Questions tagged [obfuscation]

Obfuscation refers to hiding the intended meaning of communication.

Filter by
Sorted by
Tagged with
86
votes
4answers
8k views

Can I safely preview a short link?

There are a lot of different URL shorteners out there, like Bitly or TinyURL. Besides their main purpose of shortening a link, they also: obfuscate the actual URL collect statistics about the usage ...
0
votes
0answers
21 views

Decode malicious javascript [duplicate]

Probably as most of Facebook users I receive many malicious requests with link and JS. I usually delete or ignore them, but now out of curiosity decided to research it. I've unsuccessfully tied some ...
2
votes
0answers
64 views

What does this potentially malicious php code do? [duplicate]

Somebody hacked my webserver and uploaded many of the following files with random names in different subdirectories of my webroot. The file looks something like this and - even though I managed to ...
32
votes
16answers
13k views

How can I prove to users that my obfuscated code is not malicious without unobfuscating?

I created my own anti-adblock system, that does something similar to services like BlockAdblock except mine goes about Adblocker detection in a different manner (and so far cannot be bypassed like ...
-1
votes
1answer
121 views

What is this obfuscated JS code trying to do? [closed]

I received phishing email that contains base64 encrypted JS code in the attachment. I decrypted it but can't understand it because of obfuscation. Do you guys have any clue what this code is trying to ...
0
votes
1answer
59 views

Why is the -L (list) option of iptables not available to non-root users?

Many tools in Linux allow for checking things as a non-root user. For example, at any time, I can check whether a service is running: $ systemctl status ntp However, the iptables needs to be used as ...
0
votes
1answer
117 views

PHP code in image file

My drupal website was getting hacked recently. While cleaning up the malicious scripts, I found that the hacker uploaded an image file (sites/default/files/test.jpg) contains below code. ...
1
vote
1answer
59 views

Obfuscating android malware [closed]

I am exploring android malware forensics and am trying out payload generation and delivery, while also trying obfuscation. I have used commercial tools, e.g. ProGuard and also open sourced tools, eg. ...
0
votes
2answers
101 views

How to secure containerized python source code deployed at client side cloud

How can we secure a source code which is deployed at client side cloud and is difficult to reverse engineer just like a licensed product The major difference is that I have a service to protect and do ...
2
votes
4answers
431 views

.Net dll encryption

By nature, .NET assemblies are extremely easy to reverse engineer. Say I want to hide some code by embedding an encrypted .dll into another .dll that is to be decrypted and loaded at runtime: compile ...
2
votes
1answer
144 views

Passwords stored as obfuscated text, not encrypted

An application I admin (but did not develop or implement) claims to be storing passwords in a database using “reversible encryption.” I have access to the database table, and was able to work out that ...
0
votes
2answers
91 views

How to Prevent Copying of Device Source Code in Manufacturing

Suppose you are going to mass manufacture custom circuit boards and would like the manufacturer to upload the device firmware onto these boards before shipping them out. What are some security systems/...
0
votes
0answers
16 views

What does this obfuscated PHP script do? [duplicate]

I found an obfuscated PHP-script in a log directory on a shared hosting, which had been given chmod 0777 by mistake. The script in it's original form looks like this: $zowyb = 'i#7uH0_ls5y4m*bcrovaptf-...
1
vote
1answer
118 views

Is it possible for a javascript malware to put keylogger extension in my browser? [duplicate]

I clicked on "It's like you" virus in Facebook Messenger. Then I archived the original link with archive.ph (archive.today), and during the process the site showed me this: https://pastebin....
3
votes
3answers
719 views

Securing client side code of react application [duplicate]

I'm developing application with react and all the main logic is on the client side. I want to force users to use the application only if they paid for the app subscription. Are there any methods to ...
1
vote
1answer
131 views

The hidden meaning of the source code of the malware?

I'm studying the source code of malware developed in c++ and I have two questions in the source code below This is probably code that loads malicious dlls into memory. typedef BOOL (WINAPI *...
2
votes
2answers
463 views

How to decrypt a file to memory and run it from memory?

How someone might run an encoded executable, mp3, or any other file safely in memory after being decrypted. A use case might be someone trying to make code or a file only usable through their service ...
0
votes
1answer
164 views

Mixing VPN Protocols

Is there any benefit to mixing vpn protocols as far as obfuscating your traffic. Would a multiple hop setup like (openvpn(server1) + wireguard(server2)) be better or is (openvpn(server1) + openvpn(...
0
votes
3answers
207 views

Traffic obfuscation under targeted surveillance

When you are under targeted surveillance and all of your internet traffic is tapped (including parts where you exit from a VPN to the internet), is there any point in using traffic obfuscation? It won'...
2
votes
1answer
253 views

Hiding Tor traffic to prevent deanonymization

I am trying to figure out what is the best way to hide Tor traffic in order to improve anonymity. While Tor is pretty good at hiding users’ IP addresses, its traffic stands out. This can be ...
1
vote
0answers
53 views

Would Indistinguishability obfuscation make Javascript cryptography viable?

I know Javascript Cryptography is considered harmful because: Secure delivery of Javascript to browsers is a chicken-egg problem. Browser Javascript is hostile to cryptography. The "view-source&...
0
votes
2answers
1k views

Obfuscating an .exe file

Is there a way to obfuscate an existing .exe file? I'm in a situation where I cannot transfer the winPEAS.exe file (for PrivEsc purposes) on a Win10 machine because of the AV blocking the executable. ...
0
votes
0answers
24 views

Does "Security By Obfuscation" have any place in good security practices? [duplicate]

One thing I've had hammered into me by pretty much every security expert I've talked to is that security by obfuscation is not a substitute for actual security measures. However, it has me wondering; ...
0
votes
0answers
32 views

How to protect IP-sensitive data in files generated and used by users

I'm working on an offline windows application that generates and loads key results as files. However, these files provide key insights into how our product works internally. To make matters worse my ...
0
votes
3answers
248 views

How can I protect me from... myself?

So, here is the deal: I have a file I cannot change. I cannot, but I know in the future I will want to change it. It's of my understanding that it's not possible to make this file unchangeable while ...
1
vote
0answers
180 views

Insecure Binary protection iOS Pentest Report

Thirdparty pentest company reported their findings in our iOS app. In the report explanation for this vulnerability is Apple provides default encryption for applications; however, the encryption ...
0
votes
1answer
74 views

Who (Designer or User) Should be Resposible for the Correct/Secure Usage of a Tool Intended for Developers/Admins? [closed]

There is a healthy debate around a series of stack overflow posts that refer to the "RunAs" command. Specifically the discussion is in reference to design decision that the folks at ...
102
votes
4answers
15k views

Why is this 435 × 652 pixel JPEG over 6 MB?

This was, before someone helpfully fixed it after seeing this question, a relatively unassuming and tiny photo of a ̶f̶i̶s̶h̶ nudibranch, with 283,620 pixels. It has some metadata: text Exif tags as ...
-1
votes
1answer
378 views

obfuscating a Cython source code [closed]

After some research on how I can protect my python source code on similar topics here and other sites, most agree that I should convert my .py file to .pyd using Cython, but the problem is in the ...
0
votes
1answer
187 views

I obfuscated my commercial software, i lost source [closed]

I obfuscated my web software with srcProtector and I archived files, I uploaded a new version of the software on the website. The problem is I forgot to copy files in a new path for backup. VERY VERY ...
0
votes
1answer
75 views

Is using SecureString in combination with Xor considered secure enough for standalone Windows app?

The environment is Windows. We are using 3rd party tools in our app, and for tools to work they require method call and pass a license key that is a string. License.Import(string name, string email, ...
0
votes
1answer
135 views

Can someone decode this for me?

I decoded some of the original traffic from hex and got the below output. I'm not sure how to decode it further. Any help? Thanks. T=2020-04-10+13:27:30.758+PST&L=i&M=[g2tray]&N=22&X=...
-2
votes
1answer
96 views

Banking App With Sensitive Info In Plain Text

I have a car loan and wanted to make a payment through their website. To enroll for online payments, it asks for the last 4 numbers of my social security number, birth date and account number, but ...
1
vote
1answer
308 views

Help with decoding this? Base64 attack [closed]

I'm trying to decode this attack. I know it's attempting to send some kind of malicious command to the web server but I can't figure out how to decode it. It's like encoded more than once or something....
0
votes
0answers
182 views

Packaging Python code for github: should I obfuscate author email address from the `setup.py`?

The standard file with packaging instructions (setup.py with setuptools) for Python contains an author_email field. Such a package can then be published to PyPI, but the code is also available ...
0
votes
0answers
80 views

Securely unpack malware

I'm trying to find a way to securely unpack Windows Malware packed with UPX, I need to unpack a lot for analysis so automating the process as much as possible is beneficial. I've found a few methods ...
0
votes
1answer
112 views

Should I complie software after making all the variable and function names "1-2 character"? [duplicate]

In JavaScript, it seems common for the official release of the code to use only single-character variable and function names (of course, after converting the original code which uses clearer names) in ...
1
vote
1answer
5k views

How can I obfuscate a 64-bit executable Windows file? [closed]

Hyperion works OK when scrambling/obfuscating win32 files, but I am trying a program that seems to be a Win64 executable, and it fails: C:\Hyperion>hyperion.exe -v mimikatz.exe output.exe -------...
78
votes
5answers
14k views

Does code obfuscation give any measurable security benefit?

I've always firmly held the belief that obfuscation is essentially useless. Obfuscated code is not impossible to read, only harder to read. I had the belief that a sufficiently skilled attacker would ...
0
votes
0answers
61 views

What are good examples of "Dynamic opaque predicates"?

I am studying the concept of software obfuscation and come across this interesting scheme, dynamic opaque predicate: Basically it either goes two false branches, or two true branches, and ...
0
votes
1answer
605 views

How can Runtime-Crypters stay FUD

A Runtime Crypter always works with the same principle: It decrypts its payload, starts up a process in suspended state, inserts the payload and resumes the suspended process under false flag. All ...
0
votes
3answers
837 views

Prevent finding key in C++ application binary

I need to store a key (symmetric-key cryptography) within my C++ application binary (based on OpenCV) so that the key as unidentifiable as possible. Can someone help me choose the key so that is ...
2
votes
1answer
127 views

Obfuscating "sensitive" strings in mobile client

We have a client that runs some native (C++) code on both Android and iOS, to mitigate MITM attacks we use certificate pinning. This means that the binary includes some strings (const char * const ...
0
votes
3answers
168 views

Are there types of malware that are so time-intensive to detect that AV vendors simply choose to not detect them? [closed]

I've been reading a lot about how AVs use different heuristic methods to detect obfuscated malware and it seems like some of these methods are very time/processor intensive. For example, to detect ...
-4
votes
3answers
147 views

Is code obfuscation common in FOSS?

I am a learner of FOSS licensing, security and privacy. I ask this question because one of the arguments persuading users to use or switch to FOSS is the fact that since the code is open, an expert ...
0
votes
1answer
343 views

Is security by obscurity / obfuscation a valid option, or do the crawlers have JavaScript enabled?

I'm creating a new website, so I am thinking about how to protect my email address and phone number against crawlers, I actually mean email harvesters (most of which I suppose don't have JavaScript ...
0
votes
1answer
179 views

What does the attached php malware do? [duplicate]

Found this on a WordPress server under the filename wp-includes/class-wp-image-editor-fd.php when WordFence picked it up as being an unexpected file. Link to source is here: https://pastebin.com/...
1
vote
1answer
203 views

Filtering Obfuscated Spam Emails In Exchange

So the past few weeks we have been trying to cut back on the amount of spam reaching our users in our organization. We have been successful in implementing hard filtering rules like if an email ...
1
vote
1answer
190 views

What notable examples of metamorphic engines are there? [closed]

I am doing a research project on metamorphic malware and would like to have access to a metamorphic engine I could demo. Are there any good open-source (or easily obtainable) metamorphic engines I ...
0
votes
3answers
294 views

What string encoding options are there besides xor? [closed]

When attempting to obfuscate strings in a modern program, xor is probably the most common option. By this I mean running each char of a string through a function which xors the char with some given ...