2

I see a common method of encoding in PHP malware where there's some bytes of key, which gets used to decode that many bytes of encoded text. Decoded bytes get appended to the key on the fly. The decoding is subtracting the key byte from the encoded byte, modulo 256. It seems like this method of encoding would be prone to a known-text attack, since the cleartext ends up used in the encoding key.

What is this method of encoding called? I have absolutely failed to google up anything other than more examples of the algorithm in PHP. The method seems similar to Running Key Ciphers, but it recycles the cleartext. It seems like what I've called cleartext is often compressed (gzip, gzdeflate, etc) so that the "cleartext" is close to random bytes.

When I've seen it, the variables in the decoding function are obfuscated into $l__l_ or $g___g__, or variants with more or less underscores.

Here's an example of PHP malware that uses this encoding, if that helps.

The two variants of the algorithm I can readily find look like this:

$key = ...
$cleartext = ...
$i = 0;
do {
    $cipherbyte = $ciphertext[$i];
    $keybyte = $key[$i];
    $value = (ord($cipherbyte) - ord($keybyte))%256;
    $clearbyte = chr($value);
    $cleartext[$i] = $clearbyte;
    $key .= $clearbyte;
    $i++;
} while ($i < strlen($ciphertext));

A more compact form shows up sometimes:

$key = ...
$cleartext = "";
for($i=0; $i<strlen($ciphertext); $i++) {
    $cleartext[$i] = chr((ord($cleartext[$i])-ord($key[$i]))%256);
    $key .= $cleartext[$i];
}

I believe that for the encoding function (which I've never seen), the key would get composed like this:

$key = $seed . $cleartext;

So the length of the key is always more bytes than the cleartext.

What's this method of encoding called?

  • Looks a lot like RC4 or ARCFOUR, but I'm not entirely sure. – Ron Beyer Jan 23 at 16:13
  • @RonBeyer I don't see it. Tipoffs for RC4 are a 256-byte table, two indexes, a swap operation, and double indirection (S[S[i] + S[j]]). I don't see any of those here. – duskwuff Jan 23 at 21:12
1

This is an autokey cipher. Even if the key is not available in the source code, it's still quite vulnerable to a known-plaintext attack. (Compressing the output is minimally helpful; most compression formats have a standard header which can be used as a known plaintext.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.