Obfuscation in IT refers to all the methods aiming at altering the readability and the understanding of a part of a source code without changing its functioning.<\/p>\n","protected":false},"excerpt":{"rendered":"
In this article you will discover an effective way to counteract computer obfuscation.<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-997","post","type-post","status-publish","format-standard","hentry","category-posts"],"acf":{"headings":[{"acf_fc_layout":"base","title_category_icon":766,"title_category":"Post","title_category_color":"clr-pink","title":"How do you protect against computer obfuscation<\/span> with a WAF?","title_color":"clr-white","title_description":"","title_description_theme":"content-text-dark","title_buttons":null,"background":"bg-gradient-purple-blue-bl","padding_top":"pt-xxlarge","padding_bottom":"pb-xxlarge","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":true,"separator_bottom_color":"sep-white","opt_breadcrumb":true,"opt_breadcrumb_theme":"breadcrumb-dark"}],"background_image":null,"modules":[{"acf_fc_layout":"wysiwyg","mod_wysiwyg":"Application protection through computer obfuscation...<\/h3>\r\nObfuscation can be used as a tool to protect an application in production in order to avoid its \"reverse engineering\", i.e. the possibility for an external user to understand the source code in order, for example, to exploit potential vulnerabilities.\r\nWith this in mind, it is possible to replace variable names with characters such as the underscore \"_\" in order to give no information about their usefulness.\r\n\r\n
... but also a tool used by hackers<\/h3>\r\n\r\nHowever these techniques can just as well be used for malicious purposes, regarding the security of web applications, obfuscation allows to bypass some restrictions, these can be security mechanisms directly in the source code or web application firewalls.\r\nObfuscation is therefore a double-edged tool, being as effective in protecting an application as it is in attacking some.\r\n\r\n
What is the difference between a normal attack and an obfuscated attack? <\/h2>\r\n\r\n
1. Normal attack scenario<\/h3>","mod_wysiwyg_theme":"content-text-light","background":"bg-solid-white","padding_top":"pt-large","padding_bottom":"pb-xlarge","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","unique_id":""},{"acf_fc_layout":"photos","title":"","mod_title_color":"clr-white","mod_title_alignment":"align-left","images":[1244],"background":"bg-solid-white","padding_top":"pt-medium","padding_bottom":"pb-medium","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","unique_id":""},{"acf_fc_layout":"wysiwyg","mod_wysiwyg":"In a normal attack, the attacker simply sends an attack aimed at a company's server, such as a command injection, however the web application firewall will analyse the request and spot the attack.\r\nAs the request is not healthy, the user cannot access the server and their attack attempt is recorded in a log.\r\n\r\n
2. Computer obfuscation attack<\/h3>","mod_wysiwyg_theme":"content-text-light","background":"bg-solid-white","padding_top":"pt-medium","padding_bottom":"pb-medium","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","unique_id":""},{"acf_fc_layout":"photos","title":"","mod_title_color":"clr-white","mod_title_alignment":"align-left","images":[1244],"background":"bg-solid-white","padding_top":"pt-medium","padding_bottom":"pb-medium","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","unique_id":""},{"acf_fc_layout":"wysiwyg","mod_wysiwyg":"In this second example, the attacker sends the same attack but obfuscated (using the techniques we will see below) so that the algorithms cannot draw any reliable conclusions.\r\n\r\nHere, the web application firewall, not being designed to detect obfuscations, will let the attack through and the server may then be compromised because the web application firewall will not have known how to distinguish a real request from a fake one.\r\n\r\n
What are the different types of obfuscations? <\/h2>\r\n\r\nMultiple obfuscation techniques exist and differ from one language to another. Let's mention some examples:\r\n\r\n
Code obfuscation, which language? <\/h3>\r\n\r\n
1. Double encoding<\/h4>\r\nIn a web request (HTTP request), each character corresponds to a hexadecimal number and can be represented as %XX, where XX is the number in hexadecimal e.g. %2F representing the \"\/\"\r\nTo avoid certain filters it is possible to encode the \"%\" sign, so the \"\/\" which gives %2F in hexadecimal, can be encoded as %252F.\r\nThe double encoding can also be encoded, we speak then of multi encoding, that is used in particular to exploit Directory Traversal type flaws.\r\nIt is of course necessary that the backend is also able to handle multi-decoding for a vulnerability to be exploited.\r\n\r\n","mod_wysiwyg_theme":"content-text-light","background":"bg-solid-white","padding_top":"pt-medium","padding_bottom":"pb-medium","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","unique_id":""},{"acf_fc_layout":"photos","title":"","mod_title_color":"clr-white","mod_title_alignment":"align-left","images":[1245],"background":"bg-solid-white","padding_top":"pt-medium","padding_bottom":"pb-medium","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","unique_id":""},{"acf_fc_layout":"wysiwyg","mod_wysiwyg":"
2. Base64 encoding <\/h4>\r\nBase64 encoding is a process that can be used for different purposes. Let's take an example with the command injection<\/a>.\r\nOn a terminal it is possible to convert a command to base64, and then execute it in the following way: \r\n
![\"\"](\"https:\/\/www-dev.ubikasec.com\/wp-content\/uploads\/2023\/04\/eval_bhmk.png\")
\r\nIf a web application firewall is only intended to filter certain commands, it will give in to this manipulation and can easily be bypassed using this method.","mod_wysiwyg_theme":"content-text-light","background":"bg-solid-white","padding_top":"pt-medium","padding_bottom":"pb-medium","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","unique_id":""},{"acf_fc_layout":"photos","title":"","mod_title_color":"clr-white","mod_title_alignment":"align-left","images":[1246],"background":"bg-solid-white","padding_top":"pt-medium","padding_bottom":"pb-medium","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","unique_id":""},{"acf_fc_layout":"wysiwyg","mod_wysiwyg":"3. Properties of a language<\/h4>\r\nOther means of obfuscation exist, sometimes implemented directly in a language, an example can be Javascript with its atomic part.\r\nThis obfuscation technique is based on only a string of 6 characters: [, ], (, ), ! and +, and allows to transform Javascript code into a script incomprehensible to a human.\r\nTo obtain the simple letter \"d\", it is necessary to use \"[[][[]]+[])[!+[]+!+[]]\", so a code to exploit a XSS<\/a> can easily go up to more than 20000 characters.","mod_wysiwyg_theme":"content-text-light","background":"bg-solid-white","padding_top":"pt-medium","padding_bottom":"pb-medium","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","unique_id":""},{"acf_fc_layout":"photos","title":"","mod_title_color":"clr-white","mod_title_alignment":"align-left","images":[1247],"background":"bg-solid-white","padding_top":"pt-medium","padding_bottom":"pb-medium","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","unique_id":""},{"acf_fc_layout":"wysiwyg","mod_wysiwyg":"
How does UBIKA Cloud Protector<\/a> protect against computer obfuscation? <\/h2>\r\n \r\nIn order to avoid being trapped, UBIKA Cloud Protector uses normalization engines to identify obfuscation techniques before launching its analysis.\r\nThe engines used by UBIKA Cloud Protector can be called recursively and thus counteract multiple encodings.\r\nThus, the obfuscated parts of a request are decoded, analysed and sent to the different security engines depending on the attack pattern encountered.\r\n","mod_wysiwyg_theme":"content-text-light","background":"bg-solid-white","padding_top":"pt-medium","padding_bottom":"pb-medium","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","unique_id":""},{"acf_fc_layout":"photos","title":"","mod_title_color":"clr-white","mod_title_alignment":"align-left","images":[1248],"background":"bg-solid-white","padding_top":"pt-medium","padding_bottom":"pb-medium","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","unique_id":""},{"acf_fc_layout":"buttons","button":[{"internal_link":75,"external_link":"","button_style":"cta-turquoise-white","button_label":"Request your free 14 days"}],"background":"bg-solid-white","padding_top":"pt-medium","padding_bottom":"pb-medium","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","button_align":"align-center","unique_id":""}],"dl_form":"","dl_form_title":"","dl_gated":false,"dl_asset":""},"yoast_head":"\n