Questions tagged [obfuscation]
Obfuscation refers to hiding the intended meaning of communication.
179
questions
0
votes
0
answers
24
views
Found several potentially malicious PHP files but not sure what they are doing? [duplicate]
A friend found several suspicious PHP files on his server when we was upgrading his Wordpress install. They are all in the public_html folder and the filenames are the name of his domain with ...
- 101
2
votes
4
answers
431
views
Code obfuscation and source code repositories
As I understand, code obfuscation is used to make reverse engineering difficult/hard for the adversaries/red team.
Now if I use a source code obfuscator where a .C/.CPP file is used as input and an ...
0
votes
0
answers
49
views
Obfuscation of scripts
For an embedded IoT product running linux, digital signature validation of new firmware package is performed by a startup script file. For maintenance and troubleshooting purposes, the product does ...
0
votes
0
answers
1k
views
Best port to setup Outline VPN for obfuscation
Many outline access keys use a random port but some do 443, I’ve found out since port 443 is for http its harder to find out that port is using a vpn.
So the question is, why don’t other Outline ...
- 11
-1
votes
3
answers
104
views
Who can we read the contents of the variable? Which format is used? [closed]
We are not IT security specialists but we are very curious to know more about a scam we received through mail.
We received a mail with a HTML file attached. The subject of the mail looked very ...
- 3
0
votes
2
answers
130
views
DomainFronting - re-routing and SSL certificats
I'm looking for a specific answer regarding the TLS handshake in a scenario of domain-fronting.
Following hensonsecurity and zscaler blogs I have noticed that a detailed description regarding the re-...
0
votes
1
answer
769
views
UUIDs replacing inremental IDs in URLs
I am reading about implementing UUIDs in URLs instead of incremental IDs to reduce attack vectors using obfuscation. I plan to create a UUID from an incremental ID and store the UUID which would be ...
- 133
0
votes
2
answers
116
views
Is it possible to eavesdrop HTTPS encryptions by file size?
I see that HTTPS uses symmetric encryption for the file transfer, often AES. I also read that AES uses padding to help obfuscate the data itself. Though I am curious how powerful that padding is when ...
- 101
102
votes
5
answers
13k
views
Can I safely preview a short link?
There are a lot of different URL shorteners out there, like Bitly or TinyURL. Besides their main purpose of shortening a link, they also:
obfuscate the actual URL
collect statistics about the usage ...
- 1,653
2
votes
0
answers
66
views
What does this potentially malicious php code do? [duplicate]
Somebody hacked my webserver and uploaded many of the following files with random names in different subdirectories of my webroot. The file looks something like this and - even though I managed to ...
- 121
31
votes
16
answers
14k
views
How can I prove to users that my obfuscated code is not malicious without unobfuscating?
I created my own anti-adblock system, that does something similar to services like BlockAdblock except mine goes about Adblocker detection in a different manner (and so far cannot be bypassed like ...
- 671
-1
votes
1
answer
453
views
What is this obfuscated JS code trying to do? [closed]
I received phishing email that contains base64 encrypted JS code in the attachment. I decrypted it but can't understand it because of obfuscation. Do you guys have any clue what this code is trying to ...
0
votes
1
answer
126
views
Why is the -L (list) option of iptables not available to non-root users?
Many tools in Linux allow for checking things as a non-root user. For example, at any time, I can check whether a service is running:
$ systemctl status ntp
However, the iptables needs to be used as ...
- 987
0
votes
1
answer
571
views
PHP code in image file
My drupal website was getting hacked recently. While cleaning up the malicious scripts, I found that the hacker uploaded an image file (sites/default/files/test.jpg) contains below code.
...
- 187
1
vote
1
answer
107
views
Obfuscating android malware [closed]
I am exploring android malware forensics and am trying out payload generation and delivery, while also trying obfuscation. I have used commercial tools, e.g. ProGuard and also open sourced tools, eg. ...
- 13
1
vote
2
answers
697
views
How to secure containerized python source code deployed at client side cloud
How can we secure a source code which is deployed at client side cloud and is difficult to reverse engineer just like a licensed product The major difference is that I have a service to protect and do ...
- 23
2
votes
4
answers
2k
views
.Net dll encryption
By nature, .NET assemblies are extremely easy to reverse engineer. Say I want to hide some code by embedding an encrypted .dll into another .dll that is to be decrypted and loaded at runtime:
compile ...
- 81
1
vote
1
answer
279
views
Passwords stored as obfuscated text, not encrypted
An application I admin (but did not develop or implement) claims to be storing passwords in a database using “reversible encryption.”
I have access to the database table, and was able to work out that ...
- 13
0
votes
2
answers
149
views
How to Prevent Copying of Device Source Code in Manufacturing
Suppose you are going to mass manufacture custom circuit boards and would like the manufacturer to upload the device firmware onto these boards before shipping them out. What are some security systems/...
- 1
0
votes
0
answers
16
views
What does this obfuscated PHP script do? [duplicate]
I found an obfuscated PHP-script in a log directory on a shared hosting, which had been given chmod 0777 by mistake.
The script in it's original form looks like this:
$zowyb = 'i#7uH0_ls5y4m*bcrovaptf-...
- 233
1
vote
1
answer
331
views
Is it possible for a javascript malware to put keylogger extension in my browser? [duplicate]
I clicked on "It's like you" virus in Facebook Messenger. Then I archived the original link with archive.ph (archive.today), and during the process the site showed me this: https://pastebin....
3
votes
3
answers
2k
views
Securing client side code of react application [duplicate]
I'm developing application with react and all the main logic is on the client side. I want to force users to use the application only if they paid for the app subscription.
Are there any methods to ...
1
vote
1
answer
187
views
The hidden meaning of the source code of the malware?
I'm studying the source code of malware developed in c++ and I have two questions in the source code below
This is probably code that loads malicious dlls into memory.
typedef BOOL (WINAPI *...
- 13
3
votes
2
answers
1k
views
How to decrypt a file to memory and run it from memory?
How someone might run an encoded executable, mp3, or any other file safely in memory after being decrypted.
A use case might be someone trying to make code or a file only usable through their service ...
0
votes
1
answer
356
views
Mixing VPN Protocols
Is there any benefit to mixing vpn protocols as far as obfuscating your traffic. Would a multiple hop setup like (openvpn(server1) + wireguard(server2)) be better or is (openvpn(server1) + openvpn(...
0
votes
3
answers
629
views
Traffic obfuscation under targeted surveillance
When you are under targeted surveillance and all of your internet traffic is tapped (including parts where you exit from a VPN to the internet), is there any point in using traffic obfuscation? It won'...
- 11
2
votes
1
answer
535
views
Hiding Tor traffic to prevent deanonymization
I am trying to figure out what is the best way to hide Tor traffic in order to improve anonymity.
While Tor is pretty good at hiding users’ IP addresses, its traffic stands out. This can be ...
- 29
1
vote
0
answers
116
views
Would Indistinguishability obfuscation make Javascript cryptography viable?
I know Javascript Cryptography is considered harmful because:
Secure delivery of Javascript to browsers is a chicken-egg problem.
Browser Javascript is hostile to cryptography.
The "view-source&...
- 111
0
votes
1
answer
4k
views
Obfuscating an .exe file
Is there a way to obfuscate an existing .exe file?
I'm in a situation where I cannot transfer the winPEAS.exe file (for PrivEsc purposes) on a Win10 machine because of the AV blocking the executable.
...
- 11
0
votes
0
answers
26
views
Does "Security By Obfuscation" have any place in good security practices? [duplicate]
One thing I've had hammered into me by pretty much every security expert I've talked to is that security by obfuscation is not a substitute for actual security measures. However, it has me wondering; ...
- 101
0
votes
0
answers
75
views
How to protect IP-sensitive data in files generated and used by users
I'm working on an offline windows application that generates and loads key results as files. However, these files provide key insights into how our product works internally. To make matters worse my ...
- 101
0
votes
3
answers
309
views
How can I protect me from... myself?
So, here is the deal:
I have a file I cannot change. I cannot, but I know in the future I will want to change it. It's of my understanding that it's not possible to make this file unchangeable while ...
- 74
1
vote
0
answers
368
views
Insecure Binary protection iOS Pentest Report
Thirdparty pentest company reported their findings in our iOS app.
In the report explanation for this vulnerability is
Apple provides default encryption for applications; however, the encryption ...
- 111
0
votes
1
answer
140
views
Who (Designer or User) Should be Resposible for the Correct/Secure Usage of a Tool Intended for Developers/Admins? [closed]
There is a healthy debate around a series of stack overflow posts that refer to the "RunAs" command. Specifically the discussion is in reference to design decision that the folks at ...
- 191
102
votes
4
answers
15k
views
Why is this 435 × 652 pixel JPEG over 6 MB?
This was, before someone helpfully fixed it after seeing this question, a relatively unassuming and tiny photo of a ̶f̶i̶s̶h̶ nudibranch, with 283,620 pixels. It has some metadata: text Exif tags as ...
- 782
-1
votes
1
answer
615
views
obfuscating a Cython source code [closed]
After some research on how I can protect my python source code on similar topics here and other sites, most agree that I should convert my .py file to .pyd using Cython, but the problem is in the ...
- 1
0
votes
1
answer
260
views
I obfuscated my commercial software, i lost source [closed]
I obfuscated my web software with srcProtector and I archived files, I uploaded a new version of the software on the website.
The problem is I forgot to copy files in a new path for backup.
VERY VERY ...
0
votes
1
answer
205
views
Is using SecureString in combination with Xor considered secure enough for standalone Windows app?
The environment is Windows. We are using 3rd party tools in our app, and for tools to work they require method call and pass a license key that is a string.
License.Import(string name, string email, ...
- 1,325
0
votes
1
answer
205
views
Can someone decode this for me?
I decoded some of the original traffic from hex and got the below output. I'm not sure how to decode it further. Any help? Thanks.
T=2020-04-10+13:27:30.758+PST&L=i&M=[g2tray]&N=22&X=...
- 15
-2
votes
1
answer
134
views
Banking App With Sensitive Info In Plain Text
I have a car loan and wanted to make a payment through their website. To enroll for online payments, it asks for the last 4 numbers of my social security number, birth date and account number, but ...
- 287
1
vote
1
answer
617
views
Help with decoding this? Base64 attack [closed]
I'm trying to decode this attack. I know it's attempting to send some kind of malicious command to the web server but I can't figure out how to decode it. It's like encoded more than once or something....
- 15
0
votes
0
answers
363
views
Packaging Python code for github: should I obfuscate author email address from the `setup.py`?
The standard file with packaging instructions (setup.py with setuptools) for Python contains an author_email field. Such a package can then be published to PyPI, but the code is also available ...
- 151
0
votes
0
answers
165
views
Securely unpack malware
I'm trying to find a way to securely unpack Windows Malware packed with UPX, I need to unpack a lot for analysis so automating the process as much as possible is beneficial.
I've found a few methods ...
- 101
0
votes
1
answer
164
views
Should I complie software after making all the variable and function names "1-2 character"? [duplicate]
In JavaScript, it seems common for the official release of the code to use only single-character variable and function names (of course, after converting the original code which uses clearer names) in ...
- 3,482
1
vote
1
answer
6k
views
How can I obfuscate a 64-bit executable Windows file? [closed]
Hyperion works OK when scrambling/obfuscating win32 files, but I am trying a program that seems to be a Win64 executable, and it fails:
C:\Hyperion>hyperion.exe -v mimikatz.exe output.exe
-------...
80
votes
5
answers
15k
views
Does code obfuscation give any measurable security benefit?
I've always firmly held the belief that obfuscation is essentially useless. Obfuscated code is not impossible to read, only harder to read. I had the belief that a sufficiently skilled attacker would ...
user163495
0
votes
0
answers
168
views
What are good examples of "Dynamic opaque predicates"?
I am studying the concept of software obfuscation and come across this interesting scheme, dynamic opaque predicate:
Basically it either goes two false branches, or two true branches, and ...
- 163
-1
votes
1
answer
996
views
How can Runtime-Crypters stay FUD
A Runtime Crypter always works with the same principle: It decrypts its payload, starts up a process in suspended state, inserts the payload and resumes the suspended process under false flag. All ...
0
votes
3
answers
2k
views
Prevent finding key in C++ application binary
I need to store a key (symmetric-key cryptography) within my C++ application binary (based on OpenCV) so that the key as unidentifiable as possible. Can someone help me choose the key so that is ...
- 209
2
votes
1
answer
198
views
Obfuscating "sensitive" strings in mobile client
We have a client that runs some native (C++) code on both Android and iOS, to mitigate MITM attacks we use certificate pinning.
This means that the binary includes some strings (const char * const ...
