Tag Info

Hot answers tagged

21

The Code Golf is essentially to create an unkeyed 1:1 function to transform images. As such, it's highly vulnerable to chosen-plaintext attacks: if an attacker can convince Alice or Bob to transmit a carefully-crafted image, they can build up a map of what pixels get moved to where for that image size. Further, if the images being transmitted have ...


13

Basically this is a transposition cipher. What you would do is looking for pattern and rearrange like with this text example: http://www.richkni.co.uk/php/crypta/trans0.php Your example with grey scale text would be easier as the picture on code golf because you could see very easy what is a correct solution.


13

Obfuscation might look as the first obvious step, but obfuscation has to protect something in the code and that something cannot be webservice functionality because that is reverse engineered by intercepting the traffic even if it is SSL encrypted. Certificate pinning can prevent simple SSL interception by trusting a predefined certificate. You can ...


9

Fundamentally you cannot secure your client. At best you can obscure and obfuscate in order to make it more difficult for an attacker to modify the client. You mention that it is not a security issue because the server is properly secured, but merely an annoyance. It may be more annoying to try to obscure your client than to let a few modified clients make ...


9

The article actually describes two constructions, the second one using the first one as a building tool. The first construction provides indistinguishability obfuscation while the second one is functional encryption. Indistinguishability obfuscation is a rather esoteric property, which is not what non-academic think about when they hear "obfuscation"; the ...


7

None. If they don't decompile your app, they will just put it through a proxy with it's own SSL certificate. Your client can't provide security for your backend.


5

From a security, and even ideological, point of view; blobs are unacceptable. whatever people say, they are trying to dissuade you from the importance of this issue. the risks users of non-free software face, be it a firmware blob, driver blob, or Microsoft Windows, are vastly unmeasurable. and while it is safer using any Linux distro than Windows, it ...


5

It's harder to reverse-engineer complex code. You can introduce extra variables, pipe data through multiple classes, create classes which don't actually do anything, and generally muddy the waters. Measures such as this make it much more complex to reverse engineer your code, however it makes it much more difficult to engineer your code in the first place ...


4

The attacker could Man-In-The-Middle attack their own iPhone by creating a custom CA. SSL/TLS prevents third parties they don't trust from listening in. The attacker has no reason to distrust themselves and their iPhone allows them to make it trust whatever they want. The format won't be safe, and shouldn't be (be, not contain) sensitive information.


3

When you don't want the user to have access to your code, you must not let them run it on their machine. It's that simple. As you already found out yourself, obfuscation doesn't work. So what option do you have? Run it on your own servers and offer it to the customer as a service, for example via SOAP. The drawbacks are that you need to administrate ...


3

Yes, it's possible although not quite the way some think. I've proposed a few ideas on Schneier's blog along these lines. There are a few ways of doing this: Your own microcode that starts with a processor that will not change. This can be accomplished using an open core, for instance, and freezing the internal design. Then you (and other users) do custom ...


3

There have been a few implementations of fully homomorphic encryption (2010). Fully homomorphic means it can perform addition AND multiplication (as opposed to partially homomorphic). The answer to your question though relies on what you consider "weak" and sufficient for security. Does the encryption have to stand up for 100 years, or is it OK if it's ...


2

what measures would you take to limit the risk of people tampering with your client software? There's a balance here that only you can measure. Assuming your protection doesn't bother valid users, then you only have to balance the value, to you, of protecting the software against the value to the attacker of breaking the protection. If you're talking ...


2

So, you're looking at how to handle basic Traffic Analysis? The basic countermeasures from Wikipedia (the above link) are exactly what I expected: "It is difficult to defeat traffic analysis without both encrypting messages and masking the channel. When no actual messages are being sent, the channel can be masked by sending dummy traffic, similar to the ...


2

In short: you can't. As long as someone has the local copy and the local copy is capable of retrieving this key, then someone could reverse engineer and get it. If someone had attempted to hide or obfuscate their code, then I would just step through the program in real-time or through IDA Pro. If at some point you store your key in a variable, then I'll ...


2

It really depends on how sophisticated the crawler is. I doubt that the vast majority would go to the trouble of downloading word and excel documents, mainly due to the potential size. There are libraries available thought that make reading of doc, xls(x), pdf, etc. relatively easy. It is not out of the realm of possibility that some crawlers do download ...


2

The attacker can perform a man-in-the-middle attack on him self. Basic steps are: Setup a proxy like SSLsplit or Charles Proxy on a computer. Install a custom SSL root certificate on the device (iPhone). Add the proxy in the device settings. Now the device will route all traffic over the proxy. Normally you could not decrypt this traffic but the proxy ...


2

Note, there is no legitimate reason to hide the algorithm used if you use a suitably strong passphrase/key. If you are really concerned, you could open the encrypted file in a hex editor and change the fourth byte of the symmetrically encrypted ASCII armored file. E.g., the first four bytes of an symmetric encrypted file are: 8C 0D 04 09 with the ...


2

It looks like the passphrase which was used to encrypt the message with is encrypted with AES256. The algorithm used to encrypt the message is self is not known until the encrypted session key packet is decrypted. This is what pgpdump shows: Old: Symmetric-Key Encrypted Session Key Packet(tag 3)(13 bytes) New version(4) Sym alg - AES with 256-bit key(sym ...


2

I understand your issues, but one of the fundamental maxims of cryptography is that you shouldn't reinvent the wheel and create your own encryption algorithm, primarily because it will be nowhere near as secure as an established one. Is this data going to be accessible over the Internet or transmitted over unencrypted channels? If the answer to either of ...


1

Obfuscation is a technique used to, obfuscate, or make less obvious, something. From a security perspective, obfuscation can make it more difficult or time consuming for a human attacker to understand whatever it is they are looking at. (It could also be a method of security through obscurity, by hiding things, as an example.) Most of the time people view ...


1

Just adding a simpler explanation of Functional Encryption Fully Homomorphic Encryption before proceeding to Functional Encryption and Indistinguishability Obfuscation as it is easier to explain that way. Taken mainly from http://crypto.stanford.edu/craig/easy-fhe.pdf The above is a paper by Craig Gentry (one of the pioneers in this field), and he gives a ...


1

OpenPGP is defined in RFC 4880, which probably is the specification you're looking for. OpenPGP files (no matter whether binary or ASCII-armored) are composed of individual packets, each having a header (that is probably what you have been observing regarding the "IQ"). In an OpenPGP secret key packet, quite a lot of meta data is stored. As it also contains ...


1

With Snort you can compile your rules as "shared objects" that use C instead of the Snort language and can be obfuscated. See #2 here: http://blog.snort.org/2011/02/snort-shared-object-rules.html


1

The short answer is yes, there are a variety of ways to achieve this, if I'm understanding your question correctly. A basic example would be that a user could set-up Team viewer on their home PC, then connect to it from anywhere in the world. they could then use VNC into the office over the Team Viewer connection and appear (from an IP address perspective) ...


1

I recommend you to keep it simple. You could simply AES the fields you need to protect. Independently of the encryption method you use you must encrypt together some fields: Name + Surname Date of birth State + Street number + Street name *... Otherwise you could try statistical analysis against the data.


1

Security is increased through the use of multiple layers and techniques. You would be able to slow down the attacker, but as noted in the comments to your question there are still plenty of ways to attack a wordpress site - there is not a high degree of seperation between components, databases, etc in a vanilla install. Ensure the digest auth is also ...


1

Yes, this adds some defense in depth, assuming the digest auth (or even Basic auth) is done by the webserver. This would require requests to be authenticated before even hitting your application, meaning an attacker would be unable to exploit any vulnerabilities that might exist in the admin login. That being said, is the security margin added by this ...


1

This is impossible. You could use a streaming server to send it over RTMP or even put some DRM on it to make it harder to play outside of a secured player, but the stream can always be ripped if it goes to a client's computer and DRM is just a small hurdle to be overcome by a determined attacker. You seem to be aware that it is impossible though, so the ...


1

Obfuscation is "required" when either of the three following situations applies: The application does something which is inherently weak such as embedding a secret value in the source code. The application designer wants to "feel safe", and is sufficiently incompetent at cryptography so that obfuscation provides that feeling (ignorance is bliss). The ...



Only top voted, non community-wiki answers of a minimum length are eligible