JS Obfuscation �Malware’s best friend�
“Everything Published, Talked and/or discussed in this conference is solely based on my personal point of
View, and Does not represent my current, or past employers.”
Next 60 Mins !
Introduction: A Double-Edged Sword
Origin:
The word "obfuscation" originates from the Latin verb obfuscare, meaning "to darken”.
Process of making something difficult to understand, This technique has both �legitimate and malicious applications.
�Legitimate Uses:
Preventing Spam and Phishing: Obfuscating email addresses or sensitive �information can deter automated scrapers and spammers.
Protecting Intellectual Property: Making code harder to reverse-engineer helps �safeguard proprietary algorithms and software.
Preventing Tampering and Cheating: In online gaming or secure systems, �obfuscation can make it more challenging to modify data or exploit vulnerabilities.�
Malicious Uses:
Hiding Malicious Intent: Malware authors use obfuscation to disguise the true purpose �of their code, making it harder for humans and security tools to analyze.
Evading Antivirus (AV) and Security Tools: By altering the appearance of their code, �malware can bypass signature-based detection and sandbox analysis.
https://attack.mitre.org/techniques/T1027/
JS Code Obfuscation Techniques Malware Delivery
4 category in JS code obfuscation namely Randomization, Data, Encoding and Logic Obfuscation.
1) Randomization Obfuscation: is a technique where attackers randomly insert or change some elements of the JavaScript code� without changing the semantics of the code. Some of the techniques include:
Clean JS Code | Randomization Obfuscated JS Code |
function add(a, b) { return a + b; } console.log(add("security", "sync")); | // rAnDoM CoMmEnT : combining words ... or are we? 🤔 function XyZpQ ( S1 , S2 ) { // aNoThEr CoMmEnT that means nothing! let temp = "us" + "eless"; // junk code let ReS = S1 + S2 ; // random spacing // return value.... maybe? 😉 return ReS ; } // weIrD CoMmEnT wiTh SpAcEs console.log( XyZpQ("security" , "sync") ); |
2) Data Obfuscation: is a form of data masking where the data is purposely scrambled so that it becomes very difficult for a person to understand the semantics of the code
Clean JS Code | Data Obfuscation JS Code |
let message = ”Security Sync"; console.log(message); | // String is hidden in pieces let a = ”Se" + ”cur" + ”ity"; let b = String.fromCharCode(115, 121, 110, 99); console.log(a + b); |
let num = 50; console.log(num); | // Number is hidden through calculations let num = (100 / 2) + (5 - 5); console.log(num); |
3) Encoding Obfuscation: Normally 3 methods are used to encode the original code.
ASCII/Unicode/Hex Coding | Customized Encoding Functions |
let text = String.fromCharCode(115, 121, 110, 99); // "sync” – ASCII Encoding let text = "\u0073\u0079\u006E\u0063"; // "sync” – Unicode Encoding let text = "\x73\x79\x6E\x63"; // "sync” – Hex Encoding | function decode(custom) { return custom .split("-") // Split the string into an array ["120","126","115","104"] .map(code => String.fromCharCode(code - 5)) // Convert each number to a character .join(""); // Join the characters back into a string } let encoded = "120-126-115-104"; // Each letter ASCII + 5 console.log(decode(encoded)); // Output: sync |
Standard Encryption and Decryption:��"sync" becomes "c3luYw==" People don’t instantly understand Base64 But the browser can decode it easily | let encrypted = btoa("sync"); // encode to Base64 console.log(encrypted); // "c3luYw==" let decrypted = atob(encrypted); console.log(decrypted); // "sync" |
4) Logic Obfuscation: This type of obfuscation technique manipulates the execution paths of the JavaScript codes by changing the logic structure without affecting the original semantics.
Clean JS Code | Data Obfuscation JS Code |
function add(a, b) { return a + b; } console.log(add(5, 3)); Output: 8 | function addObf(a, b) { // Irrelevant instruction (does nothing) let junk = a * b - a * b + 100 - 100; // Extra conditional branches (never change the result) if (a === 9999) { return "Not possible"; // This never runs } if (false) { console.log("This will never happen"); } // Real logic return a + b; } console.log(addObf(5, 3)); Output: 8 |
Demo Basic Obfuscation
Code or JS obfuscation is usually not done manually, The above shown are the principle of documented categories, Online tools are used to perform the Obfuscation, we will go though basic to advanced way of Obfuscation Demo here.
There are many tools for various languages that do automated code obfuscation.
Example Java Script code running: https://jsconsole.com/ �
Minifying Java script code: https://www.toptal.com/developers/javascript-minifier�
Packing the Java script code: https://beautifytools.com/javascript-obfuscator.php#
Demo Advanced Obfuscation
HTML Smuggling Example:
Recently increased spear-phishing campaign for deliver of banking Trojan Mekotio, AsyncRAT/NJRAT and Trickbot deliver payloads.
https://www.microsoft.com/en-us/security/blog/2021/11/11/html-smuggling-surges-highly-evasive-loader-technique-increasingly-used-in-banking-malware-targeted-attacks/
JSFireTruck Obfuscation Technique
https://unit42.paloaltonetworks.com/malicious-javascript-using-jsfiretruck-as-obfuscation/
References:
Anybody got any
Questions?