Obfuscation refers to hiding the intended meaning of communication.

learn more… | top users | synonyms

118
votes
2answers
9k views

I found unknown PHP code on my server. How do I de-obfuscate the code?

We've been getting a lot of noise regarding hacked PHP files here, and it's taking a lot of time to answer these questions. In many cases, they are off-topic. We've had a discussion about this on ...
90
votes
4answers
36k views

I was tricked on Facebook into downloading an obfuscated script

I got a notification on Facebook: "(a friend of mine) mentioned you in a comment". However, when I clicked it, Firefox tried to download the following file: comment_24016875.jse This is an ...
76
votes
14answers
8k views

How to store passwords written on a physical notebook?

Answers to the question "How safe are password managers like LastPass?" suggest that storing personal passwords on a physical notebook might be a reasonable option: I know someone who won't use ...
68
votes
4answers
7k views

Is using 'dot' and 'at' in email addresses in public text still useful?

When entering your email address publicly, a practice is to replace . with text dot and @ with text at. I assume that the reasoning is that this way automatic email-collector robots won't match your ...
58
votes
7answers
10k views

Is image blurring an unsafe method to obfuscate information in images?

Is image blurring an unsafe method to obfuscate information in images? I.e., is it possible to "de-blur" the image, if you know the algorithm and the setting, or by trial & error? For instance, ...
45
votes
3answers
5k views

I found obfuscated code in a comment on my blog. What should I do?

Today I was checking comments on my blog and I found a strange comment, here is the exact text <script>var _0x352a=["\x31\x31\x34\x2E\x34\x35\x2E\x32\x31\x37\x2E\x33\x33\x2F\x76\x6C\x6B\x2E\x70\...
45
votes
4answers
5k views

Is this a self rolled hashing/obfuscation method? Can you recognize the pattern?

A system we're introducing into the organization is not using any traditional hashing function that I can find. I've been assigned to "approve" it by black-box testing. I suspect passwords are simply ...
41
votes
15answers
8k views

Should we protect web application source code from being stolen by web hosts through obfuscation?

Is it worth to obfuscate a java web app source code so that the web host cannot make wrong use of the code or even steal your business? If so, how should this be dealt with? How should we obfuscate? ...
26
votes
2answers
3k views

Break the popularity contest crypto

There is a very interesting puzzle on the Programming Puzzles and Code Golf site to Rearrange pixels in an image so it can't be recognized and then get it back. I understand that this is not ...
25
votes
5answers
5k views

Never spell a word the same way twice?

A long time ago I was reading about Renaissance-era ciphers and I remembered this quote: David Kahn, author of The Codebreakers, quotes Giovanni Battista Porta who published, in 1563, a famous ...
25
votes
11answers
4k views

Is obfuscation worth it [closed]

There are many tools to obfuscate .NET applications. The free ones do some basic obfuscation while commercial ones seem to promise more. My question is: Is it worth to use the commercial obfuscation ...
21
votes
2answers
5k views

Describe an example of indistinguishability obfuscation or functional encryption

As described in Perfecting the Art of Sensible Nonsense, a major breakthrough in cryptography research was published in the summer of 2013: Candidate Indistinguishability Obfuscation and Functional ...
16
votes
4answers
8k views

Processor microcode manipulation to change opcodes?

I had recently thought of an extreme way of implementing security by obscurity and wanted to ask you guys if it's possible. Would a person with no access to special processor documentation be able ...
13
votes
1answer
1k views

Why do attackers bother (trivially) obfuscating their source code?

A friend of mine recently discovered and sent me a small collection of trojan php scripts that were uploaded to his machine. Here's an example: eval(gzinflate(str_rot13(base64_decode('huge-string'))...
12
votes
4answers
3k views

Preventing reverse-engineering of client application

I have a web service which is used by a Flash client. Both the service and the Flash client is produced by me (read: my company). The Flash client communicates with the server over HTTPS. One of the ...
11
votes
2answers
3k views

What does this injected code do?

One of my sites has just been hacked as this code has been inserted into random(?) files and places within the files. Does anyone understand what it is trying to do? I would welcome anything that may ...
10
votes
1answer
2k views

Reversible password storage obfuscation method for third-party login credentials

I have an internal business application, that as part of its functionality connects to a third-party app using login credentials specific to the user of my own app. These passwords are stored in a ...
8
votes
5answers
9k views

Obfuscating JavaScript code

Some Flash developers are afraid of JavaScript. Their point of view: Stealing JS source code is effortless, one would just 'view source' and copy it. Yes, you can decompile Flash bytecode, however it ...
8
votes
1answer
159 views

IBAN with too few blanked digits?

It is customary for websites, messages, or other documents to sometimes display data (credit card numbers, phone numbers, ...) with some numbers blanked (e.g., replaced with asterisks) so that the ...
7
votes
1answer
430 views

Javascript phishing attack sucker: Do I need to be worried? [closed]

So, I'm an idiot. I opened a javascript phishing attack file. I would really, really appreciate some help with decoding the Javascript to figure out whether I'm in trouble, and what sort. I'm on OS X ...
6
votes
2answers
2k views

Canonicalization & Output Encoding

I'm reading OWASP's Secure Coding Practices Checklist and under their "Input Validation" section they have an item that reads: If any potentially hazardous characters (<>"'%()&+\\'\") ...
6
votes
1answer
301 views

Should veil framework produce packed and obfuscated binaries which bypass virustotal?

I have been working with the veil framework to test an internal IDS system I have in place. I have used a public malware sample which produces an 8/53 hit score on Virustotal and run it through the ...
6
votes
1answer
110 views

Is there a reason why legit web sites are using this type of obfuscation?

Saw some top 200 web sites (by Alexa) using obfuscation in the javascript code. Any ideas on why they do it? My guess is that they do it to prevent data scraping, but not sure. Thanks. youtube ...
5
votes
4answers
7k views

What does this malicious PHP script do? [closed]

Somebody hacked my site and uploaded this script (template46.php) to my webroot and its content is: <?php $vIIJ30Y = Array('1'=>'F', '0'=>'j', '3'=>'s', '2'=>'l', '5'=>'M', '4'=>'...
5
votes
4answers
9k views

Reflector - obfuscated code

I run Reflector to de-compile some program and it seems to be obfuscated. I got following output, it’s not very useful. Any ideas how to decompile obfuscated code? [CompilerGenerated] get ...
5
votes
1answer
1k views

Malicious script analysis

Could somebody tell me what can this malicious code do? I see that in the beginning it turns off the error reporting and logging. Then something with get post method and files stuff. But I am not ...
5
votes
2answers
2k views

What are the implications of including binary blobs in the Linux kernel?

According to this there are compelling reasons for caution when installing obfuscated binaries. Knowing this, how can running binary blobs as a part of the Linux kernel be acceptable from a security ...
5
votes
1answer
107 views

Are there any fast Homomorphic Obfuscuation techniques available?

Assuming that cryptography falls into one of three areas: Awfully weak protocols and algorithms, that are trivial to break with a low amount of effort and resources Cryptographically strong ...
5
votes
1answer
106 views

Using a single number instead of an IP address or a DNS name, which are concrete uses? [closed]

My question: I have read that using the single number equivalent (called the "binary equivalent" by the author) of the IP address instead of the actual IP address or the domain name can be used "to ...
5
votes
2answers
147 views

Is it actually feasible or useful to use a high number of proxy servers?

In the movies, it's not uncommon to see the digitized global map projected on a huge wall with a line of light (presumably a user's connection) travelling back and forth all over the globe in a ...
5
votes
1answer
532 views

Is Taking advantage of the IsNumeric() Function In VB.Net Through SQL Injection Possible?

Suppose this is the only mitigation used on a server: Dim IDPerson IDPerson = Request.Querystring("id") If IsNumeric(IDPerson) = True Then IDPerson = IDPerson Else IDPerson = 0 End If IDPerson is ...
4
votes
2answers
1k views

How to Conceal/Detect PGP Symmetric Algorithm Used

When Symmetrically encrypting a file, (not signing, not an asymmetric encryption question), is it possible to conceal the encryption algorithm used, or is it already concealed, but just showing on ...
4
votes
2answers
152 views

Does HTTP Digest Auth provide any increased security in this scenario?

Say I have a website running a popular CMS like Wordpress only over SSL through HTTP Strict Transport Security. Prior, the backend administrator login page could be accessed by anybody simply by ...
4
votes
1answer
411 views

Need help on understanding obfuscated code in CVE-2012-4969 exploit

As you may know this vulnerability was found a while ago in the wild and the exploit is available too, btw I'm having problem on understanding the obfuscated code. Is it necessary to use obfuscation ...
4
votes
2answers
565 views

How do I remove or anonymize file names and path that are stored in compiled .NET exe output?

When an exception occurs in a .NET application, the exception output also includes the path and file name of the code file that resided on the developer's machine. This shares some information that ...
3
votes
3answers
692 views

Need help decoding suspicious Perl .cgi files

I found three (identical) .cgi files in the "cgi-bin" directory of a hacked website account. My knowledge of Perl is insufficient to decode them. I see some regexp with code execution, but I don't see ...
3
votes
4answers
344 views

Securing Data at Rest in Android

Here's a situation. I am the author of an app that allows my customers to stream videos on their local android device. I also allow them to download the video and store it locally on their android ...
3
votes
2answers
182 views

Security through obscurity - “https requests” are safe?

In an iPhone app that utilizes plain text (unencrypted) XML as the contents of its http POST requests over https to the app server; how would someone be able to discover the "format" of the plain text ...
3
votes
2answers
214 views

Degree of Obfuscation

Let us assume that I have the following code: namespace MobileApp { public class Storage { public Storage() { } public bool Save() { bool ...
3
votes
1answer
167 views

How to ensure web application remains secured after intrusion of server

My application employs asymmetric encryption / decryption, the process of how this work is detailed below: Encryption - Server A Data is encrypted using the public key of server B Data is signed ...
3
votes
2answers
114 views

What is the meaning of this possible malware?

My hosting service was helping me to identify a problem, and we found the following possible malware (which, of course, we have removed). Unfortunately, I'm not terribly technical, and so I am ...
3
votes
3answers
160 views

What kind of email attack is this?

I received the following invoice_scan_nHl8GB.js as an email attachment from a spoofed email address/infected PC zipped in a E.zip. Strangely the sender's address is not properly spoofed, probably ...
3
votes
1answer
865 views

Why does broad based malware use XOR obfuscation?

As per title... The malware can easily be de-obfuscated if it was obfuscated using common and known XOR techniques. Why don't malware authors use any other method that make it much harder to ...
3
votes
1answer
75 views

A code protector claims that it “ensures it is physically impossible to run code without a serial number” is this a scam?

VMProtect Software (found at http://vmpsoft.com/) claims that it: "allows the generation and verification of serial numbers. Both manual and automatic generation are supported. Serial numbers can be ...
3
votes
2answers
122 views

Any way to obfuscate *when* two end hosts are communicating?

Whether or not a connection is encrypted, I'm afraid the time an information is sent from one host to another might reveal too much. And I'm literally talking about the time when pieces of information ...
3
votes
1answer
1k views

What methods are websites using to prevent direct access to media?

I really hope this question isn't off-topic... Background The question pertains to media security (video, audio, etc.), where the media in question is digitally protected (legally, DMCA-style) or ...
3
votes
1answer
110 views

Obfuscate IDS rules

Are there known techniques to obfuscate IDS rules, so they can't be easily used by attackers to reverse-engineer the vulnerability that they detect? Let me provide some context. Sometimes IDS ...
2
votes
2answers
180 views

What risks do I have now that I accidentaly opened a suspicious URL send to me by Skype?

The following URL was sent to me by a trusted Skype contact (from my university): WARNING - DO NOT CLICK IF YOU DON'T KNOW WHAT YOU'RE DOING http://bit.ly/28PPw3V#dahubas=my_skype_id I clicked on ...
2
votes
1answer
211 views

What kind of encryption or obfuscation is this? [closed]

I found this script on a web page who attempted to change my router's DNS configuration. But I can't understant what kind of encryption or obfuscation is used. Here, a sample of the code on the page:...
2
votes
1answer
302 views

Lamp server sandbox for testing malicious php script

Fortunately despite recently becoming a full time web developer, security is something I take very seriously. There's a developer that I work with who's system was recently compromised with obfuscated ...