Vladimir Dashchenko
License managers: The Phantom Menace
Tiny little thing that can cause huge problems - license manager. We've studied the state of security of some major vendors
and custom-made ones and would like to deliver some results about three examples:
Vladimir graduated from Ural State Technical University with a degree in information security of telecommunication systems. He started his career as a security engineer at Russian Federal Space Agency. His research interests are pentesting, ICS, security audits, security of different unusual things (like smart toys, TVs, smart city infrastructure) and threat intelligence. Vladimir is a part of Critical Infrastructure Defense Team (CID-Team) and Kaspersky Lab ICS CERT in Kaspersky Lab
1) Gemalto License Manager - one of the most popular solutions. Used as a combination of USB token and software driver;
2) Flexnet License manager - also a very popular solution. We've identified some logical and binary vulnerabilities (up to LPE and RCE);
3) And some other license managers.
Some software solutions have Gemalto and Flexnet in their installation packages and some customization makes the state of security even worse.
Such examples will be covered during the presentation.
** This talk is co-presented with Sergey Temnikov.