Questions tagged [obfuscation]

Obfuscation refers to hiding the intended meaning of communication.

Filter by
Sorted by
Tagged with
0
votes
0answers
62 views

Prevent hostname and OS logging on local wireless networks

I see that hostname is indeed logged on routers with access time and IPs accessed, if available (ie. untunneled). According to one website, the OS is also resolved. This mocks many widespread ...
1
vote
0answers
79 views

Insecure Binary protection iOS Pentest Report

Thirdparty pentest company reported their findings in our iOS app. In the report explanation for this vulnerability is Apple provides default encryption for applications; however, the encryption ...
0
votes
1answer
61 views

Who (Designer or User) Should be Resposible for the Correct/Secure Usage of a Tool Intended for Developers/Admins? [closed]

There is a healthy debate around a series of stack overflow posts that refer to the "RunAs" command. Specifically the discussion is in reference to design decision that the folks at ...
0
votes
0answers
25 views

How do I go about decoding this malicious PHP script? [duplicate]

I came upon this script just by luck, actually. Ironically, it's stored in a protected folder on my website and I don't think <? $catches ='r'; $comforter ='$r)ciEVi'; $heroin = 'SgD'; $...
100
votes
4answers
14k views

Why is this 435 × 652 pixel JPEG over 6 MB?

This was, before someone helpfully fixed it after seeing this question, a relatively unassuming and tiny photo of a ̶f̶i̶s̶h̶ nudibranch, with 283,620 pixels. It has some metadata: text Exif tags as ...
-1
votes
1answer
83 views

obfuscating a Cython source code [closed]

After some research on how I can protect my python source code on similar topics here and other sites, most agree that I should convert my .py file to .pyd using Cython, but the problem is in the ...
0
votes
1answer
129 views

I obfuscated my commercial software, i lost source [closed]

A VERY bad problem. I obfuscated my web software with srcProtector and i archieved files, i uploaded a new version of software on the website. The problem is i forgot to copy files in a new path for ...
0
votes
1answer
42 views

Is using SecureString in combination with Xor considered secure enough for standalone Windows app?

The environment is Windows. We are using 3rd party tools in our app, and for tools to work they require method call and pass a license key that is a string. License.Import(string name, string email, ...
0
votes
1answer
104 views

Can someone decode this for me?

I decoded some of the original traffic from hex and got the below output. I'm not sure how to decode it further. Any help? Thanks. T=2020-04-10+13:27:30.758+PST&L=i&M=[g2tray]&N=22&X=...
0
votes
0answers
20 views

How to deobfuscate malicious PHP code [duplicate]

This is my first malware analyis, so apologies for my probably noob-like question. I'm having a look at a website running an outdated version of Wordpress which was hacked. The Website runs on a ...
-2
votes
1answer
91 views

Banking App With Sensitive Info In Plain Text

I have a car loan and wanted to make a payment through their website. To enroll for online payments, it asks for the last 4 numbers of my social security number, birth date and account number, but ...
1
vote
1answer
158 views

Help with decoding this? Base64 attack [closed]

I'm trying to decode this attack. I know it's attempting to send some kind of malicious command to the web server but I can't figure out how to decode it. It's like encoded more than once or something....
0
votes
0answers
85 views

Packaging Python code for github: should I obfuscate author email address from the `setup.py`?

The standard file with packaging instructions (setup.py with setuptools) for Python contains an author_email field. Such a package can then be published to PyPI, but the code is also available ...
0
votes
0answers
58 views

Securely unpack malware

I'm trying to find a way to securely unpack Windows Malware packed with UPX, I need to unpack a lot for analysis so automating the process as much as possible is beneficial. I've found a few methods ...
0
votes
1answer
110 views

Should I complie software after making all the variable and function names “1-2 character”? [duplicate]

In JavaScript, it seems common for the official release of the code to use only single-character variable and function names (of course, after converting the original code which uses clearer names) in ...
1
vote
1answer
2k views

How can I obfuscate a 64-bit executable Windows file? [closed]

Hyperion works OK when scrambling/obfuscating win32 files, but I am trying a program that seems to be a Win64 executable, and it fails: C:\Hyperion>hyperion.exe -v mimikatz.exe output.exe -------...
77
votes
5answers
13k views

Does code obfuscation give any measurable security benefit?

I've always firmly held the belief that obfuscation is essentially useless. Obfuscated code is not impossible to read, only harder to read. I had the belief that a sufficiently skilled attacker would ...
0
votes
0answers
39 views

What are good examples of “Dynamic opaque predicates”?

I am studying the concept of software obfuscation and come across this interesting scheme, dynamic opaque predicate: Basically it either goes two false branches, or two true branches, and ...
0
votes
1answer
316 views

How can Runtime-Crypters stay FUD

A Runtime Crypter always works with the same principle: It decrypts its payload, starts up a process in suspended state, inserts the payload and resumes the suspended process under false flag. All ...
0
votes
3answers
369 views

Prevent finding key in C++ application binary

I need to store a key (symmetric-key cryptography) within my C++ application binary (based on OpenCV) so that the key as unidentifiable as possible. Can someone help me choose the key so that is ...
2
votes
1answer
103 views

Obfuscating “sensitive” strings in mobile client

We have a client that runs some native (C++) code on both Android and iOS, to mitigate MITM attacks we use certificate pinning. This means that the binary includes some strings (const char * const ...
0
votes
3answers
164 views

Are there types of malware that are so time-intensive to detect that AV vendors simply choose to not detect them? [closed]

I've been reading a lot about how AVs use different heuristic methods to detect obfuscated malware and it seems like some of these methods are very time/processor intensive. For example, to detect ...
-4
votes
3answers
139 views

Is code obfuscation common in FOSS?

I am a learner of FOSS licensing, security and privacy. I ask this question because one of the arguments persuading users to use or switch to FOSS is the fact that since the code is open, an expert ...
0
votes
1answer
296 views

Is security by obscurity / obfuscation a valid option, or do the crawlers have JavaScript enabled?

I'm creating a new website, so I am thinking about how to protect my email address and phone number against crawlers, I actually mean email harvesters (most of which I suppose don't have JavaScript ...
0
votes
1answer
124 views

What does the attached php malware do? [duplicate]

Found this on a WordPress server under the filename wp-includes/class-wp-image-editor-fd.php when WordFence picked it up as being an unexpected file. Link to source is here: https://pastebin.com/...
0
votes
1answer
123 views

Filtering Obfuscated Spam Emails In Exchange

So the past few weeks we have been trying to cut back on the amount of spam reaching our users in our organization. We have been successful in implementing hard filtering rules like if an email ...
1
vote
1answer
150 views

What notable examples of metamorphic engines are there? [closed]

I am doing a research project on metamorphic malware and would like to have access to a metamorphic engine I could demo. Are there any good open-source (or easily obtainable) metamorphic engines I ...
0
votes
3answers
206 views

What string encoding options are there besides xor? [closed]

When attempting to obfuscate strings in a modern program, xor is probably the most common option. By this I mean running each char of a string through a function which xors the char with some given ...
2
votes
2answers
103 views

Could always-listening mobile apps secretly spy on conversations?

Various apps and services available on modern smartphones constantly listen with the mic (e.g. Siri or Google Assistant listening for wake word, "Now Playing" feature on Pixel phones). To settle user ...
-1
votes
2answers
275 views

Why are there no GPU Obfuscators? [closed]

Rationale: I need to figure out ways to protect Intellectual Property contained in NVIDIA CUDA/GPU code. That said, I'm surprised that there are literally zero GPU code obfuscators. On stack ...
0
votes
1answer
656 views

Key Encryption / Obfuscation

I got a GUI Program, which loads the Logic from a webserver if the entered License Key is valid. The actual connection string I hexed and xor'd with a secret key. (which is unfortunately static) The ...
1
vote
1answer
64 views

How can I make sure that my Python code cannot be accessed by the user of my web app?

I have a Python Program whose code I would like to protect. For sake of example, let's say I coded a novel function called "add" which does the following: def add(n1, n2): return n1 + n2 I'd ...
0
votes
1answer
328 views

Is this strange PHP file that I found on my server malicious? [duplicate]

I found a PHP file that I don't know where it came from on my server: <?php $ojcsoo = '_-bHft\'dik1x6cn9leapm0y4s7vg5*r8ou#2';$zjdtjcd = Array();$zjdtjcd[] = $ojcsoo[3].$ojcsoo[29];$zjdtjcd[] = $...
3
votes
1answer
394 views

C++ binary obfuscation: how to get around license checks being a simple if/then branches?

I'm looking into binary obfuscation for an exectuable binary written in C++. I realize preventing cracks is impossible, but making it slightly harder would be nice. No matter how complex the actual ...
0
votes
1answer
167 views

Are auto-type features of password managers actually effective against keyloggers?

Of course if you think of a "keylogger" as a program that can only read keystrokes, then copy-pasting on the clipboard is going to be enough. But we know that keyloggers are not really only "logging ...
2
votes
0answers
369 views

How to obfuscate C++ code with movfuscator?

I want to obfuscate a C++ application using movfuscator, but movfuscator currently uses C as the source language and not C++. I tried to do the followings (as they recommended, but with no success): ...
5
votes
4answers
1k views

Does appending randomness to a token before encrypting it, make it more secure?

Scenario: User requests page on my site Server builds up token using various values, encrypts it (via an industry-standard algorithm, nothing homegrown) using a key only the server knows, and returns ...
1
vote
2answers
332 views

How to obfuscate a assemblies binary compiled with .NET framework?

How to obfuscate a binary compile with .NET framework? Tools such as Ebowla and Pecloak.py will encrypt it but the program won't run. Even UPX can't pack it. Wondering are there any ways to obfuscate ...
-1
votes
1answer
812 views

Obfuscated PHP code found on Wordpress site - has it been compromised? [duplicate]

Firstly - I expect the answer to be yes. But I never dealt with something like this so I would like some advice. A client has recently complained that their website went down. So I started ...
2
votes
1answer
615 views

How to obfuscate SSH tunnel Mac?

I am looking to test a DPI (deep packet inspector). I currently have it set up to block SSH connections (which it does successfully). I have learned that DPI can be bypassed by obfuscating/encrypting ...
1
vote
2answers
779 views

How to make a well-known malicious programs undetectable by anti-virus solutions? [closed]

I want to make well-known malicious programs, like Mimikatz and Incognito, undetectable by anti-virus solutions. I have already tried various approaches myself, like packing the binary with UPX or ...
0
votes
2answers
985 views

Extract URL from obfuscate javascript

I have an obfuscated script. I was asked to de-obfuscate the code and extract the URL from the script. However, I used multiple de-obfuscation tools such as https://www.javascriptdeobfuscator.com/ ...
1
vote
1answer
449 views

Extract urls from obfuscated android malware

Working on android malwares, i have faced many android malwares that typically contain urls which are bank phishing page. This type of malwares are growing in number so an automated detection system ...
4
votes
1answer
1k views

Trying to understand what this PHP malware does [closed]

My server has been hacked recently and the hacker has uploaded multiple malicious source code to the web server. I have already de-obfuscate the code, but I still don't understand what it does. It ...
0
votes
0answers
34 views

Security of password to database in 2-layer SW model

I'm struggling with kinda old application which is written for Windows and has a 2-layer approach, meaning that the client SW is connecting to backend database directly. This of course mean that the ...
1
vote
1answer
860 views

Android anti-tampering and SSL pinning bypass solid implementation [duplicate]

Is there any advance solution for Android application anti-tampering and bulletproof obfuscation implementation? I have been already using following protections in my application: Obsufcation using ...
-2
votes
1answer
89 views

Visual Studio anonymity

Recently me and me colleague was wondering about obfuscating / removing project info. If application is reverse engineered than what kind of information the engineer sees? Can he see the email of the ...
0
votes
1answer
940 views

Modify Win OS banner to avoid OS detection

I would like to modify Win OS banner to defeat OS detection from scanning tools like Nmap for example. Although, I know that Nmap does not take into account just the banner to do OS detection.
2
votes
1answer
319 views

Phishing email with encoded url params

I received a phishing email with the following format: hxxp://<%legitimateSite%>/~!@%23$%25%5e&()_+~!@%23$%25%5e&()+~!@%23$%25%5e&*()+~!@%23$%25%5e&()_+~!@%23$%25%5e&()+~!@%...
9
votes
1answer
600 views

How to Change a Culture of “Security Through Obscurity”

I have worked for a number of organizations in the past that utilize practices that are justified by what I would describe as "Security through Obscurity" including the following: Weak/Vulnerable two ...