Obfuscation - CompTIA Security+ SY0-701 - 1.4

Obfuscation and Its Techniques

Understanding Obfuscation

• Obfuscation is the process of making information difficult to understand, transforming clear data into a more complex form.

• Knowing how obfuscation works allows one to reverse the process and access the original data, highlighting that hidden information can be in plain sight.

Steganography: A Form of Obfuscation

• Steganography involves hiding information within an image, derived from Greek meaning "concealed writing."

• Often considered security through obscurity, steganography's effectiveness relies on knowing how the data was concealed; otherwise, it offers no real security.

Practical Examples of Steganography

• The image containing hidden data is referred to as covertext; it conceals information that isn't visible at first glance.

• Besides images, steganography can also be applied to network traffic by embedding messages within TCP packets.

Advanced Techniques in Steganography

• Information can be hidden using almost invisible watermarks like machine identification codes found in laser printer outputs.

• Audio and video files are also mediums for steganography, allowing significant amounts of data to be concealed within these formats.

Tokenization: A Common Obfuscation Method

What is Tokenization?

• Tokenization replaces sensitive data with a non-sensitive equivalent (token), which has no mathematical relationship to the original data.

Real-world Applications of Tokenization

• For example, a Social Security number can be transformed into a different number while maintaining a link behind the scenes for retrieval purposes.

Security Benefits of Tokenization

• When using mobile payments or smartwatches, temporary tokens replace credit card numbers during transactions for enhanced security.

One-time Use Tokens

• These tokens are designed for single use only; if intercepted during transfer, they cannot be reused successfully.

Behind-the-scenes Process of Tokenization

Understanding Tokenization in Payment Systems

How Tokenization Works

• Instead of transmitting actual credit card numbers, transactions utilize tokens provided by a token service server. This enhances security by preventing exposure of sensitive information.

• The merchant sends the token back to the token service server for a reverse lookup, which retrieves the actual credit card number and validates it for sufficient funds or credit.

• After a transaction is completed, the used token is discarded by your device, ensuring it cannot be reused for future transactions. A new token is either prepared from an existing list or requested from the server.

Data Masking Techniques

• Receipts often employ data masking techniques, displaying only partial credit card numbers (usually masked with asterisks), while revealing only the last four digits to protect user privacy.