Obfuscation refers to hiding the intended meaning of communication.

learn more… | top users | synonyms

1
vote
2answers
80 views

Login attempt password logging and obfuscation

I have a third party app that records the password from every login attempt (regardless of success or failure). Is this a standard operation and does it really serve any meaningful security purpose? ...
-2
votes
1answer
79 views

An alternative to obfuscation

Recently I devised a way to avoid obfuscation of a jar file, here is how it works: Renamed the abc.jar file to xyz.so Placed it in system folder something like /lib/bdevid/ where other .so files ...
0
votes
0answers
48 views

How can I STunnel/multiplex RDP and HTTPS over the same ServerIP:443? [migrated]

I need access to my own RDP running outside of a network with DPI-firewall. So SSL is the only option, but I have a SSL web server running. As I have as well only a single IP adress with dynamic IP I ...
114
votes
2answers
9k views

I found unknown PHP code on my server. How do I de-obfuscate the code?

We've been getting a lot of noise regarding hacked PHP files here, and it's taking a lot of time to answer these questions. In many cases, they are off-topic. We've had a discussion about this on ...
0
votes
1answer
69 views

What's Google Inbox request/response obfuscation skill? [closed]

I Inspected Google Inbox network resources via Chrome Developer Tool. I saw some request/response payload and result. This object type is not readable for human. I've never seen this kind of ...
2
votes
1answer
178 views

What kind of encryption or obfuscation is this? [closed]

I found this script on a web page who attempted to change my router's DNS configuration. But I can't understant what kind of encryption or obfuscation is used. Here, a sample of the code on the ...
1
vote
1answer
64 views

Hide data from user, but process it in application

Is there a way to hide the data that's received somehow from the user? In particular, I have some data that gets send from a webserver to an application. I want the application to process the data, ...
-4
votes
1answer
33 views

Tendency towards security-is-binary in cryptography [closed]

In the real (physical) world, we seem to feel secure with just enough security, e.g.: Our door lock isn't the most secure. Anyone can lock-pick / break with force. Our car isn't the most robust. ...
45
votes
4answers
5k views

Is this a self rolled hashing/obfuscation method? Can you recognize the pattern?

A system we're introducing into the organization is not using any traditional hashing function that I can find. I've been assigned to "approve" it by black-box testing. I suspect passwords are simply ...
1
vote
2answers
113 views

Reverse Engineering - Countermeasures [closed]

I'm new to information security but I'm learning about reverse engineering. I read here about countermeasures to make reverse engineering hard. Does code signing protect the code from reverse ...
3
votes
3answers
156 views

What kind of email attack is this?

I received the following invoice_scan_nHl8GB.js as an email attachment from a spoofed email address/infected PC zipped in a E.zip. Strangely the sender's address is not properly spoofed, probably ...
3
votes
1answer
71 views

A code protector claims that it “ensures it is physically impossible to run code without a serial number” is this a scam?

VMProtect Software (found at http://vmpsoft.com/) claims that it: "allows the generation and verification of serial numbers. Both manual and automatic generation are supported. Serial numbers can be ...
6
votes
1answer
295 views

Should veil framework produce packed and obfuscated binaries which bypass virustotal?

I have been working with the veil framework to test an internal IDS system I have in place. I have used a public malware sample which produces an 8/53 hit score on Virustotal and run it through the ...
-2
votes
1answer
72 views

Is it possible to build unbreakable Protocol Obfuscation? [closed]

Using Protocol Obfuscation some internet protocols have tried to evade traffic shaping. BitTorrent supports Protocol Obfuscation for instance. Is it possible to build unbreakable Protocol ...
8
votes
1answer
155 views

IBAN with too few blanked digits?

It is customary for websites, messages, or other documents to sometimes display data (credit card numbers, phone numbers, ...) with some numbers blanked (e.g., replaced with asterisks) so that the ...
16
votes
4answers
7k views

Processor microcode manipulation to change opcodes?

I had recently thought of an extreme way of implementing security by obscurity and wanted to ask you guys if it's possible. Would a person with no access to special processor documentation be able ...
75
votes
14answers
8k views

How to store passwords written on a physical notebook?

Answers to the question "How safe are password managers like LastPass?" suggest that storing personal passwords on a physical notebook might be a reasonable option: I know someone who won't use ...
5
votes
1answer
98 views

Using a single number instead of an IP address or a DNS name, which are concrete uses? [closed]

My question: I have read that using the single number equivalent (called the "binary equivalent" by the author) of the IP address instead of the actual IP address or the domain name can be used "to ...
1
vote
2answers
152 views

How can I hide my AWS S3 access key and secret in C++? [duplicate]

I'm using AWS S3 in my C++ app to upload and download files. I've included the access key and secret in my code but I'm worried someone could read them from the binary. Is there any standard technique ...
25
votes
11answers
4k views

Is obfuscation worth it [closed]

There are many tools to obfuscate .NET applications. The free ones do some basic obfuscation while commercial ones seem to promise more. My question is: Is it worth to use the commercial obfuscation ...
1
vote
1answer
210 views

Level of security provided with (.NET) obfuscator tools

There are numerous tools that offer to obfuscate .NET code. (Dotfuscator etc.) Question is simple, those who are experienced with such tools, what it the level of protection such tools offer? Against ...
67
votes
4answers
7k views

Is using 'dot' and 'at' in email addresses in public text still useful?

When entering your email address publicly, a practice is to replace . with text dot and @ with text at. I assume that the reasoning is that this way automatic email-collector robots won't match your ...
0
votes
1answer
39 views

Entropy on payload

How can I guess if a payload is obfuscated or encrypted? in other words can I apply Shannon Entropy algorithm to a binary payload? any advice will be appreciated, thanks in advance
0
votes
1answer
62 views

Does a 'mailto:' hyperlink spoil any preceding email obfuscation efforts in PDF?

Assume there is a PDF file which contains the example@example.com email address as an image (the classic obfuscation method). However, what if this image is made clickable with a hyperlink which ...
1
vote
1answer
100 views

Common characters/statements in obfuscated JavaScript [closed]

I'm trying to compile a list of common characters and statements in obfuscated JavaScript. I'm using http://aw-snap.info/articles/js-examples.php for obfuscated JS examples, but I cannot distinguish ...
7
votes
1answer
392 views

Javascript phishing attack sucker: Do I need to be worried? [closed]

So, I'm an idiot. I opened a javascript phishing attack file. I would really, really appreciate some help with decoding the Javascript to figure out whether I'm in trouble, and what sort. I'm on OS X ...
0
votes
2answers
141 views

Hiding (Obfuscating) Java script [closed]

So i heard that obfuscating java script is useless and waste of time because anyone with a little of skill can decode your code. So i want to test that. This code will display a alert box saying hey ...
3
votes
4answers
317 views

Securing Data at Rest in Android

Here's a situation. I am the author of an app that allows my customers to stream videos on their local android device. I also allow them to download the video and store it locally on their android ...
2
votes
1answer
143 views

Preventing reverse engineering through obfuscation and LLVM [closed]

I just came across this concept of "obfuscation" and randomizing the binary so that attacker can't use it to reverse engineer a particular piece of software. Can anyone point me to resources which ...
5
votes
4answers
6k views

What does this malicious PHP script do? [closed]

Somebody hacked my site and uploaded this script (template46.php) to my webroot and its content is: <?php $vIIJ30Y = Array('1'=>'F', '0'=>'j', '3'=>'s', '2'=>'l', '5'=>'M', ...
3
votes
1answer
1k views

What methods are websites using to prevent direct access to media?

I really hope this question isn't off-topic... Background The question pertains to media security (video, audio, etc.), where the media in question is digitally protected (legally, DMCA-style) or ...
25
votes
5answers
5k views

Never spell a word the same way twice?

A long time ago I was reading about Renaissance-era ciphers and I remembered this quote: David Kahn, author of The Codebreakers, quotes Giovanni Battista Porta who published, in 1563, a famous ...
1
vote
4answers
227 views

Data anonymization/ encryption requirement

I did check out the previous postings and didnt find what I was looking for- apologies if this is a repetition. I am working on an analytics engagement for a customer and he needs to share access to ...
3
votes
2answers
181 views

Security through obscurity - “https requests” are safe?

In an iPhone app that utilizes plain text (unencrypted) XML as the contents of its http POST requests over https to the app server; how would someone be able to discover the "format" of the plain text ...
7
votes
5answers
9k views

Obfuscating JavaScript code

Some Flash developers are afraid of JavaScript. Their point of view: Stealing JS source code is effortless, one would just 'view source' and copy it. Yes, you can decompile Flash bytecode, however it ...
-4
votes
1answer
146 views

Email obfuscation/munging recent research [closed]

Does anyone know of any recent (past year or two) research into email obfuscation/munging? All I can find are tests done five to ten years ago. I'm trying to decide whether it's something still ...
21
votes
2answers
5k views

Describe an example of indistinguishability obfuscation or functional encryption

As described in Perfecting the Art of Sensible Nonsense, a major breakthrough in cryptography research was published in the summer of 2013: Candidate Indistinguishability Obfuscation and Functional ...
4
votes
2answers
146 views

Does HTTP Digest Auth provide any increased security in this scenario?

Say I have a website running a popular CMS like Wordpress only over SSL through HTTP Strict Transport Security. Prior, the backend administrator login page could be accessed by anybody simply by ...
2
votes
1answer
504 views

GnuPG / OpenPGP: How to eliminate redundancy in PGP private key?

I examined a few randomly generated private keys generated by Gnu PG, and found a lot of redundancy. It is enclosed by -----BEGIN PGP PRIVATE KEY BLOCK----- and -----END PGP PRIVATE KEY BLOCK----- ...
3
votes
1answer
109 views

Obfuscate IDS rules

Are there known techniques to obfuscate IDS rules, so they can't be easily used by attackers to reverse-engineer the vulnerability that they detect? Let me provide some context. Sometimes IDS ...
1
vote
1answer
50 views

Location Obfusication and Email/remote login

Would it be possible for a user of a 3rd party VNC software package and email client to obfusicate/spoof their location, so that an employer would be unable to determine the location from which the ...
4
votes
2answers
1k views

How to Conceal/Detect PGP Symmetric Algorithm Used

When Symmetrically encrypting a file, (not signing, not an asymmetric encryption question), is it possible to conceal the encryption algorithm used, or is it already concealed, but just showing on ...
1
vote
1answer
253 views

Obfuscation alternatives

So I've made a tool for web developers and now I want to sell it, but I don't want all web developers to see my code (PHP). I do know there are PHP Obfuscators, but I don't want to use them, as they ...
26
votes
2answers
3k views

Break the popularity contest crypto

There is a very interesting puzzle on the Programming Puzzles and Code Golf site to Rearrange pixels in an image so it can't be recognized and then get it back. I understand that this is not ...
1
vote
1answer
505 views

Obfuscation and Mobile App

Recently, I stumbled with this topic in my mind for few days. I understand that obfuscation is not the best protection against reverse engineering. I wonder if there is another method that make it ...
3
votes
2answers
99 views

Any way to obfuscate *when* two end hosts are communicating?

Whether or not a connection is encrypted, I'm afraid the time an information is sent from one host to another might reveal too much. And I'm literally talking about the time when pieces of information ...
1
vote
0answers
425 views

JPEG file SOS marker before SOF

I'm looking over some JPEG files with an assumption that a steganography has been used for trial obfuscation due to the installation of JPHS. I've come across a file where the start of scan marker ...
1
vote
2answers
1k views

How do you protect strings in code from users decompiling them and seeing them [duplicate]

For an example say we have an application such as a client based application which connects to an API using an api key. We are saying for this purpose there is no OAuth. How would a string or in this ...
0
votes
2answers
106 views

Displaying a video through the web whilst hiding the location

I felt this fit more here than SO, if not, please vote to migrate. We've been approached by a company who would like to use our platform to host their videos. The issue is that right now, we use the ...
0
votes
1answer
139 views

Is it useful to use 'dot' and 'at' in email addresses in documents on the web? [duplicate]

My question seems to be a mash up of two questions. The first is that over at TeX.SE there is a question about creating PDFs with crawler resistant email addresses. There are some good answers about ...