Hot answers tagged

135

Fortunately, almost all PHP scripts can be deobfuscated with 4 simple methods. We're going to use these four methods to create a canonical answer. Before we begin, let's collect a list of common tools that assist in deobfuscating these malicious files so we can do the work ourselves. Common tools that aid in deobfuscation UnPHP. This greatly aids in de-...


57

I highly suspect this is a self rolled, or at least very outdated method. It is very weak by modern standards and should not be used to protect anything important. Short passwords could be cracked with no more than 2^64 brute force attempts, which is quite possible with even a normal computer. If both halves of the result are independent, even with fairly ...


55

This is a typical obfuscated JavaScript malware which targets the Windows Script Host to download the rest of the payload. In this case, it downloads what appears to be mainly a Chrome Extension (manifest.json and bg.js), the autoit Windows executable, and some autoit scripts which likely include some form of ransomware. All of these files are named with ....


48

In approximate order of increasing complexity (not security, and methods may be combined), here are some ideas that would be easy for anyone used to puzzles/writing code/maths. A more complete idea is below. NB: when I say "secret" I mean not written in the book. These are all easy, and most useful to deter the casual thief. Have a memorised secret ...


42

The problem with client sided Obfuscation/Protection is that the attacker will always win. Your code runs on his PC so he can intercept and manipulate everything in the end. In the specific case of .NET it might make sense to apply basic obfuscation to remove function names for example but free tools are perfectly fine for that. To answer your question a ...


20

I haven't got the time to fully reverse-engineer what this script does, but it seems to link to several .jpg files that are actually not images but text, and then references some .au3 files, suggesting that it actually saves those .jpg files under that extension. Those .au3 files seem to match AutoIt's file extension and indeed they look like valid AutoIt ...


17

Mark's excellent answer deals with the case where the obfuscation is relatively straightforward. This addresses 99% of cases, but once in a while you may come across something a bit more malicious, e.g. using encryption of the source code too. Executing the code (or at least part of it) can be a much quicker way to find out what the code is doing than ...


16

Let's be clear: Obfuscation is not there to be a form of security that is subject to scrutiny. It will fall down as soon as someone actually tries to get around the obfuscation and just makes things harder on the attacker. The purpose of obfuscation is to dissuade potential attackers from getting into the system without a large amount of effort, which may ...


16

I created a language for this purpose. None of the symbols look anything like English (no telling if they look like any other language), there are no spaces, several letters are missing, common patterns become single symbols (dis,ing,etc) to prevent easy decoding, it is written from top to bottom, right to left, in a grid with out lines, and I used trash to ...


11

Write a diary and embed the passwords within the entries. It will not look like a book of passwords. Someone will have to read it to notice the misspelled words. I used an address book where the addresses, phone numbers, and postal codes of close friends and family members which were PINs and passwords. I know my family members addresses and phone numbers, ...


10

Is obfuscation worth it? Yes, of course it is worth it. Any extra layer which does not interfere with another layer is always worth it. It will deter the average person and keep the majority of people, or would be script kiddies, at bay.... But Commercial tools I would say are not, as anything to advanced could actually hinder your development, using some ...


10

You're lucky: it's Windows-specific. First, I took the code, and went to jsbeautifier.org to beautify it: var stroke = "5556515E070B0A1005071024120D171005011C140116100D17014A0A0110"; function do193() { return ',"h'; }; function do112() { return ') { '; }; function do127() { return 'r xa'; }; function do88() { return '= 0;'; }; function ...


10

The fact that the length of encoded strings depends on the length of respective passwords suggests a much worse weakness: passwords seem to be obfuscated rather than hashed. This means than anyone who knows the internals of the system may be able to instantly decrypt any passowrd! The implications are numerous: you have to trust developers who ever worked ...


10

From what it looks like, a malicious actor leverage what is known as a XML External Entity vulnerability (XXE) and then a Server-Side Request Forgery (SSRF). Facebook's servers were tricked into linking a malicious XML file from another domain, processing it and served it up to you. Here is the XXE cheat sheet and SSRF bible's cheat sheet, if you're ...


9

To show you it is easy to de-obfuscate your code, and therefore kind of useless to obfuscate it in the first place, I will present you how I did to de-obfuscate it in a quick and dirty fashion: I took your code, and replaced the first "eval" by "console.log". This gave me another (smaller) code starting with "eval". So I repeated this process 9 times, as ...


9

There are many better and more secure examples but I thought I'd mention one thing I've used in the past, which is mnemonics in the form of a drawings/comics to represent passphrases. This does require that you can vaguely remember what the passphrase was, however. An example could be the phrase "Tommy's birthday is on March 23rd!". The comic could ...


9

A basic method to minimise the impact of someone being able to find out passwords from glancing over at the notebook would be to have one password per page - if you're looking at that one, that's all they can see. Another alternative would be to have a Diceware or similar list, and note down the numbers. It adds a step to "decryption", in that the ...


9

Is this an exploit on Facebook? Most likely. The unscrupulous are always trying to find ways to gain access to bank accounts, passwords, friend lists, and anything else they can do to turn a buck. Is it possible that my friend got a virus which targets their contacts by tagging them on malicious links? There's no reason to think otherwise. The ...


8

Use a mask. No, seriously. Use something like medium-thickness cardboard, obtainable from office supply or hobby stores, to create a rigid grid mask, maybe 30x6 character slots in size, and cut out randomly placed holes for maybe 40-50 characters out of those. (You can obviously pick different dimensions, depending on your needs.) To write down a password, ...


6

Once upon a time, I wrote down the different PINs for my credit and bank cards. I converted them to base 9 and then added a spurious extra 9 somewhere in each number. I think that was pretty safe, but of course it only works for entirely numeric passwords such as PINs.


5

I think your 'testing' is redundant. Obfuscation is not encryption and it is completely possible to de-obfuscate even if it takes manual investigation and a lot of patience. There are many tools out there to assist and there is no logical reason why this example can't be reduced to a simpler chunk of code relatively quickly. Anyone's effort to decode this ...


5

This is a fool's errand. Even if you you could obfuscate them sufficiently in the source code, it would still be child's play to hook the device up to a proxy like Fiddler or Burp Suite, and see the raw URLs plain as day when the app is running. No need to look at your source code at all, and there is absolutely nothing you can do about protecting HTTP ...


4

I've come across several attempts at a wallet-sized reference card used as your password ciphertext. One example: http://www.passwordcard.org/en I wouldn't use one of these, but if I did, I'd spend more time on my mental model of how I derived my password, which should provide enough obfuscation that you likely wouldn't be able to acquire the card and the ...


4

Depends on the filter implementation and maybe the OS on the client machine. As you said - the IP address will end up in the TCP packets in its binary representation, regardless of how it was originally passed to the socket software layer. Firewalls will filter for this binary address and thus catch anything - there is no way around that. However, if the "...


4

This is a Cross-Site Request Forgery attempt. This Cross-Site Request Forgery attack attempts to exploit your router using the most common default user/pass combos and change your DNS servers to another: var dnsprimario = "103.31.0.140"; var dnssecundario = "8.8.8.8"; document.write('<img src="hxxp://admin:admin@10.1.1.1/dnscfg.cgi?dnsPrimary=' + ...


4

So their market is protecting your app from the prying eyes of reverse engineers. Myself, I find that page a little too fluffy, and a little too scant on details. I certainly wouldn't buy their product based solely on the descriptions on that page. Based on the descriptions, it looks like they generate some custom assembly language for each app, then you ...


4

Kerckhoffs's_principle obviously applies: A cryptosystem should be secure even if everything about the system, except the key, is public knowledge. This in itself should be enough for you to say "I cannot approve this system without more information." From your examples, it seems that the input is divided into blocks of 8 characters/bytes, each block is ...


4

I picked through the source code. The decode() function is simply a Base64 decoder. Most of its arguments and local variables serve no purpose at all. Likewise, the ratifyvWk() function, which decrypts a string by performing Base64 decoding (using the above function) followed by a Vigenère-style XOR decryption step with the key VtiEH9DlpPnDjlsD. The only ...


4

You are confusing many terms here. Perhaps I can help. Code signing is the process of cryptographically signing a file so that a user of the file can tell who signed the file and whether it has been modified since signing. It generally doesn't make the file unreadable, though, depending on how the signature is attached to the file, you may need a special ...


4

No. People with vested interests and deep wallets have put countless man-hours into solving this problem, even when using specialized hardware, and it gets broken over and over. Some game systems used security chips (10NES, anyone?) which validated cartridges and refused to run the system if the signatures did not match. It did not work out too well. If you ...



Only top voted, non community-wiki answers of a minimum length are eligible