EULAs Prohibit Decompiling Source Code - Impact on Cybersecurity Research Examined

By Isabella Cheng, Published Jun 28, 2021, 10:33am EDT

Will you get sued for finding a vulnerability? In their EULAs, manufacturers widely prohibit decompiling source, a core step in finding most vulnerabilities.

IPVM Image

In this report, IPVM examines:

  • Prohibitions against reverse engineering from Axis, Hikvision, Dahua, Avigilon, Cisco, Huawei, Samsung, Google, and Apple
  • Prohibition to protect IP
  • Dahua's special 'confidentiality restrictions'
  • Security researcher sued by Cisco and ISS for decompiling
  • Court decisions on prohibition's enforceability
  • Legal protections for security researchers
  • Comments from Dahua, Cisco, Axis, and Motorola Solutions

Executive *******

***** ***** ************ ******* reverse *********** *** ****** in *****, **** *** historically *** ******** ******* cybersecurity ***********. ***** ******* against *********** *** ******* engineering ***** ********** ****-***** research *** ****. ** is ********* ********, ********** given *** ******** ************ included, ** **** *******.

***** *** ***** ******* to **** *********** ***** these *****, *********** ************* researchers ** **** **** them ** ********. ******** and **** ******** ** comment.

*******, ***** *** ** atypical "*************** ***********" ******* disclosing "*** *********** ** the ********". ***** ******** to ******* ** **** to ****.

Clauses *********** *********** **** ******

******* *********** *********** **** are ****** ** ***-**** license ********** (****). *** clauses *** ******* *********, prohibiting ***** **** "******* engineering, ***********, ** *************" the ******** ****.

******** ** ***** ******* and ***** ******** *** excerpted ***** **** ****-***** security *** ********** *********, with *** ******** ******** emphasized.

********:

****** ** ********* ********** by *** ********* *** may *** (*** *** may *** ***** ****** else **): *)reverse ********, *********, *********** ** ********* ******* ** ****** ****** ** *** ****** **** ** *** ********, or any part thereof.

****************** ******* *********:

****** ** ********* *** out ** **** *** or ** ********* ** any ********** ***, *** agree: *)Not ** ***********, *********, ******* *********** ** ****** ********** ***** ***** ** *** ***** ** *** **** ** *** *********, or attempt to do any such activities, except and only to the extent that such activity is expressly permitted by Hikvision or applicable law notwithstanding this limitation.

************* ******* *********:

************ ** ******* ***********, decompile *** ***********.You *** *** ******* ********, ********* ** *********** *** ********.

************ *** ******** ******* Center ****** *:

*. ******* ***********, *************, Disassembly.You *** *** ******* ********, *********, ** *********** *** ********, *** *** ******* ** ** ** ***** ****** ** *** ********* *********** ** **** *********, except and only to the extent that such activity is expressly permitted by applicable law.

******** **** ******* *********:

****** ********* ****** ** Cisco, *** *** *** ...(d) ******* ********, *********, *******, ***********, ******, ** **** ********** ***** ** *** ***** **********.

**********:

****** ** ********* ********* permitted,you ***** ***, *** ***** *** ***** ****** ** ****, ******* ********, *********, *********** ** ****** *********** ** *** ********. In addition, you shall not, nor allow others to, or attempt to export the source code of the Software, or decode or modify the Software or any part of the Software or the services that it provides.

***********:

****** ** *** ****** such * *********** ** unenforceable ***** ***** ***,you *** *** ******* ********, *********, ** *********** *** ******** *******. The SOFTWARE PRODUCT is licensed as a single product, and its component parts may not be separated for use on more than one computer. Except to the extent such a restriction is unenforceable under local law, you may not modify, amend, or create derivative works of the SOFTWARE PRODUCT.

*********** ** *******:

You *** *** (*** *** *** *** ****** ****** **** **) ****, ******, ****** * ********** **** **, ******* ********, ********* ** ********* ******* ** ******* *** ****** **** ** *** ******** or any part thereof, unless this is expressly permitted or required by law, or unless you have been specifically told that you may do so by Google, in writing.

************* *********** ****:

You *** *** **** (****** ** ********* ********* ** **** ******* *** *** ***** *****), *********, *******-********, ***********, ******* ** ****** *** ****** **** **, ******, ** ****** ********** ***** ** *** ******** ***********, any updates, or any part thereof (except as and only to the extent that any foregoing restriction is prohibited by applicable law or to the extent as may be permitted by the licensing terms governing use of any open-sourced components included with the Licensed Application).

Dahua '*************** ***********'

**** *****'* ******* ********* also ******** * "*************** restriction" *********** ********** *********** of *** ******** ** any ***** ***** ******* Dahua's ******* *******:

*************** ***********: *** *** not ******** *** *********** of *** ********, ** any ***** **********, **** results, ********* ******* ** any **** ************ *********** derived **** *** ******** to *** ***** ***** without *** ******* ******* of *******.

Decompiling *********** ***** ** ******* **

***** ******* ********* ***** as ** ****** ** prohibit ***** **** *********** discovering ***** ******* *** company ** ** *********** code. ******** ******* *********** cases **** ****** **** fought **** *** ********* of **, ****** **** decompiling **** *** **** of *********** **** *** vulnerabilities. *** *******, ****** *********** *. ********, * ***** **** publisher (********) *** **** for ******* *********** *** Sega ******* ** **** compatible *****.

Cases ******* ************* *********** ****

***** ******* ************* *********** for ********* ***** *** rare, ******* *** **** that ***** *********** *** decompiling ****** **** ***** could ** **** ** justification *** ***** ******. Indeed, **** ***** **** find *** **** *** that *** ** ***** ago.

IBM ******** ********** **** *** ***********

** ****, ** *** security **********, **** ****, was **** ** ***** and *** ******** ******** Solutions (***) *** ****** a ************ ** * vulnerability ** ***** ******* which ** ********** ******* reverse ***********. ** *** time **** **** *** presentation ** ***** ***, Cisco *** ******* ***** the *******, *** *** lawyer,******** *******,***** **** *** "****** concerned"**** ***** *** *** done ******:

**** **** **** ***** had ***** *** ******* he ***** *** ******* distributing *** ********** ****, but ** *** ****** concerned **** *** ******* did *** ** ****** enough ** ******** *** customers ** ******* ********, or ** ******* ** them *** ********* *** necessary.

*******, ***** *** ***'* main ****** ******* **** were ********* *** ***** secret *****. *******, *** is *** ************/************* ******* at *** ****, ******:

* *** ****** **** exactly ** *** ******** that **** *** **** wrong. ** ******** ** be ***** ******. *****, ISS ***claiming ********t in the presentation that Mike had given on Wednesday morning. Second, Cisco was claiming ********* ** *** ********** ******* **** that Mike obtained from the Cisco binaries and had included in his slides. And finally, Cisco was claiming ***** ****** in the information Mike had obtained by decompiling and studying Cisco source code. The complaint also alleged that Mike had breached his nondisclosure agreement with ISS.

******* **** * *********** between ********* *** **** Lynn *** ****** *** the ***** ****** ********* Cisco *** ******* **** of:

*** ** **** ***** argument *** **** ********* of ** *** **** License ********* ** *** a ***** ****** *********. "Improper *****" ******** * breach ** * **** to ******** *******. *** the **** *** *** impose * **** ** maintain *******. ** *** merely * ******* *** to *******-********. * ********* of **** ******* ** a ********* ** ********, but *** ** ******** means ** *********** * trade ******.

*** **** *** ********** settled ******* *** ******* within ** *****. **** and ***** *** ****** "not ** *********** *** presentation, *** ***** ** the ********** **** *** further, *** **** ****** not ** *********** *** of *** ***** ** worked ** ***** ** ISS ** ***."

Circuit ********* ****** ** ******* **** ******* ***********

***** ***** *** **** little ********* ***** ******* clauses *********** ******* *********** clauses *** ***********, *** different ****** **** ********* opinions ** ******* ** not ** ******* ***** clauses. ********, *** ** these ***** ******** *********** vs ************* ********. *********, it ** ******* *** courts ***** **** ** a ******** ********** ******** his **** ***** ********** good-faith ********.

*** *******, *** ***** Circuit (*** * ******** case) ***** *** ******* engineering ****** *** *********** in ******** *. *****. However, *** ***** ******* (including **********) *** ************ declined ** ******* ***********-**** ******* **********. *** ************** ***** ******* *** programmers *** "****** ***** fair *** ****** [** reverse ********] ******* *** EULA":

*** ****** ******* **** thatthese ****-****** *****-******* ******** **** *********** ********* and that the *********** ******** ******* ***** ** ********'* ****, ********* *** ******* ** ******* ***********. Even though reverse engineering is a fair use under federal copyright law, the programmers waived ***** **** *** ****** ******* *** ****. [emphasis added]

*******,******** **** *** ****** Arcade, * ***** **** IP *** ********, ***** that *** **** *** not **** **** *********** in * ********* *******:

Other ********, ******* *** ***** *******, **** ******** ** ******* ******* ******-**** ******* **********, suggesting that Blizzard’s choice in selecting the district court in Missouri rather than its home state of California was a tactical decision to keep the case out of the Ninth Circuit on appeal. [emphasis added]

******, ******** *** ******/*************'* ***** **** ***********/******-**** agreements "*** **** ****** to ** ******** ** valid ********* **** ****":

** *******, *********** “**** it ** ***** **” agreements **** ****/***/**** *** less ****** ** ** enforced ** ***** ********* than ****, ********* **********, and *** ****. *** latter ***** ** ********* are ******* ********, ***** relates ** *** **** that **** *** **** negotiable (** *********) *** deliberately ******* ****.

Protections *** ******** *********** ***** ******* ********** ********* *** (****)

*****, ******** *********** **** been ************ ********* ** long ** **** *** conducting "****-***** ******** ********", as ******* ***** ******** ******** *********** *** ******** ********** Copyright *** (****) ** 2016. *** **** ** a ******* *** **** was ******* ** ** anti-piracy *******, *** ** also **** ** ********* for *********** ** ****** copyrighted ********. *** ***********:

**** *** ****** ** a ***, *** ********* of ******** *** ********** security *********** *** *** acting ** **** ***** to ******* ********** ******** on ******** ******* ** long ** *** ******** does *** ******* ***** laws **** ** *** Computer ***** *** ***** Act (****).

********** ********** ********* *** (DMCA)***** ** ******* ** circumvent ******** **** ******* access ** *********** ********. The ****** ** **** under *** ****, *********** can’t *********** *** ******** security *************** ** ***** so ******** ******* *********** or ************* ******** **** as ********** ****. ********** take **** * ***** hurdle *** **** ******* conduct ******* **** ** legal ********.

*******, *********** **** **** a ****** "******** ***********" to ** ********* ***** the *********:

***** *** ** ***** three **** ************ *********** must **** **** ******* up * ******** *********** in ***** ** **** under *** *********. *****, the ******** *******, ** any ******* ** ***** those ******** ***, **** be******** ********.” ******, ****** ********, the ****** *** ******** program ****** ******* “****** *** *** ******* of ****-***** ******** ********.” **** *****, ** part, **** *** ******** **** ** ********* ** a ********** ******* ******** to ***** **** ** individuals ** *** ******.” *****, *** ******** must *** ***** ****** today,******* **, ****.

"****-***** ******** ********" ** "carried *** ** * controlled *********** ******** ** avoid *** **** ** individuals ** *** ******" and "*** *********** ******* from *** ******** ** used ********* ** ******* the ******** ** ****** of *** ***** ** devices ** ******** ** which *** ******** ******* operates." *******, *** ********* says *********** ********** ** "one ** *** ******* to ** ********** ** determining * ******'* *********** for *** ******** ******* exemption." *******, *** ********* did *** ******* ******** disclosure *********, ****** "******** seem ******* ******* ** this [******** ********** *********] point."

*** *** **** ** example ** "****-***** ********":

**, ** *** **** all ** *** ************, this ********* ********* ****** you ** **** * connected ******* ** ****** the **** **** ** attacker ***** ***** **** bagel ** ******* ** remotely ******* **** ******* pastry *****.But, ** ******, ** **** *** ********* ****** ** ***** * *******, **** **** * ********’* *******, ** *** ******** ** **** ** ***** ********* ** ********* *********. [emphasis added]

Dahua *** ***** **** **** **** **** ***********

***** **** *** ******** declined ** *******, ***** and ***** ********* ****** they "********* *********** *** discover ********* *****... ** contact **" *** "******* engagement **** ***********."

*****'* *******:

************** ** **** ************ with *** ******** ******** community *** ** ******* engagement **** *********** ********** the *********, ******, *** responsible ********** ** ******** vulnerabilities.

***** *******:

***** *** *** ******** out. ********** **** ******** best ********* ********* *** identification *** **********, ***** encourages *** *********** ************* researchers *** ******** ********* risks *** *************** ** software, ** ******* ** and ***** ******** ******** with *** ******** ************.

*******, ***** *** *** respond ***** *** *************** clause *** ******* ******* Dahua ******** ***** ******* that.

**** ************ ******** ** comment "******* ** ******** concerns":

******* ** ******** ********, we ***’* **** ** comment ** *** ********** when ******** *********** ******** us ** ************* ******* matters.

**********

******** ******* *********** ** commonly ********** ** *****, cybersecurity *********** ********* **** not ** **** *** violating *** ******. *******, researchers ***** **** ** act ** "****-*****" *** responsibly ******** ***** ********. IPVM's ******** ****** *** be *********** ** ***** advice, *** *********** ****** consult ** ******** ** they *** ********* ***** a ******** ************.

Comments (3)

******* ***'* **** ***** EULAs. **'* ** * company's **** ******** ** treat ************* *********** ****, because **'* **** ** sell *************** ** ******* or ******* ***********. * lot ** ******/*********** **** unique ****** ***************, ** when * ******* *****'* treat **** ****, **'* easy *** **** ** flip *** ****** *** start ******* ** ****** who ********** **** ******.

Agree: 4
Disagree
Informative
Unhelpful
Funny

* ** ***** ** avoid ***** *** **** here *** * ***** adding **** ************ ** the ******* ***** ****** bug ****** ******** ***** be ******* *** ***** reading **** *** *** be ******** 😊

Agree
Disagree
Informative
Unhelpful
Funny

****** *** **** ********, Jacob. *** ***** *** familiar, * *** ****** program ******* ***** ** individuals *** ****** **** to *** *******, ********** those **** *** **** to ******** ***************.

***** *** ****** ******** are ****** ** **** generally, **** *** *** as ****** ***** ***** surveillance *************. *** *******,********************* **** ******* *** bounty ******** *** *****, as **** **** ***** tech ********* ****** ****.

*******, ** *** ************* we ********* ** *** report, *********, *****, *** Axis *** ** *** have *** ****** ********, with ************** *********** *** ******* "**** not ******* *** *** bounty ********." ******** ********* operates * "*** ********** *******" *** **** *********** may ** ******** *** a ******. **** ** not ********* ** *** report, *** ** ** one ************ ******* ********** * *** ****** program.

Agree
Disagree
Informative: 2
Unhelpful
Funny
Read this IPVM report for free.

This article is part of IPVM's 7,270 reports and 968 tests and is only available to subscribers. To get a one-time preview of our work, enter your work email to access the full article.

Already a subscriber? Login here | Join now
Loading Related Reports