Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> urls in double encoded base64 format

I've seen that somewhere else; is it just for obfuscation? Or is there some other reason for it?



From what I've seen online a lot of these adware extensions do something similar. To me it doesn't make sense as an obfuscation method since anyone capable of capturing traces of network activity (or using chrome dev tools to do the equivalent) can probably recognize a base64 encoding and can just run the decoder a second time.

Maybe it might fool some automated analyzers though.


I've definitely seen naive analyzers just do something like:

-Input string

-If string is Base64 encoded

--Run base64decode(string)

-Output new string

With no recursion for an iterated check of any sort of encoding.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: