Tag Info

Hot answers tagged

35

What is being described is a protection against some classes of known-plaintext attack. Up until the 1960s or so, most ciphers were vulnerable to these (eg. many of the attacks on the Enigma cipher were based on knowing or guessing part of the plaintext). Modern ciphers are effectively immune to this: knowing that the AES-encrypted message is "Attack at ...


25

The last line performs an eval() of function v78ZFAX() given the two parameters like so: eval(v78ZFAX($vFHLJ89, $vIIJ30Y)); That first parameter is the part that takes up the bulk of the code. It is assigned all that random-looking garbage, with . concatenating all those strings together into one long string: $vFHLJ89 = ...


22

If I search Google for "parlaimnet biuldnig", I see: Showing results for parliament building Search instead for parlaimnet biuldnig So no, such mis-spells are not sufficient to fool automated systems or to act as a CAPTCHA. However, searching for "the bobm" Google doesn't offer me a correction, so the technique is not necessarily completely useless. ...


21

The Code Golf is essentially to create an unkeyed 1:1 function to transform images. As such, it's highly vulnerable to chosen-plaintext attacks: if an attacker can convince Alice or Bob to transmit a carefully-crafted image, they can build up a map of what pixels get moved to where for that image size. Further, if the images being transmitted have ...


19

I would imagine the context of that statement was in the context of a cypher where a word repeated in multiple places produces the same cypher text in each location. If I see: AER TEO ZRE SGR. AER FSD ZFD DFG. YTR ASD AER DSG. Language analysis would reveal that "AER" is likely "The", and from there if you intercept sufficient number of encrypted ...


13

Basically this is a transposition cipher. What you would do is looking for pattern and rearrange like with this text example: http://www.richkni.co.uk/php/crypta/trans0.php Your example with grey scale text would be easier as the picture on code golf because you could see very easy what is a correct solution.


9

To show you it is easy to de-obfuscate your code, and therefore kind of useless to obfuscate it in the first place, I will present you how I did to de-obfuscate it in a quick and dirty fashion: I took your code, and replaced the first "eval" by "console.log". This gave me another (smaller) code starting with "eval". So I repeated this process 9 times, as ...


6

Type your example into a search engine of your choice. At least Google has no problem in correcting the relevant words, Bing even corrects them all. Input: the bobm is hdiden isnide teh parlaimnet biuldnig Google: the bomb is hidden isnide teh parliament building Bing: the bomb is hidden inside the parliament building Computers have become ...


4

The attacker could Man-In-The-Middle attack their own iPhone by creating a custom CA. SSL/TLS prevents third parties they don't trust from listening in. The attacker has no reason to distrust themselves and their iPhone allows them to make it trust whatever they want. The format won't be safe, and shouldn't be (be, not contain) sensitive information.


4

I think your 'testing' is redundant. Obfuscation is not encryption and it is completely possible to de-obfuscate even if it takes manual investigation and a lot of patience. There are many tools out there to assist and there is no logical reason why this example can't be reduced to a simpler chunk of code relatively quickly. Anyone's effort to decode this ...


4

You've answered the question yourself. You're trying to implement DRM to prevent users from getting the video off the device. In practice there is little you can do to prevent this. There will always be ways to copy the stream, even intercepting the stream (it has to be displayed on the device at some point right?). So the only thing you can do is make it ...


3

The commenter, paj28, is correct: don't submit these to VirusTotal. Test them against the HIPS and AV systems you are specifically targeting in a VM-guest environment. I prefer using Vagrant along with the Packer and Boxcutter tools to "mock up" things in a lab. Hyperion is great, but don't combine it with Pescrambler necessarily. You only need one cryptor, ...


3

The attacker can perform a man-in-the-middle attack on him self. Basic steps are: Setup a proxy like SSLsplit or Charles Proxy on a computer. Install a custom SSL root certificate on the device (iPhone). Add the proxy in the device settings. Now the device will route all traffic over the proxy. Normally you could not decrypt this traffic but the proxy ...


3

When you don't want the user to have access to your code, you must not let them run it on their machine. It's that simple. As you already found out yourself, obfuscation doesn't work. So what option do you have? Run it on your own servers and offer it to the customer as a service, for example via SOAP. The drawbacks are that you need to administrate ...


2

I recommend you to keep it simple. You could simply AES the fields you need to protect. Independently of the encryption method you use you must encrypt together some fields: Name + Surname Date of birth State + Street number + Street name *... Otherwise you could try statistical analysis against the data.


2

I understand your issues, but one of the fundamental maxims of cryptography is that you shouldn't reinvent the wheel and create your own encryption algorithm, primarily because it will be nowhere near as secure as an established one. Is this data going to be accessible over the Internet or transmitted over unencrypted channels? If the answer to either of ...


2

Just adding a simpler explanation of Functional Encryption Fully Homomorphic Encryption before proceeding to Functional Encryption and Indistinguishability Obfuscation as it is easier to explain that way. Taken mainly from http://crypto.stanford.edu/craig/easy-fhe.pdf The above is a paper by Craig Gentry (one of the pioneers in this field), and he gives a ...


2

Note, there is no legitimate reason to hide the algorithm used if you use a suitably strong passphrase/key. If you are really concerned, you could open the encrypted file in a hex editor and change the fourth byte of the symmetrically encrypted ASCII armored file. E.g., the first four bytes of an symmetric encrypted file are: 8C 0D 04 09 with the ...


2

It looks like the passphrase which was used to encrypt the message with is encrypted with AES256. The algorithm used to encrypt the message is self is not known until the encrypted session key packet is decrypted. This is what pgpdump shows: Old: Symmetric-Key Encrypted Session Key Packet(tag 3)(13 bytes) New version(4) Sym alg - AES with 256-bit key(sym ...


2

Actually, Google is making it far more difficult for anyone to merely download a video because Google is parsing out the entire video and serving you only portions at a time. Thus your ideal single 'request URL' (AKA a GET request) is actually multiple GET requests. Because of this parsing, it becomes difficult to create a script/program that consistently ...


2

Google has the Widevine DRM mechanism (Video DRM solution). A tool that can play with the Widevine internals (libwvcdm) can be found here -- https://github.com/EiNSTeiN-/chromecast-widevine-tools There is also the Stagefright multimedia framework to supply DRM -- https://source.android.com/devices/media.html -- Josh Drake is doing a prezo on it at BlackHat ...


1

geek_ji, You don't have many options to solve this really. 1. If you remove offline playback, then you can just use HLS with encryption, with the stream hosted in the server. 2. Allowing offline playback, as you said, will need to somehow encrypt/decrypt the video. You could always leave the public key (encryption key) stored locally for encryption, but ...


1

That's a remote command shell for a server that's probably been hacked, and you should consider the server compromised. You would be wise to suspend everything it hosts, audit all code on the machine and rebuild it / replace it. Remote users who probably control this script can force it to issue any command by posting "CODE" that's base64_encoded (that sent ...


1

Obfuscation is a technique used to, obfuscate, or make less obvious, something. From a security perspective, obfuscation can make it more difficult or time consuming for a human attacker to understand whatever it is they are looking at. (It could also be a method of security through obscurity, by hiding things, as an example.) Most of the time people view ...


1

OpenPGP is defined in RFC 4880, which probably is the specification you're looking for. OpenPGP files (no matter whether binary or ASCII-armored) are composed of individual packets, each having a header (that is probably what you have been observing regarding the "IQ"). In an OpenPGP secret key packet, quite a lot of meta data is stored. As it also contains ...


1

With Snort you can compile your rules as "shared objects" that use C instead of the Snort language and can be obfuscated. See #2 here: http://blog.snort.org/2011/02/snort-shared-object-rules.html


1

The short answer is yes, there are a variety of ways to achieve this, if I'm understanding your question correctly. A basic example would be that a user could set-up Team viewer on their home PC, then connect to it from anywhere in the world. they could then use VNC into the office over the Team Viewer connection and appear (from an IP address perspective) ...



Only top voted, non community-wiki answers of a minimum length are eligible