Tag Info

Hot answers tagged

35

What is being described is a protection against some classes of known-plaintext attack. Up until the 1960s or so, most ciphers were vulnerable to these (eg. many of the attacks on the Enigma cipher were based on knowing or guessing part of the plaintext). Modern ciphers are effectively immune to this: knowing that the AES-encrypted message is "Attack at ...


27

The last line performs an eval() of function v78ZFAX() given the two parameters like so: eval(v78ZFAX($vFHLJ89, $vIIJ30Y)); That first parameter is the part that takes up the bulk of the code. It is assigned all that random-looking garbage, with . concatenating all those strings together into one long string: $vFHLJ89 = ...


22

If I search Google for "parlaimnet biuldnig", I see: Showing results for parliament building Search instead for parlaimnet biuldnig So no, such mis-spells are not sufficient to fool automated systems or to act as a CAPTCHA. However, searching for "the bobm" Google doesn't offer me a correction, so the technique is not necessarily completely useless. ...


19

I would imagine the context of that statement was in the context of a cypher where a word repeated in multiple places produces the same cypher text in each location. If I see: AER TEO ZRE SGR. AER FSD ZFD DFG. YTR ASD AER DSG. Language analysis would reveal that "AER" is likely "The", and from there if you intercept sufficient number of encrypted ...


10

You're lucky: it's Windows-specific. First, I took the code, and went to jsbeautifier.org to beautify it: var stroke = "5556515E070B0A1005071024120D171005011C140116100D17014A0A0110"; function do193() { return ',"h'; }; function do112() { return ') { '; }; function do127() { return 'r xa'; }; function do88() { return '= 0;'; }; function ...


9

To show you it is easy to de-obfuscate your code, and therefore kind of useless to obfuscate it in the first place, I will present you how I did to de-obfuscate it in a quick and dirty fashion: I took your code, and replaced the first "eval" by "console.log". This gave me another (smaller) code starting with "eval". So I repeated this process 9 times, as ...


6

Type your example into a search engine of your choice. At least Google has no problem in correcting the relevant words, Bing even corrects them all. Input: the bobm is hdiden isnide teh parlaimnet biuldnig Google: the bomb is hidden isnide teh parliament building Bing: the bomb is hidden inside the parliament building Computers have become ...


5

I think your 'testing' is redundant. Obfuscation is not encryption and it is completely possible to de-obfuscate even if it takes manual investigation and a lot of patience. There are many tools out there to assist and there is no logical reason why this example can't be reduced to a simpler chunk of code relatively quickly. Anyone's effort to decode this ...


4

The attacker could Man-In-The-Middle attack their own iPhone by creating a custom CA. SSL/TLS prevents third parties they don't trust from listening in. The attacker has no reason to distrust themselves and their iPhone allows them to make it trust whatever they want. The format won't be safe, and shouldn't be (be, not contain) sensitive information.


4

You've answered the question yourself. You're trying to implement DRM to prevent users from getting the video off the device. In practice there is little you can do to prevent this. There will always be ways to copy the stream, even intercepting the stream (it has to be displayed on the device at some point right?). So the only thing you can do is make it ...


3

The commenter, paj28, is correct: don't submit these to VirusTotal. Test them against the HIPS and AV systems you are specifically targeting in a VM-guest environment. I prefer using Vagrant along with the Packer and Boxcutter tools to "mock up" things in a lab. Hyperion is great, but don't combine it with Pescrambler necessarily. You only need one cryptor, ...


3

When you don't want the user to have access to your code, you must not let them run it on their machine. It's that simple. As you already found out yourself, obfuscation doesn't work. So what option do you have? Run it on your own servers and offer it to the customer as a service, for example via SOAP. The drawbacks are that you need to administrate ...


3

The attacker can perform a man-in-the-middle attack on him self. Basic steps are: Setup a proxy like SSLsplit or Charles Proxy on a computer. Install a custom SSL root certificate on the device (iPhone). Add the proxy in the device settings. Now the device will route all traffic over the proxy. Normally you could not decrypt this traffic but the proxy ...


2

Actually, Google is making it far more difficult for anyone to merely download a video because Google is parsing out the entire video and serving you only portions at a time. Thus your ideal single 'request URL' (AKA a GET request) is actually multiple GET requests. Because of this parsing, it becomes difficult to create a script/program that consistently ...


2

Just adding a simpler explanation of Functional Encryption Fully Homomorphic Encryption before proceeding to Functional Encryption and Indistinguishability Obfuscation as it is easier to explain that way. Taken mainly from http://crypto.stanford.edu/craig/easy-fhe.pdf The above is a paper by Craig Gentry (one of the pioneers in this field), and he gives a ...


2

Note, there is no legitimate reason to hide the algorithm used if you use a suitably strong passphrase/key. If you are really concerned, you could open the encrypted file in a hex editor and change the fourth byte of the symmetrically encrypted ASCII armored file. E.g., the first four bytes of an symmetric encrypted file are: 8C 0D 04 09 with the ...


2

It looks like the passphrase which was used to encrypt the message with is encrypted with AES256. The algorithm used to encrypt the message is self is not known until the encrypted session key packet is decrypted. This is what pgpdump shows: Old: Symmetric-Key Encrypted Session Key Packet(tag 3)(13 bytes) New version(4) Sym alg - AES with 256-bit key(sym ...


2

Obfuscating in Javascript is usually done by generating the code dynamically. While you find older examples which make extensive use of chr(..) or base64 or lots of string concatenations detection heuristics improved to flag this kind of code as potentially malicious so that the attacked improved their methods. Typical current examples like this are not ...


2

Google has the Widevine DRM mechanism (Video DRM solution). A tool that can play with the Widevine internals (libwvcdm) can be found here -- https://github.com/EiNSTeiN-/chromecast-widevine-tools There is also the Stagefright multimedia framework to supply DRM -- https://source.android.com/devices/media.html -- Josh Drake is doing a prezo on it at BlackHat ...


1

That's a remote command shell for a server that's probably been hacked, and you should consider the server compromised. You would be wise to suspend everything it hosts, audit all code on the machine and rebuild it / replace it. Remote users who probably control this script can force it to issue any command by posting "CODE" that's base64_encoded (that sent ...


1

geek_ji, You don't have many options to solve this really. 1. If you remove offline playback, then you can just use HLS with encryption, with the stream hosted in the server. 2. Allowing offline playback, as you said, will need to somehow encrypt/decrypt the video. You could always leave the public key (encryption key) stored locally for encryption, but ...


1

Obfuscation is a technique used to, obfuscate, or make less obvious, something. From a security perspective, obfuscation can make it more difficult or time consuming for a human attacker to understand whatever it is they are looking at. (It could also be a method of security through obscurity, by hiding things, as an example.) Most of the time people view ...


1

OpenPGP is defined in RFC 4880, which probably is the specification you're looking for. OpenPGP files (no matter whether binary or ASCII-armored) are composed of individual packets, each having a header (that is probably what you have been observing regarding the "IQ"). In an OpenPGP secret key packet, quite a lot of meta data is stored. As it also contains ...


1

With Snort you can compile your rules as "shared objects" that use C instead of the Snort language and can be obfuscated. See #2 here: http://blog.snort.org/2011/02/snort-shared-object-rules.html


1

The short answer is yes, there are a variety of ways to achieve this, if I'm understanding your question correctly. A basic example would be that a user could set-up Team viewer on their home PC, then connect to it from anywhere in the world. they could then use VNC into the office over the Team Viewer connection and appear (from an IP address perspective) ...



Only top voted, non community-wiki answers of a minimum length are eligible