Obfuscation refers to hiding the intended meaning of communication.

learn more… | top users | synonyms

2
votes
1answer
53 views

A code protector claims that it “ensures it is physically impossible to run code without a serial number” is this a scam?

VMProtect Software (found at http://vmpsoft.com/) claims that it: "allows the generation and verification of serial numbers. Both manual and automatic generation are supported. Serial numbers can be ...
2
votes
1answer
111 views

What kind of encryption or obfuscation is this? [closed]

I found this script on a web page who attempted to change my router's DNS configuration. But I can't understant what kind of encryption or obfuscation is used. Here, a sample of the code on the ...
-2
votes
1answer
56 views

Is it possible to build unbreakable Protocol Obfuscation? [closed]

Using Protocol Obfuscation some internet protocols have tried to evade traffic shaping. BitTorrent supports Protocol Obfuscation for instance. Is it possible to build unbreakable Protocol ...
72
votes
14answers
7k views

How to store passwords written on a physical notebook?

Answers to the question "How safe are password managers like LastPass?" suggest that storing personal passwords on a physical notebook might be a reasonable option: I know someone who won't use ...
5
votes
1answer
77 views

Using a single number instead of an IP address or a DNS name, which are concrete uses? [closed]

My question: I have read that using the single number equivalent (called the "binary equivalent" by the author) of the IP address instead of the actual IP address or the domain name can be used "to ...
1
vote
2answers
89 views

How can I hide my AWS S3 access key and secret in C++? [duplicate]

I'm using AWS S3 in my C++ app to upload and download files. I've included the access key and secret in my code but I'm worried someone could read them from the binary. Is there any standard technique ...
24
votes
11answers
4k views

Is obfuscation worth it [closed]

There are many tools to obfuscate .NET applications. The free ones do some basic obfuscation while commercial ones seem to promise more. My question is: Is it worth to use the commercial obfuscation ...
1
vote
1answer
106 views

Level of security provided with (.NET) obfuscator tools

There are numerous tools that offer to obfuscate .NET code. (Dotfuscator etc.) Question is simple, those who are experienced with such tools, what it the level of protection such tools offer? Against ...
0
votes
1answer
34 views

Entropy on payload

How can I guess if a payload is obfuscated or encrypted? in other words can I apply Shannon Entropy algorithm to a binary payload? any advice will be appreciated, thanks in advance
9
votes
1answer
126 views

IBAN with too few blanked digits?

It is customary for websites, messages, or other documents to sometimes display data (credit card numbers, phone numbers, ...) with some numbers blanked (e.g., replaced with asterisks) so that the ...
0
votes
1answer
53 views

Does a 'mailto:' hyperlink spoil any preceding email obfuscation efforts in PDF?

Assume there is a PDF file which contains the example@example.com email address as an image (the classic obfuscation method). However, what if this image is made clickable with a hyperlink which ...
1
vote
1answer
69 views

Common characters/statements in obfuscated JavaScript [closed]

I'm trying to compile a list of common characters and statements in obfuscated JavaScript. I'm using http://aw-snap.info/articles/js-examples.php for obfuscated JS examples, but I cannot distinguish ...
7
votes
1answer
289 views

Javascript phishing attack sucker: Do I need to be worried? [closed]

So, I'm an idiot. I opened a javascript phishing attack file. I would really, really appreciate some help with decoding the Javascript to figure out whether I'm in trouble, and what sort. I'm on OS X ...
0
votes
2answers
125 views

Hiding (Obfuscating) Java script [closed]

So i heard that obfuscating java script is useless and waste of time because anyone with a little of skill can decode your code. So i want to test that. This code will display a alert box saying hey ...
2
votes
1answer
125 views

Preventing reverse engineering through obfuscation and LLVM [closed]

I just came across this concept of "obfuscation" and randomizing the binary so that attacker can't use it to reverse engineer a particular piece of software. Can anyone point me to resources which ...
6
votes
4answers
5k views

What does this malicious PHP script do? [closed]

Somebody hacked my site and uploaded this script (template46.php) to my webroot and its content is: <?php $vIIJ30Y = Array('1'=>'F', '0'=>'j', '3'=>'s', '2'=>'l', '5'=>'M', ...
3
votes
4answers
251 views

Securing Data at Rest in Android

Here's a situation. I am the author of an app that allows my customers to stream videos on their local android device. I also allow them to download the video and store it locally on their android ...
3
votes
1answer
856 views

What methods are websites using to prevent direct access to media?

I really hope this question isn't off-topic... Background The question pertains to media security (video, audio, etc.), where the media in question is digitally protected (legally, DMCA-style) or ...
24
votes
5answers
5k views

Never spell a word the same way twice?

A long time ago I was reading about Renaissance-era ciphers and I remembered this quote: David Kahn, author of The Codebreakers, quotes Giovanni Battista Porta who published, in 1563, a famous ...
6
votes
1answer
258 views

Should veil framework produce packed and obfuscated binaries which bypass virustotal?

I have been working with the veil framework to test an internal IDS system I have in place. I have used a public malware sample which produces an 8/53 hit score on Virustotal and run it through the ...
3
votes
2answers
177 views

Security through obscurity - “https requests” are safe?

In an iPhone app that utilizes plain text (unencrypted) XML as the contents of its http POST requests over https to the app server; how would someone be able to discover the "format" of the plain text ...
-4
votes
1answer
135 views

Email obfuscation/munging recent research [closed]

Does anyone know of any recent (past year or two) research into email obfuscation/munging? All I can find are tests done five to ten years ago. I'm trying to decide whether it's something still ...
1
vote
1answer
449 views

GnuPG / OpenPGP: How to eliminate redundancy in PGP private key?

I examined a few randomly generated private keys generated by Gnu PG, and found a lot of redundancy. It is enclosed by -----BEGIN PGP PRIVATE KEY BLOCK----- and -----END PGP PRIVATE KEY BLOCK----- ...
1
vote
1answer
43 views

Location Obfusication and Email/remote login

Would it be possible for a user of a 3rd party VNC software package and email client to obfusicate/spoof their location, so that an employer would be unable to determine the location from which the ...
3
votes
1answer
103 views

Obfuscate IDS rules

Are there known techniques to obfuscate IDS rules, so they can't be easily used by attackers to reverse-engineer the vulnerability that they detect? Let me provide some context. Sometimes IDS ...
3
votes
2answers
1k views

How to Conceal/Detect PGP Symmetric Algorithm Used

When Symmetrically encrypting a file, (not signing, not an asymmetric encryption question), is it possible to conceal the encryption algorithm used, or is it already concealed, but just showing on ...
1
vote
1answer
234 views

Obfuscation alternatives

So I've made a tool for web developers and now I want to sell it, but I don't want all web developers to see my code (PHP). I do know there are PHP Obfuscators, but I don't want to use them, as they ...
26
votes
2answers
3k views

Break the popularity contest crypto

There is a very interesting puzzle on the Programming Puzzles and Code Golf site to Rearrange pixels in an image so it can't be recognized and then get it back. I understand that this is not ...
1
vote
4answers
192 views

Data anonymization/ encryption requirement

I did check out the previous postings and didnt find what I was looking for- apologies if this is a repetition. I am working on an analytics engagement for a customer and he needs to share access to ...
1
vote
1answer
402 views

Obfuscation and Mobile App

Recently, I stumbled with this topic in my mind for few days. I understand that obfuscation is not the best protection against reverse engineering. I wonder if there is another method that make it ...
4
votes
2answers
138 views

Does HTTP Digest Auth provide any increased security in this scenario?

Say I have a website running a popular CMS like Wordpress only over SSL through HTTP Strict Transport Security. Prior, the backend administrator login page could be accessed by anybody simply by ...
2
votes
2answers
93 views

Any way to obfuscate *when* two end hosts are communicating?

Whether or not a connection is encrypted, I'm afraid the time an information is sent from one host to another might reveal too much. And I'm literally talking about the time when pieces of information ...
1
vote
0answers
390 views

JPEG file SOS marker before SOF

I'm looking over some JPEG files with an assumption that a steganography has been used for trial obfuscation due to the installation of JPHS. I've come across a file where the start of scan marker ...
0
votes
2answers
1k views

How do you protect strings in code from users decompiling them and seeing them [duplicate]

For an example say we have an application such as a client based application which connects to an API using an api key. We are saying for this purpose there is no OAuth. How would a string or in this ...
0
votes
2answers
92 views

Displaying a video through the web whilst hiding the location

I felt this fit more here than SO, if not, please vote to migrate. We've been approached by a company who would like to use our platform to host their videos. The issue is that right now, we use the ...
0
votes
1answer
137 views

Is it useful to use 'dot' and 'at' in email addresses in documents on the web? [duplicate]

My question seems to be a mash up of two questions. The first is that over at TeX.SE there is a question about creating PDFs with crawler resistant email addresses. There are some good answers about ...
5
votes
1answer
98 views

Are there any fast Homomorphic Obfuscuation techniques available?

Assuming that cryptography falls into one of three areas: Awfully weak protocols and algorithms, that are trivial to break with a low amount of effort and resources Cryptographically strong ...
12
votes
4answers
2k views

Preventing reverse-engineering of client application

I have a web service which is used by a Flash client. Both the service and the Flash client is produced by me (read: my company). The Flash client communicates with the server over HTTPS. One of the ...
18
votes
2answers
4k views

Describe an example of indistinguishability obfuscation or functional encryption

As described in Perfecting the Art of Sensible Nonsense, a major breakthrough in cryptography research was published in the summer of 2013: Candidate Indistinguishability Obfuscation and Functional ...
2
votes
1answer
277 views

Use of openssl could be a weak point in an Android App?

I'm reviewing an Android app (consists of Java and C source). There are complicated obfuscation steps in the build process (for content protection). But it uses statically linked openssl library ...
65
votes
4answers
6k views

Is using 'dot' and 'at' in email addresses in public text still useful?

When entering your email address publicly, a practice is to replace . with text dot and @ with text at. I assume that the reasoning is that this way automatic email-collector robots won't match your ...
45
votes
3answers
4k views

I found obfuscated code in a comment on my blog. What should I do?

Today I was checking comments on my blog and I found a strange comment, here is the exact text <script>var ...
39
votes
15answers
7k views

Should we protect web application source code from being stolen by web hosts through obfuscation?

Is it worth to obfuscate a java web app source code so that the web host cannot make wrong use of the code or even steal your business? If so, how should this be dealt with? How should we obfuscate? ...
3
votes
2answers
197 views

Degree of Obfuscation

Let us assume that I have the following code: namespace MobileApp { public class Storage { public Storage() { } public bool Save() { bool ...
3
votes
1answer
748 views

Why does broad based malware use XOR obfuscation?

As per title... The malware can easily be de-obfuscated if it was obfuscated using common and known XOR techniques. Why don't malware authors use any other method that make it much harder to ...
4
votes
2answers
1k views

What are the implications of including binary blobs in the Linux kernel?

According to this there are compelling reasons for caution when installing obfuscated binaries. Knowing this, how can running binary blobs as a part of the Linux kernel be acceptable from a security ...
5
votes
1answer
503 views

Is Taking advantage of the IsNumeric() Function In VB.Net Through SQL Injection Possible?

Suppose this is the only mitigation used on a server: Dim IDPerson IDPerson = Request.Querystring("id") If IsNumeric(IDPerson) = True Then IDPerson = IDPerson Else IDPerson = 0 End If IDPerson is ...
5
votes
1answer
947 views

Malicious script analysis

Could somebody tell me what can this malicious code do? I see that in the beginning it turns off the error reporting and logging. Then something with get post method and files stuff. But I am not ...
6
votes
5answers
8k views

Obfuscating JavaScript code

Some Flash developers are afraid of JavaScript. Their point of view: Stealing JS source code is effortless, one would just 'view source' and copy it. Yes, you can decompile Flash bytecode, however it ...
11
votes
2answers
2k views

What does this injected code do?

One of my sites has just been hacked as this code has been inserted into random(?) files and places within the files. Does anyone understand what it is trying to do? I would welcome anything that may ...