This is not a tribute to the Starsiege: Tribes map. Code obfuscation is source code or intermediate code that is often intentionally scrambled to make it more difficult to read. The reason for this is to deter reverse engineering, disassembly, and decompilation, which may directly affect loss of intellectual property, ease of probing for application vulnerabilities and loss of revenue.

C, C++, and Perl are the easiest obfuscatable languages. There are many varieties of interesting obfuscations ranging from simple keyword substitution, use/non-use of whitespace to create artistic effects, clever self-generating or heavily compressed programs, or programs that are valid and operate similarly in multiple programming languages.

From a security standpoint code obfuscation creates a dilemma, especially for preventing XSS attacks. Dynamic code obfuscation techniques, which basically scramble malicious code in a different way each time a new visitor enters the malicious website, were developed in response to security vendors’ efforts to detect encrypted malicious code.

By obfuscating the malicious code, attackers are able to bypass signature-based solutions such as URI filtering, IDS/IPS, and anti-virus. This prevents a problem for code inspection which attempts to validate user inputs. Many phishing campaigns employ code obfuscation by obfuscating the malicious URI the user must access to avoid suspicion.

Dynamic obfuscation techniques allow visitors of a malicious site to receive a different instance of the obfuscated malicious code, based on random functions and parameter name changes. For each piece of obfuscated code, there would need to exist a signature using signature-based solutions to prevent dynamic obfuscation techniques. This would require an immense amount of time and research and as soon as a signature is ready to be implemented, the malicious code would have already mutated numerous times.

A suggested defensive measure is to use real-time code inspection, which analyzes and understands the code embedded within web content on-the-fly before it reaches the end users. Real-time code inspection would be able to break the code up into small segments, regardless of the code source, for inspection and action prior to execution of the code on network resources.

If you would like to experience an example of code obfuscation with Perl, try this code:

@P=split//,".URRUU\c8R";@d=split//,"\nrekcah xinU / lreP rehtona tsuJ";sub p{
@p{"r$p","u$p"}=(P,P);pipe"r$p","u$p";++$p;($q*=2)+=$f=!fork;map{$P=$P[$f^ord
($p{$_})&6];$p{$_}=/ ^$P/ix?$P:close$_}keys%p}p;p;p;p;p;map{$p{$_}=~/^[P.]/&&
close$_}%p;wait until$?;map{/^r/&&<$_>}%p;$_=$d[$q];sleep rand(2)if/\S/;print

Compile and run from your shell for an interesting message.