera was the only competent browser for Windows Mobile devices. What made them the bad old days? They only had a trial version, and some time after the paid version didn't come out the date limit on the trial version expired, so thousands of people turned the dates back and sacrificed the entire "organization" category of PDA functionality just to keep using a good browser. I believe a full version of Opera was eventually released but it took a very long time.
  - zeusk 5y ago
    Not sure what version you're talking about, but I had 6.1, 6.5 devices and they all ran fennec (firefox).
eitland 5y ago
Back in the days we actually had to use this trick. We knew we had enough licenses but at some point people started complaining that others wouldn't give back shared licenses. It turned out the server didn't register them in when someone signed off. So after troubleshooting we ended up doing exactly what this trick is protecting against, setting the server clock to somewhere in the future. Worked nicely back then. This was just as I left that place, a few weeks later my college told me they had found the problem: our previous it manager had installed a new instance of the license server on a faster machine. He had not installed the license files (nor documented it anywhere) though so the new server would just say thank you and discard the license token whenever anyone signed out.
cantrevealname 5y ago
The following is entirely from memory: FLEXlm was originally written by just one guy. I think I remember his name -- his initials are M.C. if anyone would like to confirm that I'm recalling correctly. When he sold his stake he got ~$10 million. The software went through many ownership changes. I think this was when it went from Globetrotter to Macrovision. When he got his ~$10 million he gave about $2 million to his current employees as a gift. I thought it was a very honorable thing. He had no legal obligation to do so. This isn't inside information; it was all published somewhere but it's funny how the web can "forget" things after a couple decades. EDIT: I found something that at least confirms the name I was remembering, Matt Christiano, and a history[1] of license management that he wrote in 2007. [1] http://reprisesoftware.com/blog/2007/01/a-brief-history-of-software-license-management-2/ http://reprisesoftware.com/blog/2007/01/a-brief-history-of-s...
gmiller123456 5y ago
I guess we should try to list as many non-adversarial ways you can end up with a future dated file: 1. Incorrectly set clock, corrected after files were modified. 2. Slightly corrupt file system. 3. Copied files from another system. 4. You're testing your own DRM. 5. Other software doing similar crazy things you're unaware of. 6. Testing software that needs the date changed for certain scenarios. 7. Bug in time sync software. Others?
userbinator 5y ago
FlexLM --- certainly gave me a bit of nostalgia from all the time I spent on it as a cracker few decades ago... I guess it's still found on very expensive/specialist software which hasn't become entirely service/cloud-based.
- rathel 5y ago
  Cadence and Synopsys use it.
  - azalemeth 5y ago
    It's very popular in high-end Unix workstation software, e.g. CST microwave studio, Bruker's MRI and NMR software, etc
- krylon 5y ago
  I think Autodesk still uses it. I vaguely recall running into some trouble with the FlexLM service and Autodesk Inventor when I still worked as a Windows admin/helpdesk monkey.
  - ale42 5y ago
    Yes they still do, at least for floating licenses, I'm running a FlexLM server for our lab with several Autodesk floating licenses on it. MATLAB also uses it, and so do many others scientific software packages (e.g., ANSYS).
kevin_thibedeau 5y ago
Assuming the original version from 2007 was guaranteed to be internal only, it's not looking good for whoever decided to expose the knowledge base. Bonus points for outsourcing to a third party support forum so we can admire the self-pwn while they struggle to find who has admin privileges to take it down. How much was that MBA's bonus?
analognoise 5y ago
FlexLM is still used all the time. I wish I knew enough to crack it, just to know how. I'll bet it's fascinating.
- Alexqw85 5y ago
  Sadly, my experience with FLEXlm has been far from fascinating. Matlab uses it, and Matlab has some weird license types (that we use) that don't map well to FLEXlm, so they approximate it in odd ways. I build (internal only) Debian packages for Matlab and FLEXlm, and admin the license server. I've seen far more of FLEXlm than I care to. Mathworks made the mistake once of asking for my feedback about their product, from a sysadmin's perspective. They received about three earfuls from me, about half of which was dedicated to my disdain for FLEXlm. FLEXlm seems simple on the surface, but has poor and outdated documentation (even once you find and read through the 300-400 page tome that's floating around) and is a pain to debug when under fire. We have it running well enough now, but the road to get there should frankly embarrass those who ship (and/or rely on) the software today. Frustratingly, Mathworks' response to my feedback largely boiled down to "it's 3rd party software, so we can't do anything about it." As if FLEXlm were a force of nature, and there were no viable alternate models for physics. Not a good look.
- userbinator 5y ago
  Search for cracking tutorials, there's plenty out there (including ones specific to FlexLM.)
a-dub 5y ago
the flexlm usecase is: protect revenue for vendors that sell into large companies/organizations by making drm that is sufficiently annoying to defeat and/or live with in a degraded state such that it's more annoying than dealing with internal bureaucracy to get accounts payable and information technology to actually pay the software vendor. saas of course just threatens to turn things off when the bill isn't paid. it's how big organizations work, nothing happens until it's annoying.
- a-dub 5y ago
  also, fun fact: sgi irix shipped with a "system" flexlm daemon.
dylan604 5y ago
Back in my days of programming shiny round discs, we had a client request to put a time bomb in an interactive CD-ROM. To test it, we adjusted the date on the computer that did our MPEG-2 encoding for DVD. As was bound to happen, the date did not get reset to current time, so that some DVD encodes were encoded in the future. It took so many calls back&forth with support to figure out why these files were misbehaving. TL;DR becareful when adjusting the dates as there may be unintended consequences
unixhero 5y ago
I work in Security and we talk about barrier management. A security barrier is be something you implement to avoid a certain hazard to begin traversing your bowtie risk model (google it). This particular case of doing a technical check by chcking files" timestamp for timestamps set in the future is NOT a security reason. It is a license compliance check, but has nothing to do with security. Also, if I were a customer of this company which apparently sells me IT Lifecycle tools that should help me with IT cataloging and omventory, I would be livid if the solution stopped working because it had identified "bad date" files somewhere in my IT landscape. I would migrate the hell away from it there are plenty of other vendors.
- thyrsus 5y ago
  The customers for this software are companies like Cadence or Synoptics, who then use it to encourage license compliance by their customers. As a Cadence customer, my employer could use strace to observe the license daemon behavior and figure out how to cheat, but we're not at all interested in doing so, both from an ethical position and as a matter of maintaining a long term relationship. We have dedicated VMs to host the license daemons, so the failure scenarios proposed are unlikely: we've experienced - and corrected - time skews, but they didn't come close to affecting the license servers. Maintaining the license servers are an accepted part of the license cost.
- robertlagrant 5y ago
  > bowtie risk model (google it). I regret googling it.
musicale 5y ago
I expect the purpose of enterprise license management software like this is less to prevent unlicensed use (which is basically impossible) and more to help organizations track their license usage and stay compliant with whatever the terms are. It's a beautiful comment though, and an interesting scheme that could potentially break relatively easily. In my experience, the license manager usually goes out to lunch at the most inopportune moment – usually before some important deadline, coincident with IT support (or anyone who is capable of fixing the license manager) being out of the office for an extended period.
- habeebtc 5y ago
  I know Flexera well. They regularly do "license compliance shakedowns". This is not some trade secret, lots of ISV's do it. So the following is describing broadly how ISV's do it and nothing specific to Flexera. The way it works is to have a licensing model not enforced perfectly by the DRM. Sell licenses per user, per machine, but allow usage outside that in some way. Make it the customer's duty to enforce license usage instead of the vendor. Wait a while. Sales comes back and runs an audit, they see more users than licensed in the last X amount of time and require a "true up" fee before more licenses can be sold, or possibly under threat of terminating existing licenses. The intent is to use the threat of disruption to the business as leverage to cough up more revenue than the customer planned to provide initially per their license agreement. It is shady, but it works, and a widespread practice.
GuB-42 5y ago
I remember the date trick, many computers were set at the wrong date back then for that reason. But nowadays, a computer at the wrong date is pretty much unusable because of certificates, so much that it has become one of the typical tech support question, just after "is it plugged in".

256 points by parsecs 5y ago

Ha. Files that won’t be made for >24hr according to your system clock in important directories will flag for abuse. Good to know how to screw with your users I guess? I don’t know much about DRM methods, but I assume this is a Windows95-level weak one?

aetherspawn 5y ago
People assume that DRM is way stronger than it actually is. Most DRM for engineering software (>$20k per license) is easily defeated by just changing your MAC ID to match. Using a special MAC ID is way more convenient each time you buy a new workstation, or i.e. get it back with new components on warranty, or whatever, than waiting days or weeks for support to generate new keys. But yeah, it's 2021, and most DRM is pathetic. Hardware keys are honestly the only truly effective DRM. (Although re hardware keys: Very annoying when you have 5+ softwares and need 5+ USB ports ... perhaps someone should create a bluetooth based DRM dongle or something like that.)
- tschwimmer 5y ago
  I'm curious to hear what you think of the video game DRM DeNuvo, which has shown itself to be somewhat more robust to cracking in recent years.
  - parsecs 5y ago
    There's been lots and lots of titles with Denuvo cracked by scene groups like CODEX and CPY/Conspiracy and EMPRESS[1]. There's also controversy with the DRM's highly excessive and arguably wasteful use of resources. Some games were much more performant after Denuvo was removed [1]: I would link CrackWatch but they seem to be down atm. https://www.reddit.com/r/CrackWatch/comments/lnbi5a/crack_watch_games/ https://www.reddit.com/r/CrackWatch/comments/lnbi5a/crack_wa...
- marcan_42 5y ago
  Can confirm. I looked at DRM for a certain FPGA vendor's EDA tools once. The license is MAC-tied, and on Linux, sometimes it picks the MAC of tun0 or some other virtual interface... which is the same on every host. Then your license works everywhere. Or you can just LD_PRELOAD a library that hijacks the relevant glibc function to always return a static MAC. They also use encryption for their IP cores. It's RSA. The private key is conveniently called "rsa_key" in their binary. Which they shipped with symbols. Once you decrypt the IP cores you get the full source code, with original comments, to do with as you please. It's all for show; the DRM in these "professional" tools is sillier than what games used in the 90s.
- no_time 5y ago
  >is easily defeated by just changing your MAC ID to match. HA I may or may not have cracked something similar back in the day. It was using GetIfTable() which meant that you'd need to have a NIC with the exact same name and mac address. Of course just dumping the output from a licensed machine and injecting it into the memory when needed did the trick.
- azalemeth 5y ago
  Is flexlm comprehensively cracked yet? It seems like a juicy target. Honestly, I hate all of these things. My employer spends multi-millions on software licenses every year. All these DRM schemes are painful, insulting, and inevitably break at the worst possible moment. We have one box -- legally acquired -- with a hardware dongle, plugged in the back of the machine. Someone smashed it when moving the thing accidentally. Were we inclined, with SEM, TEM, AFM and plenty of x-ray facilities, I'm sure that it's not beyond our ken to crack the sodding thing, and honestly, after that experience I was sorely tempted. I'm fed up of being treated as a rich criminal by businesses. They want an un-get-out-able subscription agreement, for life, and with "markets made" at every available opportunity, i.e. $METRIC_FUCKTON_OF_MONEY for $MINIMAL_INCREMENTAL features. One commercial FEM solver I use charges per GPU, per CPU, and per year. The whole thing is based on maths invented in my university!
  - eitland 5y ago
    > Someone smashed it when moving the thing accidentally. And that's one of the reasons why I'm glad we used HP servers with internal usb ports for this.
  - dsr_ 5y ago
    I worked at a company which made heavy use of a math library that had license enforcement via a method rather like FlexLM. After enough complaining, we got them to send us an unenforced version -- and they became a little more proactive in sending us annual bills and asking if we needed a new number of licenses. If you're paying bigbucks, try asking for better terms. Explain how painful it is for you, not to pay them, but to not be able to use their software. Maybe it will work.
    - azalemeth 5y ago
      I tried that once. The quoted annual price was increased by a factor of ten...
      - dsr_ 5y ago
        "Oh, OK. We will investigate alternatives at price points above what we currently pay you but less than 10x. Thanks for letting us know how much you value this relationship."
DaiPlusPlus 5y ago
> I don’t know much about DRM methods, but I assume this is a Windows95-level weak one? Checking for files-from-the-future as evidence of clock-tampering is certainly not a new technique - and I'm sure it predates Windows 95. I am familiar with a slightly improved version of the technique: rather than checking actual filesystem files, instead the DRM opened the HDD as a raw device and would write multiple redundant copies of timestamps and usage logs to unallocated parts of the disk - so even restoring a HDD (at the filesystem level) wouldn't be enough to make the DRM system think it was back-in-the-past. You'd have to do a raw low-level HDD restore that included the state of unallocated - but written - disk contents. I gather it would also raise a fuss if it couldn't find any of its previously written logs either. ...I don't know what happens if you try to run the software on a disk with zero free disk space, however. I think it was used by some Macromedia titles in the late 1990s - or software of that variety.
- gruez 5y ago
  >...I don't know what happens if you try to run the software on a disk with zero free disk space, however. It will still work, at least on windows. That's because it reserves some sectors at the end as hidden sectors that applications can't directly access. source: https://en.wikipedia.org/wiki/Microsoft_Reserved_Partition https://en.wikipedia.org/wiki/Microsoft_Reserved_Partition
  - p_l 5y ago
    The DRM schemes actually used the "no man's land" between MBR and start of cylinder 1, which was supposed to be unused. This craps itself when you run Grub, which happily scribbles itself to the same area
- josephcsible 5y ago
  > the DRM opened the HDD as a raw device Why does [insert random program here] need admin rights? Now you know!
  - zinekeller 5y ago
geofft 5y ago
The target audience of FLEXlm is large companies with the ability to pay for many licenses of expensive per-seat software. For instance, MATLAB, AutoCAD, and various commercial FPGA and hardware design tools (Altera, Xilinx, Synopsis, etc.), etc. use FLEXlm. So the threat model isn't really folks who are pirating any of this software off random warez sites and finding a crack - those users wouldn't be able to pay for a legitimate license anyway, so it's not like you're really losing profit from them. This is more of a "locks keep honest people honest" licensing scheme. Your IT department is unlikely to set up a large-scale system for distributing cracks, so it makes sure that a company that can afford it and is willing to pay for it is paying for the right number of licenses. But just like mostly-well-meaning people might wander into a place without locks, mostly-well-meaning people might "temporarily" forget to get a proper license for a new hire and then forget to ever fix it, or put the software on a shared drive, or never get around to doing the paperwork to buy a renewal, or whatever. Having any license-checking scheme at all makes them remember to do that. MATLAB, for instance, currently sells a "standard" license for $2,150, not counting annual support costs. They also sell a "home" license for $149. By doing that, they're already banking on the fact that no serious company's IT department is going to just buy a bunch of "home" licenses and save themselves 93% of the licensing cost. They clearly don't need the DRM for the last 7% to be foolproof.
- hakfoo 5y ago
  I'd think the strongest answer for "keep honest people honest" is to streamline licensing as much as possible. In a fundamentally well-intentioned organization, what's the ratio of "dishonest" to "doesn't understand the license specifics?" (i. e. not recycling licenses properly when a user replaces his machine) Vendors should be pushing for organization-level licensing. Anything per-user/core/project/etc. is going to require a lot of tracking overhead, and create much more incentives to game and gimmick it. I'm picturing the shops which stagger shifts at sites in different time zones so as to keep the simultaneous user count low, or people buying specific weird hardware to keep core counts low on per-core-licensed software. If you're just doing organization-level licensing, you can scale all the counting back to a less disruptive and intensive "analytics-only" level, and just use it to inform the next round of negotiated pricing. "We know you have 500 simultaneous users, so we know this package is worth $50,000 per year to you."

I_Byte 5y ago

Archived in case it is deleted. https://web.archive.org/web/20210829234321/https://community.flexera.com/t5/FlexNet-Publisher-Knowledge-Base/Receiving-FLEXlm-Error-88-309-System-Clock-Has-Been-Set-Back/ta-p/5825 https://web.archive.org/web/20210829234321/https://community...

SilverRed 5y ago
Archive.org respects the original sites takedown. archive.is does not.
- zaik 5y ago
  https://archive.is/N4FZh https://archive.is/N4FZh

dane-pgp 5y ago

When I see the word "security" used like this, I wish the person who used it would be honest about whose security they have in mind. (Also, they should be clear about whether they are talking about cyber security, or financial security, or personal security.) It's like the word "protection" in the terms "copy protection" or "content protection". Those at least make clear that it is not the user who is being protected, but it's still disingenuous to suggest that a file is somehow harmed by being copied. If anything, having more copies of a file only makes it safer.

chasil 5y ago
I don't use any licensed software with enforcement methods like this, but it looks trivial to defeat. A string dump of the binary would likely show these directories, and even if they were obfuscated, an strace would reveal them as they probed the file dates.
- zinekeller 5y ago
  It's "trivial" to you, for sure, but as many have noted it's not intended for "advanced" users, but for a target audience who happens to be not computer-savvy.
  - Espressosaurus 5y ago
    And not just not computer-savvy, it's also about making it painful enough a business will pay the license fee rather than trying to jump through hoops to work around licensing problems. If it has to execute on a PC, there is a way to break the protection. It's simply about making it too difficult to bother trying to break the protection.
    - zinekeller 5y ago
      ... well, except for having a separate executable for function-limited trial program, I guess.
da39a3ee 5y ago

codetrotter 5y ago

Simple but probably effective. In terms of protecting against regular end users fiddling with the system time I mean. On a related note I remember many years ago when I was using Windows, and there was a third-party utility to monitor the registry for changes. I only had the trial version of the utility, but using the utility itself I found that they were storing information in the registry about when the trial would expire. So I was able to use the utility to discover and defeat the trial protection of itself. So that was cool in and of itself. But I also found that, even though this was in a time before most software would do online checks, many pieces of software were able to know that the trial had expired even if I tried things like setting the clock back or removing registry entries they had created. Probably some of those pieces of software were doing similar things to the one mentioned in the OP. But it never occurred to me at the time. I’m not even sure I would have thought of this even today if I were to try it. But these days I use software that’s open source for a lot of things instead, and where I need proprietary software I pay for it instead. If it’s proprietary and not worth the money then it’s not worth using either. Though I am still sad that Adobe switched to a subscription based payment which I ended up not being able to afford and don’t want to sign up for again because of their horrible billing practices. So I am stuck not being able to run Adobe software even though I would have liked to.

Causality1 5y ago
You're giving me flashbacks to the bad old days when Opera was the only competent browser for Windows Mobile devices. What made them the bad old days? They only had a trial version, and some time after the paid version didn't come out the date limit on the trial version expired, so thousands of people turned the dates back and sacrificed the entire "organization" category of PDA functionality just to keep using a good browser. I believe a full version of Opera was eventually released but it took a very long time.
- zeusk 5y ago
  Not sure what version you're talking about, but I had 6.1, 6.5 devices and they all ran fennec (firefox).

eitland 5y ago

Back in the days we actually had to use this trick. We knew we had enough licenses but at some point people started complaining that others wouldn't give back shared licenses. It turned out the server didn't register them in when someone signed off. So after troubleshooting we ended up doing exactly what this trick is protecting against, setting the server clock to somewhere in the future. Worked nicely back then. This was just as I left that place, a few weeks later my college told me they had found the problem: our previous it manager had installed a new instance of the license server on a faster machine. He had not installed the license files (nor documented it anywhere) though so the new server would just say thank you and discard the license token whenever anyone signed out.

cantrevealname 5y ago

The following is entirely from memory: FLEXlm was originally written by just one guy. I think I remember his name -- his initials are M.C. if anyone would like to confirm that I'm recalling correctly. When he sold his stake he got ~$10 million. The software went through many ownership changes. I think this was when it went from Globetrotter to Macrovision. When he got his ~$10 million he gave about $2 million to his current employees as a gift. I thought it was a very honorable thing. He had no legal obligation to do so. This isn't inside information; it was all published somewhere but it's funny how the web can "forget" things after a couple decades. EDIT: I found something that at least confirms the name I was remembering, Matt Christiano, and a history[1] of license management that he wrote in 2007. [1] http://reprisesoftware.com/blog/2007/01/a-brief-history-of-software-license-management-2/ http://reprisesoftware.com/blog/2007/01/a-brief-history-of-s...

gmiller123456 5y ago

I guess we should try to list as many non-adversarial ways you can end up with a future dated file: 1. Incorrectly set clock, corrected after files were modified. 2. Slightly corrupt file system. 3. Copied files from another system. 4. You're testing your own DRM. 5. Other software doing similar crazy things you're unaware of. 6. Testing software that needs the date changed for certain scenarios. 7. Bug in time sync software. Others?

userbinator 5y ago

FlexLM --- certainly gave me a bit of nostalgia from all the time I spent on it as a cracker few decades ago... I guess it's still found on very expensive/specialist software which hasn't become entirely service/cloud-based.

rathel 5y ago
Cadence and Synopsys use it.
- azalemeth 5y ago
  It's very popular in high-end Unix workstation software, e.g. CST microwave studio, Bruker's MRI and NMR software, etc
krylon 5y ago
I think Autodesk still uses it. I vaguely recall running into some trouble with the FlexLM service and Autodesk Inventor when I still worked as a Windows admin/helpdesk monkey.
- ale42 5y ago
  Yes they still do, at least for floating licenses, I'm running a FlexLM server for our lab with several Autodesk floating licenses on it. MATLAB also uses it, and so do many others scientific software packages (e.g., ANSYS).

kevin_thibedeau 5y ago

Assuming the original version from 2007 was guaranteed to be internal only, it's not looking good for whoever decided to expose the knowledge base. Bonus points for outsourcing to a third party support forum so we can admire the self-pwn while they struggle to find who has admin privileges to take it down. How much was that MBA's bonus?

analognoise 5y ago

FlexLM is still used all the time. I wish I knew enough to crack it, just to know how. I'll bet it's fascinating.

Alexqw85 5y ago
Sadly, my experience with FLEXlm has been far from fascinating. Matlab uses it, and Matlab has some weird license types (that we use) that don't map well to FLEXlm, so they approximate it in odd ways. I build (internal only) Debian packages for Matlab and FLEXlm, and admin the license server. I've seen far more of FLEXlm than I care to. Mathworks made the mistake once of asking for my feedback about their product, from a sysadmin's perspective. They received about three earfuls from me, about half of which was dedicated to my disdain for FLEXlm. FLEXlm seems simple on the surface, but has poor and outdated documentation (even once you find and read through the 300-400 page tome that's floating around) and is a pain to debug when under fire. We have it running well enough now, but the road to get there should frankly embarrass those who ship (and/or rely on) the software today. Frustratingly, Mathworks' response to my feedback largely boiled down to "it's 3rd party software, so we can't do anything about it." As if FLEXlm were a force of nature, and there were no viable alternate models for physics. Not a good look.
userbinator 5y ago
Search for cracking tutorials, there's plenty out there (including ones specific to FlexLM.)

a-dub 5y ago

the flexlm usecase is: protect revenue for vendors that sell into large companies/organizations by making drm that is sufficiently annoying to defeat and/or live with in a degraded state such that it's more annoying than dealing with internal bureaucracy to get accounts payable and information technology to actually pay the software vendor. saas of course just threatens to turn things off when the bill isn't paid. it's how big organizations work, nothing happens until it's annoying.

a-dub 5y ago
also, fun fact: sgi irix shipped with a "system" flexlm daemon.

dylan604 5y ago

Back in my days of programming shiny round discs, we had a client request to put a time bomb in an interactive CD-ROM. To test it, we adjusted the date on the computer that did our MPEG-2 encoding for DVD. As was bound to happen, the date did not get reset to current time, so that some DVD encodes were encoded in the future. It took so many calls back&forth with support to figure out why these files were misbehaving. TL;DR becareful when adjusting the dates as there may be unintended consequences

unixhero 5y ago

I work in Security and we talk about barrier management. A security barrier is be something you implement to avoid a certain hazard to begin traversing your bowtie risk model (google it). This particular case of doing a technical check by chcking files" timestamp for timestamps set in the future is NOT a security reason. It is a license compliance check, but has nothing to do with security. Also, if I were a customer of this company which apparently sells me IT Lifecycle tools that should help me with IT cataloging and omventory, I would be livid if the solution stopped working because it had identified "bad date" files somewhere in my IT landscape. I would migrate the hell away from it there are plenty of other vendors.

thyrsus 5y ago
The customers for this software are companies like Cadence or Synoptics, who then use it to encourage license compliance by their customers. As a Cadence customer, my employer could use strace to observe the license daemon behavior and figure out how to cheat, but we're not at all interested in doing so, both from an ethical position and as a matter of maintaining a long term relationship. We have dedicated VMs to host the license daemons, so the failure scenarios proposed are unlikely: we've experienced - and corrected - time skews, but they didn't come close to affecting the license servers. Maintaining the license servers are an accepted part of the license cost.
robertlagrant 5y ago
> bowtie risk model (google it). I regret googling it.

musicale 5y ago

I expect the purpose of enterprise license management software like this is less to prevent unlicensed use (which is basically impossible) and more to help organizations track their license usage and stay compliant with whatever the terms are. It's a beautiful comment though, and an interesting scheme that could potentially break relatively easily. In my experience, the license manager usually goes out to lunch at the most inopportune moment – usually before some important deadline, coincident with IT support (or anyone who is capable of fixing the license manager) being out of the office for an extended period.

habeebtc 5y ago
I know Flexera well. They regularly do "license compliance shakedowns". This is not some trade secret, lots of ISV's do it. So the following is describing broadly how ISV's do it and nothing specific to Flexera. The way it works is to have a licensing model not enforced perfectly by the DRM. Sell licenses per user, per machine, but allow usage outside that in some way. Make it the customer's duty to enforce license usage instead of the vendor. Wait a while. Sales comes back and runs an audit, they see more users than licensed in the last X amount of time and require a "true up" fee before more licenses can be sold, or possibly under threat of terminating existing licenses. The intent is to use the threat of disruption to the business as leverage to cough up more revenue than the customer planned to provide initially per their license agreement. It is shady, but it works, and a widespread practice.

GuB-42 5y ago

I remember the date trick, many computers were set at the wrong date back then for that reason. But nowadays, a computer at the wrong date is pretty much unusable because of certificates, so much that it has become one of the typical tech support question, just after "is it plugged in".