Tag Info

Hot answers tagged

35

What is being described is a protection against some classes of known-plaintext attack. Up until the 1960s or so, most ciphers were vulnerable to these (eg. many of the attacks on the Enigma cipher were based on knowing or guessing part of the plaintext). Modern ciphers are effectively immune to this: knowing that the AES-encrypted message is "Attack at ...


21

The Code Golf is essentially to create an unkeyed 1:1 function to transform images. As such, it's highly vulnerable to chosen-plaintext attacks: if an attacker can convince Alice or Bob to transmit a carefully-crafted image, they can build up a map of what pixels get moved to where for that image size. Further, if the images being transmitted have ...


21

If I search Google for "parlaimnet biuldnig", I see: Showing results for parliament building Search instead for parlaimnet biuldnig So no, such mis-spells are not sufficient to fool automated systems or to act as a CAPTCHA. However, searching for "the bobm" Google doesn't offer me a correction, so the technique is not necessarily completely useless. ...


19

I would imagine the context of that statement was in the context of a cypher where a word repeated in multiple places produces the same cypher text in each location. If I see: AER TEO ZRE SGR. AER FSD ZFD DFG. YTR ASD AER DSG. Language analysis would reveal that "AER" is likely "The", and from there if you intercept sufficient number of encrypted ...


13

Basically this is a transposition cipher. What you would do is looking for pattern and rearrange like with this text example: http://www.richkni.co.uk/php/crypta/trans0.php Your example with grey scale text would be easier as the picture on code golf because you could see very easy what is a correct solution.


6

Type your example into a search engine of your choice. At least Google has no problem in correcting the relevant words, Bing even corrects them all. Input: the bobm is hdiden isnide teh parlaimnet biuldnig Google: the bomb is hidden isnide teh parliament building Bing: the bomb is hidden inside the parliament building Computers have become ...


5

It's harder to reverse-engineer complex code. You can introduce extra variables, pipe data through multiple classes, create classes which don't actually do anything, and generally muddy the waters. Measures such as this make it much more complex to reverse engineer your code, however it makes it much more difficult to engineer your code in the first place ...


4

The attacker could Man-In-The-Middle attack their own iPhone by creating a custom CA. SSL/TLS prevents third parties they don't trust from listening in. The attacker has no reason to distrust themselves and their iPhone allows them to make it trust whatever they want. The format won't be safe, and shouldn't be (be, not contain) sensitive information.


3

When you don't want the user to have access to your code, you must not let them run it on their machine. It's that simple. As you already found out yourself, obfuscation doesn't work. So what option do you have? Run it on your own servers and offer it to the customer as a service, for example via SOAP. The drawbacks are that you need to administrate ...


3

Yes, it's possible although not quite the way some think. I've proposed a few ideas on Schneier's blog along these lines. There are a few ways of doing this: Your own microcode that starts with a processor that will not change. This can be accomplished using an open core, for instance, and freezing the internal design. Then you (and other users) do custom ...


2

I recommend you to keep it simple. You could simply AES the fields you need to protect. Independently of the encryption method you use you must encrypt together some fields: Name + Surname Date of birth State + Street number + Street name *... Otherwise you could try statistical analysis against the data.


2

I understand your issues, but one of the fundamental maxims of cryptography is that you shouldn't reinvent the wheel and create your own encryption algorithm, primarily because it will be nowhere near as secure as an established one. Is this data going to be accessible over the Internet or transmitted over unencrypted channels? If the answer to either of ...


2

So, you're looking at how to handle basic Traffic Analysis? The basic countermeasures from Wikipedia (the above link) are exactly what I expected: "It is difficult to defeat traffic analysis without both encrypting messages and masking the channel. When no actual messages are being sent, the channel can be masked by sending dummy traffic, similar to the ...


2

In short: you can't. As long as someone has the local copy and the local copy is capable of retrieving this key, then someone could reverse engineer and get it. If someone had attempted to hide or obfuscate their code, then I would just step through the program in real-time or through IDA Pro. If at some point you store your key in a variable, then I'll ...


2

Just adding a simpler explanation of Functional Encryption Fully Homomorphic Encryption before proceeding to Functional Encryption and Indistinguishability Obfuscation as it is easier to explain that way. Taken mainly from http://crypto.stanford.edu/craig/easy-fhe.pdf The above is a paper by Craig Gentry (one of the pioneers in this field), and he gives a ...


2

Note, there is no legitimate reason to hide the algorithm used if you use a suitably strong passphrase/key. If you are really concerned, you could open the encrypted file in a hex editor and change the fourth byte of the symmetrically encrypted ASCII armored file. E.g., the first four bytes of an symmetric encrypted file are: 8C 0D 04 09 with the ...


2

It looks like the passphrase which was used to encrypt the message with is encrypted with AES256. The algorithm used to encrypt the message is self is not known until the encrypted session key packet is decrypted. This is what pgpdump shows: Old: Symmetric-Key Encrypted Session Key Packet(tag 3)(13 bytes) New version(4) Sym alg - AES with 256-bit key(sym ...


2

The attacker can perform a man-in-the-middle attack on him self. Basic steps are: Setup a proxy like SSLsplit or Charles Proxy on a computer. Install a custom SSL root certificate on the device (iPhone). Add the proxy in the device settings. Now the device will route all traffic over the proxy. Normally you could not decrypt this traffic but the proxy ...


1

Actually, Google is making it far more difficult for anyone to merely download a video because Google is parsing out the entire video and serving you only portions at a time. Thus your ideal single 'request URL' (AKA a GET request) is actually multiple GET requests. Because of this parsing, it becomes difficult to create a script/program that consistently ...


1

Obfuscation is a technique used to, obfuscate, or make less obvious, something. From a security perspective, obfuscation can make it more difficult or time consuming for a human attacker to understand whatever it is they are looking at. (It could also be a method of security through obscurity, by hiding things, as an example.) Most of the time people view ...


1

OpenPGP is defined in RFC 4880, which probably is the specification you're looking for. OpenPGP files (no matter whether binary or ASCII-armored) are composed of individual packets, each having a header (that is probably what you have been observing regarding the "IQ"). In an OpenPGP secret key packet, quite a lot of meta data is stored. As it also contains ...


1

With Snort you can compile your rules as "shared objects" that use C instead of the Snort language and can be obfuscated. See #2 here: http://blog.snort.org/2011/02/snort-shared-object-rules.html


1

The short answer is yes, there are a variety of ways to achieve this, if I'm understanding your question correctly. A basic example would be that a user could set-up Team viewer on their home PC, then connect to it from anywhere in the world. they could then use VNC into the office over the Team Viewer connection and appear (from an IP address perspective) ...


1

Security is increased through the use of multiple layers and techniques. You would be able to slow down the attacker, but as noted in the comments to your question there are still plenty of ways to attack a wordpress site - there is not a high degree of seperation between components, databases, etc in a vanilla install. Ensure the digest auth is also ...


1

Yes, this adds some defense in depth, assuming the digest auth (or even Basic auth) is done by the webserver. This would require requests to be authenticated before even hitting your application, meaning an attacker would be unable to exploit any vulnerabilities that might exist in the admin login. That being said, is the security margin added by this ...



Only top voted, non community-wiki answers of a minimum length are eligible