5 ms·

VM-based architectures are really common in the obfuscation space, which is why you have executable packers[1], JS packers[2] and bot management products[3][4]

VM-based architectures are really common in the obfuscation space, which is why you have executable packers[1], JS packers[2] and bot management products[3][4] leveraging similar techniques. As for why the obfuscation is needed: bot management products suffer from a fundamental weakness in that ultimately, all of them simply collect static data from the environment, therefore it would make much more sense to make the steps involved as difficult to reverse engineer as possible. Once that is done, all you need to do is slightly change the schematics of your script every few weeks and publish a new bundle, and you've got yourself a pretty unsubvertible* protection scheme. Regarding the "trojan horse", I think someone is yet to show proof that it's a Javascript exploit. (*Unsubvertible is obviously relative, but raising the cost the attack, from say, $0.01/1000 requests to $10/1000 requests would massively cut down on abuse.) [1] https://vmpsoft.com/ https://vmpsoft.com/ [2] https://jscrambler.com/ https://jscrambler.com/ [3] https://github.com/neuroradiology/InsideReCaptcha https://github.com/neuroradiology/InsideReCaptcha [4] https://www.zenrows.com/blog/bypass-cloudflare#_qEu5MvVdnILJHW8q3FKf https://www.zenrows.com/blog/bypass-cloudflare#_qEu5MvVdnILJ...

noduerme 2y ago
[flagged]
- supriyo-biswas 2y ago
  > Packers and obfuscators are not a "VM". It may look like a VM and act like a VM, in that it has opcodes that you can write to in another higher-level "language", but that is not a VM. It's in the same sandbox as the thing you're trying to obfuscate. Indignant, caustic comments that simply discard all presented evidence such as this is the primary reason why people with the relevant experience have reduced their contributions on HN. I suspect I'll join their ranks too.
  - esseph 2y ago
    If you explain what you disagree with, maybe people would learn something. If you joint "their ranks", you've simply gone down the bit of the "social media + expertise" bell curve, where the more expertise you get on a particular topic, the less you want to engage about it in public. This is not unique to any one field or realm of knowledge.
    - supriyo-biswas 2y ago
      This is all correct, just that I'm lamenting the decline of technical discussions over uninformed positions and polarizing diatribes at a place I loved to come to be informed. /soapbox
      - esseph 2y ago
        You're the one doing the informing on this topic, congrats, you've forum-peaked.
    - noduerme 2y ago
      It's also a learning experience on both sides if people who have the knowledge share it with others. Teaching is a great way to learn; I exercise a great deal in my mind when I'm not working by trying to help other people solve problems.
      - deleted 2y ago
        [deleted]
    - oefrha 2y ago
      > I can't think of a scenario where you'd need to deconstruct their front-end to mimic the calls. Just observe the calls and mimic them. Just about everything in that wall of text is wrong, but it’s rather pointless to engage someone who clearly has never reverse engineered a single thing with a modicum of defense, yet has tons of opinions on the subject. It’s like debating the pros and cons of programming languages with someone whose claim of expertise is having used computers. I totally get gp’s frustration. Denial of service with too many absurd points is real. > If you explain what you disagree with, maybe people would learn something. TFA explains in detail why reverse engineering is necessary, and specifically what is achieved by reverse engineering which part. ggp clearly has zero interest in learning when much of what they wrote has been refuted in the damn post being discussed. Other people can RTFA to learn as well, it’s a good technical post, and we don’t get enough of those these days.
      - 2y ago
  - noduerme 2y ago
    I'm not trying to be caustic or indignant. Not at all! I'm very surprised someone would take it that way. I have a different definition of what a "VM" is. I've been writing code for 30+ years and this is my understanding of what that means. Please, by all means, if I am completely wrong then take the time to explain what your view is.
  - marvinmorvin 2y ago
    [flagged]
- saagarjha 2y ago
  Amazing. Every word of what you said was wrong.
  - noduerme 2y ago
    Well, then correct me.
    - saagarjha 2y ago
      Your definition of VM diverges from the standard one. This is a VM: > it has opcodes that you can write to in another higher-level "language" VMs aren't just VirtualBox. TikTok obfuscates their frontend because they fingerprint the device and send it to their server, likely as an anti-fraud thing. Generally these kinds of things will make it so that you can't treat the frontend as a black box and replay requests or do anything simple like that. For example, if they add an incrementing counter to each request and then encrypt it, and then they see you send the same request again, then they will flag you for doing something fishy. You'd only know what they were doing if you reverse engineered the frontend. This isn't security per se but it makes people have to reverse engineer the code to mimic genuine behavior, which is their goal. As for TikTok being a cyberweapon: you're going to have to back up that claim. Obfuscating an app and then installing it on people's phones is not as clever an idea as you think it is.
- noduerme 2y ago
  I seem to be misunderstood. In a sibling part of this thread that was responding to someone who was later flagged, I wrote this: But that's basically an emulator of a VM, isn't it? It's like rewriting the Flash AVM2 into JS... it's still running in JS whereas the original VM was C++. It could JIT compile stuff but only because it literally was reserving memory that could overflow, and (semi-technical take here) from that advantage, of being closer to the metal, flowed all of the flaws in AVM2 that precipitated most of Adobe's woes with Flash. A VM implant in a web page that uses a plugin like Java or Flash, to get around running browser-sandboxed code, which can take over physical memory, is far different from just emulating a VM in Javascript. I wouldn't call writing a ton of opcodes in JS, which resolved to JS functions, a "virtual machine", because it isn't reserving anything or doing anything that Javascript can't do. Someone correct me here if I'm wrong... this is just heavy-duty obfuscation. Also, one major purpose of a VM is to improve performance over what's available in the browser. If you use that as a measurement, this clearly doesn't fit that goal.
  - lxgr 2y ago
    > But that's basically an emulator of a VM, isn't it? It's like rewriting the Flash AVM2 into JS... it's still running in JS whereas the original VM was C++. I think you're using a different definition of the term VM than most other people here. An "emulated VM" is a VM too. > one major purpose of a VM is to improve performance over what's available in the browser. That's definitely a very nonstandard interpretation. Many VMs are, intentionally, much less capable (in a permissions sense; in a computational sense, they're almost always exactly as capable) than the host environment they run in.
- wzdd 2y ago
  > I can't think of a scenario where you'd need to deconstruct their front-end to mimic the calls. The article mentioned that important API calls are signed. So you would need at least partially to deconstruct their front-end to invoke the calls. Any other nefarious purposes aside, this seems explicitly anti-bot because you can change the obfuscation whenever you like, forcing another RE effort.

noduerme 2y ago

[flagged]

supriyo-biswas 2y ago
> Packers and obfuscators are not a "VM". It may look like a VM and act like a VM, in that it has opcodes that you can write to in another higher-level "language", but that is not a VM. It's in the same sandbox as the thing you're trying to obfuscate. Indignant, caustic comments that simply discard all presented evidence such as this is the primary reason why people with the relevant experience have reduced their contributions on HN. I suspect I'll join their ranks too.
- esseph 2y ago
  If you explain what you disagree with, maybe people would learn something. If you joint "their ranks", you've simply gone down the bit of the "social media + expertise" bell curve, where the more expertise you get on a particular topic, the less you want to engage about it in public. This is not unique to any one field or realm of knowledge.
  - supriyo-biswas 2y ago
    This is all correct, just that I'm lamenting the decline of technical discussions over uninformed positions and polarizing diatribes at a place I loved to come to be informed. /soapbox
    - esseph 2y ago
      You're the one doing the informing on this topic, congrats, you've forum-peaked.
  - noduerme 2y ago
    It's also a learning experience on both sides if people who have the knowledge share it with others. Teaching is a great way to learn; I exercise a great deal in my mind when I'm not working by trying to help other people solve problems.
    - deleted 2y ago
      [deleted]
  - oefrha 2y ago
    > I can't think of a scenario where you'd need to deconstruct their front-end to mimic the calls. Just observe the calls and mimic them. Just about everything in that wall of text is wrong, but it’s rather pointless to engage someone who clearly has never reverse engineered a single thing with a modicum of defense, yet has tons of opinions on the subject. It’s like debating the pros and cons of programming languages with someone whose claim of expertise is having used computers. I totally get gp’s frustration. Denial of service with too many absurd points is real. > If you explain what you disagree with, maybe people would learn something. TFA explains in detail why reverse engineering is necessary, and specifically what is achieved by reverse engineering which part. ggp clearly has zero interest in learning when much of what they wrote has been refuted in the damn post being discussed. Other people can RTFA to learn as well, it’s a good technical post, and we don’t get enough of those these days.
    - 2y ago
- noduerme 2y ago
  I'm not trying to be caustic or indignant. Not at all! I'm very surprised someone would take it that way. I have a different definition of what a "VM" is. I've been writing code for 30+ years and this is my understanding of what that means. Please, by all means, if I am completely wrong then take the time to explain what your view is.
- marvinmorvin 2y ago
  [flagged]
saagarjha 2y ago
Amazing. Every word of what you said was wrong.
- noduerme 2y ago
  Well, then correct me.
  - saagarjha 2y ago
    Your definition of VM diverges from the standard one. This is a VM: > it has opcodes that you can write to in another higher-level "language" VMs aren't just VirtualBox. TikTok obfuscates their frontend because they fingerprint the device and send it to their server, likely as an anti-fraud thing. Generally these kinds of things will make it so that you can't treat the frontend as a black box and replay requests or do anything simple like that. For example, if they add an incrementing counter to each request and then encrypt it, and then they see you send the same request again, then they will flag you for doing something fishy. You'd only know what they were doing if you reverse engineered the frontend. This isn't security per se but it makes people have to reverse engineer the code to mimic genuine behavior, which is their goal. As for TikTok being a cyberweapon: you're going to have to back up that claim. Obfuscating an app and then installing it on people's phones is not as clever an idea as you think it is.
noduerme 2y ago
I seem to be misunderstood. In a sibling part of this thread that was responding to someone who was later flagged, I wrote this: But that's basically an emulator of a VM, isn't it? It's like rewriting the Flash AVM2 into JS... it's still running in JS whereas the original VM was C++. It could JIT compile stuff but only because it literally was reserving memory that could overflow, and (semi-technical take here) from that advantage, of being closer to the metal, flowed all of the flaws in AVM2 that precipitated most of Adobe's woes with Flash. A VM implant in a web page that uses a plugin like Java or Flash, to get around running browser-sandboxed code, which can take over physical memory, is far different from just emulating a VM in Javascript. I wouldn't call writing a ton of opcodes in JS, which resolved to JS functions, a "virtual machine", because it isn't reserving anything or doing anything that Javascript can't do. Someone correct me here if I'm wrong... this is just heavy-duty obfuscation. Also, one major purpose of a VM is to improve performance over what's available in the browser. If you use that as a measurement, this clearly doesn't fit that goal.
- lxgr 2y ago
  > But that's basically an emulator of a VM, isn't it? It's like rewriting the Flash AVM2 into JS... it's still running in JS whereas the original VM was C++. I think you're using a different definition of the term VM than most other people here. An "emulated VM" is a VM too. > one major purpose of a VM is to improve performance over what's available in the browser. That's definitely a very nonstandard interpretation. Many VMs are, intentionally, much less capable (in a permissions sense; in a computational sense, they're almost always exactly as capable) than the host environment they run in.
wzdd 2y ago
> I can't think of a scenario where you'd need to deconstruct their front-end to mimic the calls. The article mentioned that important API calls are signed. So you would need at least partially to deconstruct their front-end to invoke the calls. Any other nefarious purposes aside, this seems explicitly anti-bot because you can change the obfuscation whenever you like, forcing another RE effort.