Kaspersky Lab discovers multiple vulnerabilities in widely spread corporate license management software

Kaspersky Lab ICS CERT researchers have found a variety of serious vulnerabilities in the Hardware Against Software Piracy (HASP) license management system, widely used in corporate and ICS environments to activate the licensed software. A number of systems affected by the vulnerable technology may amount to hundreds of thousands and even more worldwide.

The USB-tokens in question are being widely used in different organizations to serve the purpose of convenient software license activation. In normal use case scenarios, a company’s system administrator would need to approach the computer with the software that needs to be activated and insert the token. It will then confirm that the software of interest is indeed legitimate (not pirated) and would activate it, so the user of the PC or server would then be able to use this software.
Once the token is attached to a PC or a server for the first time, the Windows OS downloads the software driver from the vendor’s servers in order to make the token hardware work properly with the computer hardware. In other cases, the driver comes installed with third party software which uses the aforementioned system for license protection. Our experts have found that, upon installation, this software adds port 1947 of the computer to the list of exclusions of the Windows Firewall with no proper user notification, making it available for a remote attack.

More importantly, the port remains open after the token has been de-attached, which is why even in a patched and protected corporate environment an attacker would only need to install a software using the HASP solution, or attach the token to a PC once (even a locked one) in order to make it available for remote attacks.
Overall, researchers have identified 14 vulnerabilities in a component of the software solution, including multiple DoS vulnerabilities and several RCEs (remote execution of arbitrary code) which, for instance, are automatically exploited not with user rights, but with the most privileged system rights. This provides attackers with an opportunity to execute any arbitrary codes. All identified vulnerabilities can be potentially very dangerous and result in big losses for businesses.