Questions tagged [obfuscation]

Obfuscation refers to hiding the intended meaning of communication.

Filter by
Sorted by
Tagged with
2
votes
3answers
364 views

Securing client side code of react application [duplicate]

I'm developing application with react and all the main logic is on the client side. I want to force users to use the application only if they paid for the app subscription. Are there any methods to ...
1
vote
1answer
114 views

The hidden meaning of the source code of the malware?

I'm studying the source code of malware developed in c++ and I have two questions in the source code below This is probably code that loads malicious dlls into memory. typedef BOOL (WINAPI *...
2
votes
2answers
179 views

How to decrypt a file to memory and run it from memory?

How someone might run an encoded executable, mp3, or any other file safely in memory after being decrypted. A use case might be someone trying to make code or a file only usable through their service ...
0
votes
1answer
87 views

Mixing VPN Protocols

Is there any benefit to mixing vpn protocols as far as obfuscating your traffic. Would a multiple hop setup like (openvpn(server1) + wireguard(server2)) be better or is (openvpn(server1) + openvpn(...
0
votes
3answers
127 views

Traffic obfuscation under targeted surveillance

When you are under targeted surveillance and all of your internet traffic is tapped (including parts where you exit from a VPN to the internet), is there any point in using traffic obfuscation? It won'...
2
votes
1answer
154 views

Hiding Tor traffic to prevent deanonymization

I am trying to figure out what is the best way to hide Tor traffic in order to improve anonymity. While Tor is pretty good at hiding users’ IP addresses, its traffic stands out. This can be ...
1
vote
0answers
44 views

Would Indistinguishability obfuscation make Javascript cryptography viable?

I know Javascript Cryptography is considered harmful because: Secure delivery of Javascript to browsers is a chicken-egg problem. Browser Javascript is hostile to cryptography. The "view-source&...
0
votes
2answers
252 views

Obfuscating an .exe file

Is there a way to obfuscate an existing .exe file? I'm in a situation where I cannot transfer the winPEAS.exe file (for PrivEsc purposes) on a Win10 machine because of the AV blocking the executable. ...
0
votes
0answers
22 views

Does “Security By Obfuscation” have any place in good security practices? [duplicate]

One thing I've had hammered into me by pretty much every security expert I've talked to is that security by obfuscation is not a substitute for actual security measures. However, it has me wondering; ...
0
votes
0answers
31 views

How to protect IP-sensitive data in files generated and used by users

I'm working on an offline windows application that generates and loads key results as files. However, these files provide key insights into how our product works internally. To make matters worse my ...
0
votes
3answers
236 views

How can I protect me from… myself?

So, here is the deal: I have a file I cannot change. I cannot, but I know in the future I will want to change it. It's of my understanding that it's not possible to make this file unchangeable while ...
1
vote
0answers
98 views

Insecure Binary protection iOS Pentest Report

Thirdparty pentest company reported their findings in our iOS app. In the report explanation for this vulnerability is Apple provides default encryption for applications; however, the encryption ...
0
votes
1answer
67 views

Who (Designer or User) Should be Resposible for the Correct/Secure Usage of a Tool Intended for Developers/Admins? [closed]

There is a healthy debate around a series of stack overflow posts that refer to the "RunAs" command. Specifically the discussion is in reference to design decision that the folks at ...
0
votes
0answers
25 views

How do I go about decoding this malicious PHP script? [duplicate]

I came upon this script just by luck, actually. Ironically, it's stored in a protected folder on my website and I don't think <? $catches ='r'; $comforter ='$r)ciEVi'; $heroin = 'SgD'; $...
101
votes
4answers
14k views

Why is this 435 × 652 pixel JPEG over 6 MB?

This was, before someone helpfully fixed it after seeing this question, a relatively unassuming and tiny photo of a ̶f̶i̶s̶h̶ nudibranch, with 283,620 pixels. It has some metadata: text Exif tags as ...
-1
votes
1answer
226 views

obfuscating a Cython source code [closed]

After some research on how I can protect my python source code on similar topics here and other sites, most agree that I should convert my .py file to .pyd using Cython, but the problem is in the ...
0
votes
1answer
145 views

I obfuscated my commercial software, i lost source [closed]

A VERY bad problem. I obfuscated my web software with srcProtector and i archieved files, i uploaded a new version of software on the website. The problem is i forgot to copy files in a new path for ...
0
votes
1answer
52 views

Is using SecureString in combination with Xor considered secure enough for standalone Windows app?

The environment is Windows. We are using 3rd party tools in our app, and for tools to work they require method call and pass a license key that is a string. License.Import(string name, string email, ...
0
votes
1answer
114 views

Can someone decode this for me?

I decoded some of the original traffic from hex and got the below output. I'm not sure how to decode it further. Any help? Thanks. T=2020-04-10+13:27:30.758+PST&L=i&M=[g2tray]&N=22&X=...
0
votes
0answers
20 views

How to deobfuscate malicious PHP code [duplicate]

This is my first malware analyis, so apologies for my probably noob-like question. I'm having a look at a website running an outdated version of Wordpress which was hacked. The Website runs on a ...
-2
votes
1answer
93 views

Banking App With Sensitive Info In Plain Text

I have a car loan and wanted to make a payment through their website. To enroll for online payments, it asks for the last 4 numbers of my social security number, birth date and account number, but ...
1
vote
1answer
211 views

Help with decoding this? Base64 attack [closed]

I'm trying to decode this attack. I know it's attempting to send some kind of malicious command to the web server but I can't figure out how to decode it. It's like encoded more than once or something....
0
votes
0answers
135 views

Packaging Python code for github: should I obfuscate author email address from the `setup.py`?

The standard file with packaging instructions (setup.py with setuptools) for Python contains an author_email field. Such a package can then be published to PyPI, but the code is also available ...
0
votes
0answers
62 views

Securely unpack malware

I'm trying to find a way to securely unpack Windows Malware packed with UPX, I need to unpack a lot for analysis so automating the process as much as possible is beneficial. I've found a few methods ...
0
votes
1answer
110 views

Should I complie software after making all the variable and function names “1-2 character”? [duplicate]

In JavaScript, it seems common for the official release of the code to use only single-character variable and function names (of course, after converting the original code which uses clearer names) in ...
1
vote
1answer
3k views

How can I obfuscate a 64-bit executable Windows file? [closed]

Hyperion works OK when scrambling/obfuscating win32 files, but I am trying a program that seems to be a Win64 executable, and it fails: C:\Hyperion>hyperion.exe -v mimikatz.exe output.exe -------...
78
votes
5answers
14k views

Does code obfuscation give any measurable security benefit?

I've always firmly held the belief that obfuscation is essentially useless. Obfuscated code is not impossible to read, only harder to read. I had the belief that a sufficiently skilled attacker would ...
0
votes
0answers
50 views

What are good examples of “Dynamic opaque predicates”?

I am studying the concept of software obfuscation and come across this interesting scheme, dynamic opaque predicate: Basically it either goes two false branches, or two true branches, and ...
0
votes
1answer
452 views

How can Runtime-Crypters stay FUD

A Runtime Crypter always works with the same principle: It decrypts its payload, starts up a process in suspended state, inserts the payload and resumes the suspended process under false flag. All ...
0
votes
3answers
595 views

Prevent finding key in C++ application binary

I need to store a key (symmetric-key cryptography) within my C++ application binary (based on OpenCV) so that the key as unidentifiable as possible. Can someone help me choose the key so that is ...
2
votes
1answer
108 views

Obfuscating “sensitive” strings in mobile client

We have a client that runs some native (C++) code on both Android and iOS, to mitigate MITM attacks we use certificate pinning. This means that the binary includes some strings (const char * const ...
0
votes
3answers
165 views

Are there types of malware that are so time-intensive to detect that AV vendors simply choose to not detect them? [closed]

I've been reading a lot about how AVs use different heuristic methods to detect obfuscated malware and it seems like some of these methods are very time/processor intensive. For example, to detect ...
-4
votes
3answers
145 views

Is code obfuscation common in FOSS?

I am a learner of FOSS licensing, security and privacy. I ask this question because one of the arguments persuading users to use or switch to FOSS is the fact that since the code is open, an expert ...
0
votes
1answer
319 views

Is security by obscurity / obfuscation a valid option, or do the crawlers have JavaScript enabled?

I'm creating a new website, so I am thinking about how to protect my email address and phone number against crawlers, I actually mean email harvesters (most of which I suppose don't have JavaScript ...
0
votes
1answer
150 views

What does the attached php malware do? [duplicate]

Found this on a WordPress server under the filename wp-includes/class-wp-image-editor-fd.php when WordFence picked it up as being an unexpected file. Link to source is here: https://pastebin.com/...
1
vote
1answer
169 views

Filtering Obfuscated Spam Emails In Exchange

So the past few weeks we have been trying to cut back on the amount of spam reaching our users in our organization. We have been successful in implementing hard filtering rules like if an email ...
1
vote
1answer
173 views

What notable examples of metamorphic engines are there? [closed]

I am doing a research project on metamorphic malware and would like to have access to a metamorphic engine I could demo. Are there any good open-source (or easily obtainable) metamorphic engines I ...
0
votes
3answers
252 views

What string encoding options are there besides xor? [closed]

When attempting to obfuscate strings in a modern program, xor is probably the most common option. By this I mean running each char of a string through a function which xors the char with some given ...
2
votes
2answers
108 views

Could always-listening mobile apps secretly spy on conversations?

Various apps and services available on modern smartphones constantly listen with the mic (e.g. Siri or Google Assistant listening for wake word, "Now Playing" feature on Pixel phones). To settle user ...
-1
votes
2answers
312 views

Why are there no GPU Obfuscators? [closed]

Rationale: I need to figure out ways to protect Intellectual Property contained in NVIDIA CUDA/GPU code. That said, I'm surprised that there are literally zero GPU code obfuscators. On stack ...
0
votes
1answer
805 views

Key Encryption / Obfuscation

I got a GUI Program, which loads the Logic from a webserver if the entered License Key is valid. The actual connection string I hexed and xor'd with a secret key. (which is unfortunately static) The ...
1
vote
1answer
64 views

How can I make sure that my Python code cannot be accessed by the user of my web app?

I have a Python Program whose code I would like to protect. For sake of example, let's say I coded a novel function called "add" which does the following: def add(n1, n2): return n1 + n2 I'd ...
0
votes
1answer
388 views

Is this strange PHP file that I found on my server malicious? [duplicate]

I found a PHP file that I don't know where it came from on my server: <?php $ojcsoo = '_-bHft\'dik1x6cn9leapm0y4s7vg5*r8ou#2';$zjdtjcd = Array();$zjdtjcd[] = $ojcsoo[3].$ojcsoo[29];$zjdtjcd[] = $...
3
votes
1answer
462 views

C++ binary obfuscation: how to get around license checks being a simple if/then branches?

I'm looking into binary obfuscation for an exectuable binary written in C++. I realize preventing cracks is impossible, but making it slightly harder would be nice. No matter how complex the actual ...
0
votes
1answer
198 views

Are auto-type features of password managers actually effective against keyloggers?

Of course if you think of a "keylogger" as a program that can only read keystrokes, then copy-pasting on the clipboard is going to be enough. But we know that keyloggers are not really only "logging ...
2
votes
0answers
413 views

How to obfuscate C++ code with movfuscator?

I want to obfuscate a C++ application using movfuscator, but movfuscator currently uses C as the source language and not C++. I tried to do the followings (as they recommended, but with no success): ...
5
votes
4answers
1k views

Does appending randomness to a token before encrypting it, make it more secure?

Scenario: User requests page on my site Server builds up token using various values, encrypts it (via an industry-standard algorithm, nothing homegrown) using a key only the server knows, and returns ...
1
vote
2answers
370 views

How to obfuscate a assemblies binary compiled with .NET framework?

How to obfuscate a binary compile with .NET framework? Tools such as Ebowla and Pecloak.py will encrypt it but the program won't run. Even UPX can't pack it. Wondering are there any ways to obfuscate ...
-1
votes
1answer
937 views

Obfuscated PHP code found on Wordpress site - has it been compromised? [duplicate]

Firstly - I expect the answer to be yes. But I never dealt with something like this so I would like some advice. A client has recently complained that their website went down. So I started ...
2
votes
1answer
709 views

How to obfuscate SSH tunnel Mac?

I am looking to test a DPI (deep packet inspector). I currently have it set up to block SSH connections (which it does successfully). I have learned that DPI can be bypassed by obfuscating/encrypting ...