Obfuscation

Disguising of program code or spam messages

Obfuscation is a technique used in both malware and spam, to disguise the content of a malicious program or of a spammed message.

In programming, the obfuscation of code to hinder reverse engineering and code changes has legitimate uses, to protect copyrights and intellectual property. In malware creation, it is generally intended to make the process of analysing the malware more difficult and time consuming. Any programming language, including both compiled and scripting languages, can be obfuscated, making it difficult to read or follow the logic and structure of the program.

In spam, obfuscation is intended to defeat automated rather than human readers. Words commonly used in spam, such as the names of popular proprietary drugs, are hidden in a way which makes it unclear to anti-spam software, but when displayed the words are easily recognisable to a human eye. The insertion of spacing, interspersal of letters with nonsense code or invisible characters, or use of patterns of colour and size are among many techniques used to create such obfuscation.

Quick Links

Poll
The Japanese government is reported to have commissioned a 'defensive virus'. Is 'defensive' malware ever a good idea?
Yes
No
I don't know
Leave a comment
View 11 comments

99 Subscription Promo

Virus Bulletin
In this month's magazine:
  • Living the meme
  • If Svar is the answer...
  • Static analysis of mobile malware
  • And the devil is six: the security consequences of the switch to IPv6
  • Behind enemy lines: reporting from the CCC 28C3 Congress
Virus Bulletin 02 2012
Subscribe now!

Virus Bulletin currently has 224,239 registered users.