Hot answers tagged

135

Fortunately, almost all PHP scripts can be deobfuscated with 4 simple methods. We're going to use these four methods to create a canonical answer. Before we begin, let's collect a list of common tools that assist in deobfuscating these malicious files so we can do the work ourselves. Common tools that aid in deobfuscation UnPHP. This greatly aids in de-...


103

This is a typical obfuscated JavaScript malware which targets the Windows Script Host to download the rest of the payload. In this case, it downloads what appears to be mainly a Chrome Extension (manifest.json and bg.js), the autoit Windows executable, and some autoit scripts which install them. All of these files are named with .jpg extensions on the (...


63

Is it possible to "de-blur" the image, if you know the algorithm and the setting, or by trial & error? Here, I assume we are only considering images which were blurred using a filter applied to the image, and not as a result of a poor capture (motion/optical blur). Deblurring definitely is possible, and you will see support in many image processing ...


57

I highly suspect this is a self rolled, or at least very outdated method. It is very weak by modern standards and should not be used to protect anything important. Short passwords could be cracked with no more than 2^64 brute force attempts, which is quite possible with even a normal computer. If both halves of the result are independent, even with fairly ...


48

In approximate order of increasing complexity (not security, and methods may be combined), here are some ideas that would be easy for anyone used to puzzles/writing code/maths. A more complete idea is below. NB: when I say "secret" I mean not written in the book. These are all easy, and most useful to deter the casual thief. Have a memorised secret ...


42

The problem with client sided Obfuscation/Protection is that the attacker will always win. Your code runs on his PC so he can intercept and manipulate everything in the end. In the specific case of .NET it might make sense to apply basic obfuscation to remove function names for example but free tools are perfectly fine for that. To answer your question a ...


31

I haven't got the time to fully reverse-engineer what this script does, but it seems to link to several .jpg files that are actually not images but text, and then references some .au3 files, suggesting that it actually saves those .jpg files under that extension. Those .au3 files seem to match AutoIt's file extension and indeed they look like valid AutoIt ...


17

Mark's excellent answer deals with the case where the obfuscation is relatively straightforward. This addresses 99% of cases, but once in a while you may come across something a bit more malicious, e.g. using encryption of the source code too. Executing the code (or at least part of it) can be a much quicker way to find out what the code is doing than ...


16

Let's be clear: Obfuscation is not there to be a form of security that is subject to scrutiny. It will fall down as soon as someone actually tries to get around the obfuscation and just makes things harder on the attacker. The purpose of obfuscation is to dissuade potential attackers from getting into the system without a large amount of effort, which may ...


16

I created a language for this purpose. None of the symbols look anything like English (no telling if they look like any other language), there are no spaces, several letters are missing, common patterns become single symbols (dis,ing,etc) to prevent easy decoding, it is written from top to bottom, right to left, in a grid with out lines, and I used trash to ...


16

From what it looks like, a malicious actor leverage what is known as a XML External Entity vulnerability (XXE) and then a Server-Side Request Forgery (SSRF). Facebook's servers were tricked into linking a malicious XML file from another domain, processing it and served it up to you. Here is the XXE cheat sheet and SSRF bible's cheat sheet, if you're ...


14

Yes, blurring is an unsafe way to censor data in images. There are software that can easily reverse algorithmic blurring like gaussian blurs, to fairly legible result. Often enough to identify objects/read texts.


11

Write a diary and embed the passwords within the entries. It will not look like a book of passwords. Someone will have to read it to notice the misspelled words. I used an address book where the addresses, phone numbers, and postal codes of close friends and family members which were PINs and passwords. I know my family members addresses and phone numbers, ...


11

Is this an exploit on Facebook? Most likely. The unscrupulous are always trying to find ways to gain access to bank accounts, passwords, friend lists, and anything else they can do to turn a buck. Is it possible that my friend got a virus which targets their contacts by tagging them on malicious links? There's no reason to think otherwise. The ...


10

Is obfuscation worth it? Yes, of course it is worth it. Any extra layer which does not interfere with another layer is always worth it. It will deter the average person and keep the majority of people, or would be script kiddies, at bay.... But Commercial tools I would say are not, as anything to advanced could actually hinder your development, using some ...


10

The fact that the length of encoded strings depends on the length of respective passwords suggests a much worse weakness: passwords seem to be obfuscated rather than hashed. This means than anyone who knows the internals of the system may be able to instantly decrypt any passowrd! The implications are numerous: you have to trust developers who ever worked ...


9

A basic method to minimise the impact of someone being able to find out passwords from glancing over at the notebook would be to have one password per page - if you're looking at that one, that's all they can see. Another alternative would be to have a Diceware or similar list, and note down the numbers. It adds a step to "decryption", in that the ...


9

There are many better and more secure examples but I thought I'd mention one thing I've used in the past, which is mnemonics in the form of a drawings/comics to represent passphrases. This does require that you can vaguely remember what the passphrase was, however. An example could be the phrase "Tommy's birthday is on March 23rd!". The comic could ...


8

Use a mask. No, seriously. Use something like medium-thickness cardboard, obtainable from office supply or hobby stores, to create a rigid grid mask, maybe 30x6 character slots in size, and cut out randomly placed holes for maybe 40-50 characters out of those. (You can obviously pick different dimensions, depending on your needs.) To write down a password, ...


8

It depends on two things: the image itself (amount of info), and the blur used (type+amount). The Gaussian blur you mentioned re-distributes contrast (info) from where it's most or least concentrated into a diffusing circle around the contrast; more towards the center, less and less as you approach the edge of the circle (aka blur radius). Instead of a ...


7

What risks do you have? Possibly that your computer is now infected with malicious software like a virus or a trojan horse. The following steps should be taken if you didn't already. What to do? There are some steps you can take: First of all, don't click on links that you don't trust or know Use unshortenit.it or urlex.org to check where the ...


6

Once upon a time, I wrote down the different PINs for my credit and bank cards. I converted them to base 9 and then added a spurious extra 9 somewhere in each number. I think that was pretty safe, but of course it only works for entirely numeric passwords such as PINs.


5

This is a fool's errand. Even if you you could obfuscate them sufficiently in the source code, it would still be child's play to hook the device up to a proxy like Fiddler or Burp Suite, and see the raw URLs plain as day when the app is running. No need to look at your source code at all, and there is absolutely nothing you can do about protecting HTTP ...


4

Depends on the filter implementation and maybe the OS on the client machine. As you said - the IP address will end up in the TCP packets in its binary representation, regardless of how it was originally passed to the socket software layer. Firewalls will filter for this binary address and thus catch anything - there is no way around that. However, if the "...


4

So their market is protecting your app from the prying eyes of reverse engineers. Myself, I find that page a little too fluffy, and a little too scant on details. I certainly wouldn't buy their product based solely on the descriptions on that page. Based on the descriptions, it looks like they generate some custom assembly language for each app, then you ...


4

This is a Cross-Site Request Forgery attempt. This Cross-Site Request Forgery attack attempts to exploit your router using the most common default user/pass combos and change your DNS servers to another: var dnsprimario = "103.31.0.140"; var dnssecundario = "8.8.8.8"; document.write('<img src="hxxp://admin:admin@10.1.1.1/dnscfg.cgi?dnsPrimary=' + ...


4

I've come across several attempts at a wallet-sized reference card used as your password ciphertext. One example: http://www.passwordcard.org/en I wouldn't use one of these, but if I did, I'd spend more time on my mental model of how I derived my password, which should provide enough obfuscation that you likely wouldn't be able to acquire the card and the ...


4

Kerckhoffs's_principle obviously applies: A cryptosystem should be secure even if everything about the system, except the key, is public knowledge. This in itself should be enough for you to say "I cannot approve this system without more information." From your examples, it seems that the input is divided into blocks of 8 characters/bytes, each block is ...


4

I picked through the source code. The decode() function is simply a Base64 decoder. Most of its arguments and local variables serve no purpose at all. Likewise, the ratifyvWk() function, which decrypts a string by performing Base64 decoding (using the above function) followed by a Vigenère-style XOR decryption step with the key VtiEH9DlpPnDjlsD. The only ...


4

You are confusing many terms here. Perhaps I can help. Code signing is the process of cryptographically signing a file so that a user of the file can tell who signed the file and whether it has been modified since signing. It generally doesn't make the file unreadable, though, depending on how the signature is attached to the file, you may need a special ...



Only top voted, non community-wiki answers of a minimum length are eligible