Metatrader. Protection from MQL Decompiling

by: Alexey Koshevoy




A little bit of theory.

Expert advisors, indicators and scripts for the Metatrader system are created using the built-in MQL language. Then, the source text code MQ4 is compiled into executable binary code EX4. File with the EX4 extension contains program logic understandable to the Metatrader interpreter only. We will not see anything using ordinary text editor. This is convenient in case if a programmer or trader provide their program for usage but doesn’t want the user to know the details of the sales strategy.

A problem.

Unfortunately, there are methods of decompiling the EX4 files back to MQ4 which allow seeing the program logic. This is a big problem for those who want to keep the details of their trading strategy confidential.

Decompiling makes it pointless to create a business that is based on sales of expert advisors or providing them for usage. The existing companies suffer great losses.

Solution methods.

There is an opinion that a good MQL programmer can write program in a way that would make it impossible to decompile. For example, by using licensing system. Well, unfortunately this is not the case. The strategy cannot be protected by means of MQL only.

Let us see several methods of protecting sales strategies. We will compare them and find out their pros and cons.

1. Pure MQL

As we have already said, this method does not provide protection because an EX4 file can be easily decompiled. However, along with the cons, MQL programming has its pros which will be examined in comparison with the other methods.

Pros: simple structured language that is comprehensible by traders and not only by specialists. Lowest cost level as compared to other methods.

Cons: easily decompiled.

Special features: applicable for personal use or for refinement of the strategies logic.

2. DLL

MQL language has a very useful special feature. It allows the programs to link with the libraries (DLL) written in other programming languages. First of all, it essentially expands the possibilities and secondly, it allows moving MQL logic into the library which makes decompiling of an EX4 file useless.

DLL can also be decompiled however it is by no means easy and requires specific knowledge. When decompiled, the DLL code is translated into the Assembler (ASM) machine language. This procedure is called disassembly. Pay level of ASM specialists is very high, thus such expenses are unreasonable for hacking most projects.

Moreover, a project consists of two parts minimum: MQL+DLL, which makes the hacking job even more complicated, since it requires teamwork of two specialists.

Pros: quite a high protection level, unlimited capacity to expand possibilities of the MQL language.

Cons: higher development cost as compared to an MQL project. Library installation required.

Special features: applicable for projects of average cost and popularity.

3. Online WEB

This method implies moving of the trade logic to WEB server. The user’s computer will have executive interface only, without the decision-making module.

MQL, DLL and WEB are used in this architecture. MQL generates a request, DLL sends it to WEB server, and the server generates and sends a reply that gets into MQL through DLL. MQL manages the orders based on the reply.

There are simpler variants, when MQL only listens to / monitors the replies from WEB server.

Pros: The highest protection. Possibility of remote updates. Possibility of remote control over access to the project.

Cons: Delays can occur during data synchronization. High development cost.

Special features: Applicable for major or popular projects.

Comparison.

The comparison was made by specialists of AirBionicFX company. Explanation of the results and comparison criteria are given below each diagram.

By protection level

Minimum is 0, Maximum is 10. The more, the better.

MQL – 1
DLL – 6
WEB – 9

MQL has minimal protection against hacking, but 1 point is scored considering that it is not every user who knows about decompiling and not everyone knowing it would be ready to use this method.

DLL has average protection level.

WEB has almost maximum protection level. One point is not scored because there is a probability to hack WEB server that stores the strategy logic. Such probability is very low and even if it happens, then a specialist is needed to decompile binary code and then synchronize the logic with the MQL.

The following factors were considered when estimating the protection level:
Statistics of users’ awareness of the decompiling possibility;
Complexity of decompiling process for each of the methods;
Cost of hacking job specialists.

By development cost

Minimum is 0, Maximum is 10. The less, the better.

MQL – 1
DLL – 4
WEB – 10

The results can be explained as follows. If we take any task and fulfill it using all methods, then MQL will be the most low-cost one, WEB is the most expensive, and DLL will have the cost a little less than average as per the maximum level.

The following factors were considered when estimating the development cost:
Cost of work done by specialists in each area;
Complexity and time for testing a ready project.

By speed of decision-making

Minimum is 0, Maximum is 10. The more, the better.

MQL – 10
DLL – 9-6
WEB – 6-1

Speed of decision-making is like the other side of a coin while the first side is protection. The more components the system has, the more problems will be there with data synchronization. Accordingly, WEB method will be the slowest. DLL will be average, and MQL – the fastest.

For DLL, a range of speed values is given. If DLL is used as a library for computations, then the processing speed will be practically comparable with the MQL and will have an index of 9 points. And if synchronization with the external data sources is used within DLL, then the speed index may fall to 6 points.

Same for WEB. If the logic is simple and it is executed fast, then the speed index will be not lower than 6 points. And if, for example, WEB server is connected with Back Office for computation of expert advisor values, then the speed index may fall to the minimal value.

The following factors were considered when estimating the speed of decision-making:
Project architecture;
Connection with external data sources.

Conclusion

When selecting a method of protection, you have to consider all the parameters described above. Then the facilities committed for the development will pay off over and above and the ill-wishers will be left with nothing!

Have a nice trade!



About The Author
Alexey Koshevoy, AirBionicFX founder and CEO

http://www.airbionicfx.com

Read rest of entry

Information Security Software: E-signature

by: Asna Ishrat




The conducting of business communication and transactions over networks and through computers. As most restrictively defined, electronic commerce is the buying and selling of goods and services, and the transfer of funds, through digital communications. However EC also includes all inter-company and intra-company functions (such as marketing, finance, manufacturing, selling, and negotiation) that enable commerce and use electronic mail, EDI, file transfer, fax, video conferencing, workflow, or interaction with a remote computer.

E-signature – The definition

A digital signature is an electronic (code) signature that can be used to authenticate the identity of the sender of a message or the signer of a document and to ensure that the original content of the message or document that has been sent is unchanged. Digital signatures are easily transportable, cannot be imitated by someone else, and can be automatically time-stamped. The ability to ensure that the original signed message arrived means that the sender cannot easily repudiate it later.

A digital signature can be used with any kind of message, whether it is encrypted or not, simply so that the receiver can be sure of the sender's identity and that the message arrived intact. A digital certificate contains the digital signature of the certificate-issuing authority so that anyone can verify that the certificate is real.

A more formal definition: "(I) A value computed with a cryptographic algorithm and appended to a data object in such a way that any recipient of the data can use the signature to verify the data's origin and integrity.

(II) Data appended to, or a cryptographic transformation of, a data unit that allows a recipient of the data unit to prove the source and integrity of the data unit and protect against forgery, e.g. by the recipient."
Source: IETF (http://www.ietf.org/rfc/rfc2828.txt).

E-signature – How It Works (with PKI)

Assume you were going to send the draft of a contract to your lawyer in another town. You want to give your lawyer the assurance that it was unchanged from what you sent and that it is really from you.

1. You copy-and-paste the contract (it's a short one!) into an e-mail note.

2. Using special software, you obtain a message hash (mathematical summary) of the contract.

3. You then use a private key that you have previously obtained from a public-private key authority to encrypt the hash.

4. The encrypted hash becomes your digital signature of the message. (Note that it will be different each time you send a message.)

At the other end, your lawyer receives the message.

1. To make sure it's intact and from you, your lawyer makes a hash of the received message.

2. Your lawyer then uses your public key to decrypt the message hash or summary.

3. If the hashes match, the received message is valid.

E-signature – The facts we all must know

It is evident from various definitions of e-signature and legislation enacted so far that almost everyone has tried to maintain technology independence so far. But generally it is also seen that use of PKI is catching up as a popular method of creating e-signatures (digital signatures) worldwide.

Use of PKI has some merits, over other methods, which are clearly seen as convenient and secure by the industry and businesses deploying such solution. The convenience of sharing keys, irreversible hashing algorithms and association of keys to an individual using digital certificate issued by a trusted party (Certificate Authority) have mainly contributed to this wining recipe.

A Certificate Authority (CA) issues a digital certificate with the information provided by the certificate subject, verifies information provided for correctness, digitally signs this certificate, associates such certificate with a public key and also publishes this key through its repository.

Through intelligently drafted legal agreements CA also puts all the responsibility liability on the certificate subscribers and relying parties whereas most popular internet browsers and email clients provide mechanism to trust a certificate implicitly or explicitly.

In such scenarios it very important for all to make sure that the certificates are only trusted and relied upon if these are issued by a trusted CA and are validated by issuing authority as not expired and/or revoked. Adding any certificate explicitly to the trust list maintained by your operating system is no less than committing hara-kiri.

CA is required to publish its Certificate Policy (CP) and Certificate Practice Statement (CPS) along with other agreements such as Subscriber’s Agreement & Relying Party’s Agreement. Equally important is the fact that all parties must understand and exactly know indemnities and warranties listed in various legal contracts.

The digital certificate verifies that the key pair used for the digital signature is associated to the person whose information is provided in the certificate. The certificate may also associate a person to an enterprise as authorized signatory. This demonstrates total dependence on the trust relying party must have in the certificate issuing authority (issuing CA) and his ability to get the certificate verified from the CA. It is an accepted fact and recommended best practice to not trust a certificate that cannot be verified for its validity, this means the CA must provide online certificate validation in real-time. Any CA just providing Certificate Revocation Lists is not good enough for serious business.

Trusting a CA must always be a well-thought decision and must be based on good knowledge of the security of the CA it self, its policies and practices pertaining to certificate lifecycle management, hiring of staff, access to sensitive information and areas (physical access), segregation of staff duties etc. An individual needing to rely on a digital signature should not have to be well-informed of all the legal and contractual intricacies on the contrary the individual will be more comfortable if there is some external entity that can audit and accredit certificate issuing CA as trustworthy.

Conclusion

There is no doubt that we have come a long way in improving these technologies to provide the comfort and trust to parties conducting business through electronic documents and transactions from one end of the world to the other there is even more need for governance in a totally new territory for all of us. And I must also be content with these (web) technologies for providing such convenient ways of researching, collecting information and doing business with such speed that would not have been possible only a few decades back.



About The Author
We offer Information Security Software Solution for System Auditing, Risk Management Tools, Vulnerability Scanners, Auditing Tools, Penetration Testing Tools, Forensics Utilities and Regulatory Compliance.

http://www.secure-bytes.com

Read rest of entry