Quote:

Bingo! We’ve got an executable, which automagically performs TONS of integrity checks, which checks are spread all over the executable, and are extremely non-obvious too.

Another Quote:

This approach of 'not revealing code until attack costs are high' is certainly not limited to payments.

Quote:

it is fundamentally impossible to prevent (or detect) debugging, at least as long we’re staying on one single box.

Another Quote:

DON’T spend more than 10% of your overall anti-bot-fighting time budget on system-specific protections.

Quote:

Some of the system calls are not absolutely necessary, and using them will significantly simplify life of the attacker

Another Quote:

Scrambling will help to protect your protocol even if the attacker manages to F.L.I.R.T. with your TLS library

Quote:

One of the nastier-for-us features of IDA Pro is so-called F.L.I.R.T.

Another Quote:

All the popular protection methods lag well-behind capabilities of the average-attacker-on-a-100K-simultaneous-player-game.