Legal Reverse Engineering for Security Review in US for Korean Provided Module
<p>My company has received a command-line stand-alone (ELF) executable from a Korean company that provides a service for validating Korean users. It took them a few tries to get us a version that runs on the latest release of FreeBSD.</p>

<p>They will not give us the algorithm for encrypting or decrypting the data sent to/received from their service. They probably have a secret key embedded in the compiled file.</p>

<p>The example website code they provide indicates that this stand-alone executable only does encryption and decryption of the data sent over the wire.</p>

<p>As part of our security review, we would like to find out does the compiled file only do the encryption/decryption or does it send information to another site/service.</p>

<p>Are there any US precedents or laws governing reverse engineering of foreign company obtained code for security reviews?</p>

<blockquote>
  <p>Are there any US precedents or laws governing reverse engineering of
  foreign company obtained code for security reviews?</p>
</blockquote>

<p>Yes there are, and they indicate that you may reverse engineer the executable.</p>

<p>Regarding <a href="https://www.law.cornell.edu/uscode/text/18/1836" rel="nofollow noreferrer">misappropriation of trade secrets</a>, <a href="https://www.law.cornell.edu/uscode/text/18/1839" rel="nofollow noreferrer">18 USC § 1839(6)(B)</a> explicitly states that "<em>improper means</em>" <em>does not include reverse engineering, independent derivation, or any other lawful means of acquisition</em>.</p>

<p>See also <a href="https://www.leagle.com/decision/infco20180327178" rel="nofollow noreferrer"><em>Oracle America, Inc. v. Google LLC</em>, 886 F.3d 1179, 1200 (2018)</a>:</p>

<blockquote>
  <p>In <em>Sony</em>, the court found that the defendant's reverse engineering
  and intermediate copying of Sony's copyrighted software system "was a
  fair use for the purpose of gaining access to the unprotected elements
  of Sony's software." 203 F.3d at 602. The court explained that Sony's
  software program contained unprotected functional elements and that
  the defendant could only access those elements through reverse
  engineering.</p>
</blockquote>

<p>The rest of that paragraph (omitted here) is about transforming vs. plagiarizing
software, which seems irrelevant to your situation because you are essentially trying to ascertain the embedding of secret key(s) and the application's use of sockets.</p>

<p>You will find additional cases with queries such as <a href="http://www.leagle.com/leaglesearch?all=software&amp;exact=reverse+engineering&amp;crt=Federal+Circuit" rel="nofollow noreferrer">http://www.leagle.com/leaglesearch?all=software&amp;exact=reverse+engineering&amp;crt=Federal+Circuit</a> , maybe trying different search parameters and/or jurisdictions.</p>

<p>So load the ELF file with the disassembler/debugger of your choice and start setting those breakpoints on <strong>int $0x80</strong>!</p>

software security