Software Piracy Attacks on Java Software Using Malicious Aspects

Abstract

Code obfuscators are the most widely used tools for protecting commercial Java software. Advanced obfuscation techniques make de-compiled Java programs not re-compilable, thus greatly raise the barrier of cracking Java software. However, we have found that the new aspect-oriented programming language, AspectJ, can be abused to overcome advanced code obfuscation and conduct piracy attacks on Java software effectively using its code instrumentation mechanisms. Most noticeably, such piracy attacks are accomplished at the bytecode level, which implies that the obfuscation techniques of making decompiled programs not re-compilable may not prohibit such attacks. We have successfully applied this approach to overcome the license protection of several commercial Java packages. This paper describes such attacks and reports our experiment results, We also discuss why it is difficult to defend against such attacks and reflect on their root causes. We argue that the simplicity and very low cost of such attacks make them worth wider attention from the community. Besides, our results can also provide some food for thought for aspect-oriented language designers when reviewing the join point model.