software hacking
Is cracking software with server emulators illegal?
<p>Let's say I have a program that needs you to login with a paid account in order to use it, and it sends authorization data to a server (username and pass) using this example link (I show example credentials): <a href="http://foo.bar/checkUser?user=PKTINOS&amp;pass=password" rel="nofollow noreferrer">http://foo.bar/checkUser?user=PKTINOS&amp;pass=password</a></p>

<p>In this sample, the authorization link returns "Success" if the credentials are valid and "Failure" if they are not.</p>

<p>And let's say I have another 3rd-party program that redirects that link to my own URL, e.g., <a href="http://bar.foo/checkUser" rel="nofollow noreferrer">http://bar.foo/checkUser</a>, that happens to always return "Success."</p>

<p>(This would allow you to use the program with false credentials.)</p>

<p>Would that violate any law?</p>

<p>Forget about copyright or EULAs. In the UK this would be illegal under the <a href="http://www.legislation.gov.uk/ukpga/1990/18" rel="nofollow noreferrer">Computer Misuse Act (1998)</a> and <strong>you could be jailed for up to a year</strong> - specifically</p>
<blockquote>
<p>Unauthorised access to computer material.</p>
<p>(1)A person is guilty of an offence if—</p>
<p>(a)he causes a computer to perform any function with intent to secure access to any program or data held in any computer, or to enable any such access to be secured;</p>
<p>(b)the access he intends to secure, or to enable to be secured, is unauthorised; and</p>
<p>(c)he knows at the time when he causes the computer to perform the function that that is the case.</p>
</blockquote>
<p>This law has been applied even to simply altering parameters in a GET request to a website, so it is incredibly broad.</p>
<p>Other jurisdictions have similar wording, so be aware!</p>

<p>As a first note, I will provide the obvious statement that this may vary from jurisdiction to jurisdiction and I speak only from knowledge of UK law and the resources at my disposal that may cover some other jurisdictions in a light touch manner.</p>

<p>As your question considers the scenario where you are spoofing a check for a paid account, I will assume that you do not possess the appropriate license for the software and are using this technique to circumvent what is a license verification procedure. </p>

<p>That said, usually this would be illegal as you are using a piece of software without the appropriate license. This follows the agreement (read contract) you have formed in the installation of the program - the EULA (end user license agreement). Where the EULA stipulates that you only have rights to utilise the software if you have the appropriate license, you would still be in breach. See section 1.g. of the <a href="http://www.mcafee.com/us/resources/legal/end-user-license-agreements-en-gb.pdf" rel="nofollow noreferrer">McAfee EULA</a>.</p>

<p>Furthermore, while you may not be in <em>direct</em> breach of the decompilation/modification restrictions imposed by the <a href="http://www.mcafee.com/us/resources/legal/end-user-license-agreements-en-gb.pdf" rel="nofollow noreferrer">EULA (3.f.)</a>, you may still be in breach of the proscription of 'Reverse Engineering', as through your analysis of the software you have been able to exploit a particular aspect.</p>

<p>Obviously, I have opted to use a fairly comprehensive EULA for the purpose of this answer and it is feasible that there may be software produced without the relevant provisions and protections.</p>
