Obfuscation - CompTIA Security+ SY0-701 - 1.4

Summary

This video script delves into the concept of obfuscation, illustrating how data can be intentionally obscured while remaining in plain sight. It explores steganography, the art of hiding information within images or other media, and discusses its vulnerabilities. The script also covers tokenization, a method of replacing sensitive data with tokens for secure transmission, and data masking, which conceals parts of sensitive information to protect it from unauthorized access. The explanation of these techniques provides insight into the balance between security and accessibility.

Takeaways

• 🔒 Obfuscation is the process of making something difficult to understand that was originally clear.
• 🔄 Knowing the method of obfuscation allows one to reverse the process and retrieve the original data.
• 👀 Information can be hidden in plain sight, recognizable only to those who know the hiding method.
• 🖼️ Steganography is a form of obfuscation that hides data within images, like a 'covertext'.
• 🔐 Security through obscurity is not reliable as the data can be easily recovered if the hiding process is known.
• 🌐 Steganography extends beyond images, including media like network traffic, audio, and video files.
• 🖨️ Printers use nearly invisible yellow dots, or machine identification codes, for steganographic purposes.
• 💳 Tokenization replaces sensitive data with a token, which can be safely transmitted without encryption.
• 🛒 Mobile payments often use one-time-use tokens derived from credit card numbers for secure transactions.
• 🔄 Token service servers provide and manage tokens for secure transactions, invalidating them after use.
• 💳 Data masking, such as showing only the last four digits of a credit card number, is used to protect sensitive information from being exposed.

Q & A

What is obfuscation and why is it used?

Obfuscation is the process of making something that is normally easy to understand more difficult to comprehend. It is used to hide information in plain sight, so that only those who know how it was obfuscated can access the original data.

How does one reverse the process of obfuscation?

If you know the method used to obfuscate the data, you can reverse the process and regain access to the original information.

What is steganography and where does its name originate from?

Steganography is a type of obfuscation where information is hidden within an image or other media. The term comes from the Greek language and means 'concealed writing'.

How is security through obscurity different from actual security?

Security through obscurity relies on the secrecy of the process used to hide data. If someone discovers this process, the data can be easily recovered, making it not a secure method of protection.

What is meant by 'covertext' in the context of steganography?

In steganography, 'covertext' refers to the document or medium that contains the hidden data.

Can steganography be used in forms other than images?

Yes, steganography can be applied to various types of media, including network traffic, audio files, and video files.

What are machine identification codes and how are they used?

Machine identification codes, often represented by yellow dots on printed pages, are used to identify the printer used for printing. If one knows the format of these dots, they can match them back to the specific printer.

How does audio steganography work?

Audio steganography involves hiding information within an audio file or track, making it undetectable to the human ear but recoverable if one knows the method of embedding.

What is tokenization and how is it used to protect sensitive data?

Tokenization is a process where sensitive data is replaced with a token, a stand-in value. This token can be used in transactions instead of the actual sensitive data, protecting it from being misused if intercepted.

How does the credit card tokenization process work during a mobile payment?

During mobile payments, a temporary token is created from the credit card number and sent across the network for the transaction. This token is one-time use and cannot be reused, ensuring the security of the transaction.

What is data masking and why is it used on receipts?

Data masking is a technique where parts of sensitive information, like a credit card number, are hidden, typically showing only the last four digits. It is used to prevent unauthorized access to the full number and protect the customer's information.

How does a company limit access to sensitive credit card information?

Companies can limit access to sensitive information by allowing only certain employees to view the full credit card number, while others may only see a portion of it or have it masked.

What are some alternative methods to data masking using asterisks?

Alternative methods to data masking include rearranging the numbers or replacing certain digits with others that can be reversed later on, ensuring the original data remains secure.

Outlines

00:00

🔒 The Art of Data Obfuscation and Steganography

This paragraph introduces the concept of obfuscation as a method to intentionally complicate the understanding of easily comprehensible information. It explains that while data is hidden in plain sight, those familiar with the obfuscation technique can reverse the process to retrieve the original data. Steganography is highlighted as a popular form of obfuscation, with its Greek origin meaning 'concealed writing'. The paragraph also discusses the use of steganography in various media, including images, network traffic, and printer identification codes, and touches on the limitations of security through obscurity.

05:00

💳 Credit Card Tokenization and Data Masking

The second paragraph delves into the process of credit card tokenization, a security measure where sensitive data is replaced with a non-sensitive token. It describes the registration of a credit card with a mobile phone, the generation of tokens by a token service server, and the use of these tokens during transactions. The paragraph also explains the one-time use of tokens and the subsequent disposal after a transaction. Additionally, it covers data masking techniques used on receipts and in customer service interactions to protect credit card information, illustrating the importance of limiting access to sensitive data and the methods employed to obscure it.

Keywords

💡Obfuscation

Obfuscation refers to the deliberate act of making something that is normally clear and understandable more difficult to comprehend. In the context of the video, it is a technique used to hide information in plain sight, where only those who know the method of obfuscation can decode the original message. The script discusses various forms of obfuscation, such as steganography and tokenization, as methods to conceal data.

💡Steganography

Steganography is a technique used to conceal information within another medium, such as an image, audio, or video file. It is derived from the Greek language, meaning 'concealed writing.' The video script explains that data can be hidden within an image, making it invisible to the naked eye but recoverable if one knows the method of embedding. It is an example of security through obscurity, which is not considered robust security on its own.

💡Covertext

In the context of steganography, 'covertext' refers to the document or medium that contains the hidden data. The video script uses the term to describe an image that appears normal but actually contains embedded information. The covertext serves as a disguise for the true content, which can only be revealed through the knowledge of the specific steganographic technique used.

💡Machine Identification Codes

Machine Identification Codes, as mentioned in the script, are nearly invisible watermarks that are printed by certain printers, such as laser printers. These yellow dots contain information that can be used to identify the specific printer used for the output. The script uses this as an example of how steganography can be applied in physical documents, with the dots being an example of data hidden in plain sight.

💡Tokenization

Tokenization is a process where sensitive data, such as a Social Security number or credit card number, is replaced with a non-sensitive equivalent, known as a token. The video script explains that this process allows for the secure transmission of data across networks without the need for encryption, as the token has no practical use to an unauthorized party. It is used in everyday transactions, such as mobile payments, to enhance security.

💡Data Masking

Data masking is a security technique that involves hiding parts of sensitive information, such as a credit card number, while still allowing the essential parts to be visible for verification purposes. The script illustrates this with the example of a receipt showing only the last four digits of the credit card number. This practice helps protect sensitive data from being misused if the receipt is lost or stolen.

💡Credit Card Token

A credit card token, as described in the script, is a temporary and unique identifier that replaces the actual credit card number during a transaction. This token is used to ensure that even if the data is intercepted during transmission, it cannot be used for fraudulent activities because it is not the actual credit card number. The script explains that this token is a one-time use and is discarded after the transaction is completed.

💡Near-Field Communication (NFC)

Near-Field Communication, or NFC, is a technology that enables the transfer of data between devices over a short distance. In the context of the video, NFC is used during the checkout process to transfer the payment token from a mobile device to the payment system. This contactless technology facilitates secure and convenient transactions without exposing the actual credit card information.

💡Token Service Server

The Token Service Server, as mentioned in the script, is a remote server responsible for generating and managing tokens for sensitive data. When a credit card is registered for mobile payments, this server provides a series of tokens that are stored on the user's device. The script explains that the merchant sends the token to this server during a transaction, which then performs a reverse lookup to determine the actual credit card number for processing the payment.

💡Security Through Obscurity

Security through obscurity is a term used to describe a security measure that relies on the secrecy of the implementation or the algorithm rather than on the strength of the security measures themselves. The script points out that while steganography can be a form of security through obscurity, it is not considered a strong security practice because if the method of hiding the data is discovered, the data can be easily retrieved.

💡Audio Steganography

Audio steganography is a form of steganography where information is hidden within an audio file or track. The script briefly mentions this as another medium where data can be concealed, similar to how it is done with images. This method takes advantage of the human auditory system's inability to detect slight alterations in sound that can encode data.

💡Video Steganography

Video steganography is the practice of hiding information within a video file. The script suggests that a video can contain a significant amount of hidden data, which can be extracted if one knows the specific method used for embedding. This form of steganography is an example of how multimedia content can be used to conceal data for various purposes.

Highlights

Obfuscation is the process of making something difficult to understand that would normally be easy to comprehend.

If you know how obfuscation is done, you can reverse the process to access the original data.

Obfuscation hides information in plain sight, only recognizable if you know how it was hidden.

Steganography is a popular form of obfuscation that hides data within an image.

Steganography has Greek roots meaning 'concealed writing'.

Security through obscurity is not real security as the data can be easily recovered if the hiding process is known.

Covertext refers to the document containing hidden data, like an image with embedded information.

Steganography can be applied to various media forms beyond images, like network traffic or audio/video files.

Yellow dots on printed pages are machine identification codes used for steganography.

Inverting an image can make the yellow machine identification dots more visible.

Audio and video steganography can hide information within sound or visual media.

Tokenization is a form of obfuscation that replaces sensitive data with a token that references the original data.

Tokenization is used in mobile payments to transfer a one-time-use token instead of the actual credit card number.

Token service servers generate tokens and perform a reverse lookup to validate transactions.

Data masking on receipts hides parts of the credit card number for security.

Companies limit access to full credit card numbers to enhance security.

Different methods can be used for data masking, such as rearranging or replacing numbers.

Transcripts

Obfuscation is a process, where you take something

that normally would be very easy to understand,

and you make it much more difficult to understand.

As we step through this video, you'll

get an idea of all of the different ways

that you could take a bit of information or data

and turn it into something that's not quite as

clear as it could be.

One of the interesting aspects of obfuscation

is that if you know how the obfuscation is done,

you're able to reverse the process and gain

access to the original data.

With obfuscation, you're effectively hiding information,

but it's in plain sight.

And only if you know how it was hidden,

would you recognize that there's actually

data contained within that object.

One very popular kind of obfuscation

is steganography, where we can hide information

within an image.

And somewhere in this image is some data

that we would be able to recover if we knew how that data was

originally stored.

Steganography has its roots in the Greek language.

And it stands for "concealed writing."

It's a way to hide data in an image such as this one.

We often refer to steganography as a type of security

through obscurity, which means that if the process that

was used to hide the data, you can very easily recover

the data.

And that's why we often mention that security through obscurity

is not really security at all.

So in this example, we've used a third party utility

to take a bit of information and hide that information

within the image itself.

Obviously, looking at the image, you

can't see any of the data that's stored within it.

But it is really stored within the data containing

this particular image.

Sometimes you'll hear this image referred to as the covertext.

The covertext is the document that contains the data

that you're hiding.

Of course, hiding information within an image

is only one type of steganography.

You can use steganography in many different types

of media and forms.

For example, you can hide information

within network traffic and embed messages within TCP packets

that you're sending across the network.

This data is obviously sent a few bits or bytes at a time.

And if you know how the data is being sent,

you can reconstruct that data on the other side.

We've already mentioned how easy it is to use steganography

with an image to hide data.

And one of the more interesting ways to hide information

is by putting dots on a piece of paper.

These are almost invisible watermarks

that are included with laser printers

and other types of printers.

And if you look very closely at the printed page,

you'll start to see little yellow dots appear.

These yellow dots are referred to as machine identification

codes.

And if you know the format of these yellow dots,

you can match that back to the printer that

was used to print this output.

This is a little bit difficult to see with the yellow dots

on a white page.

So let's invert the image.

And now, you'll see blue dots on this black page.

If you look closely at a laser printer output

from your printer, you should be able to find those yellow dots

somewhere on the printed page.

Well.

If you can store information inside of an image,

you could certainly store information

in other types of media.

For example, you can have audio steganography,

where you're hiding information within an audio file

or an audio track.

We can also use video steganography.

So a video, such as this one can be

used to hide a great deal of information

within that particular file.

A very popular form of obfuscation that we

use every day is tokenization.

This is where we take something that is sensitive data,

and we replace it with a token of that sensitive data.

For example, we can take a Social Security number, which

is relatively sensitive information,

change it into a completely different number.

But behind the scenes, we're matching those two together.

This means we can transfer the modified

number across the network.

And on the other side, it will make that switch

to what the actual number might be.

If someone did happen to capture information

containing that token, they would not

be able to use it for anything practical,

because it is not an actual Social Security number.

You may not realize it, but this is the same process

that's occurring when you pay for items at the store

with your mobile phone or your smartwatch.

There is a temporary token that is created from your credit

card number.

And that token is what's sent across the network.

This is a one-time use token, which

means if somebody does capture that token during the transfer

and then they try to use it again,

that token will be denied because it can only

be used once.

This means that we can transfer this data across the network

without needing to encrypt any of the data.

Since we've replaced the sensitive credit card

information with a one-use token,

we can send this information across the network

without needing to encrypt or hash any information.

If anyone got their hands on this data,

they wouldn't be able to do anything with it.

And since it doesn't have any mathematical relationship

back to your credit card number, it's completely safe

to send across the network.

Here's how this credit card tokenization process

works behind the scenes.

The first step is to register a credit card

number on our mobile phone.

When you perform that registration process,

it reaches out to a remote token service server

to register this credit card.

At that time, this server is going

to provide you with a series of tokens that will

be stored on your local phone.

Notice that the token is a very different number

than the actual credit card number

that we've registered on our phone.

In most cases, we usually don't see this token at all.

Although if you do look at a receipt,

you may notice that the receipt is showing a credit card

number that doesn't match the actual credit card number.

Now that we've received these tokens,

our phone is ready to be used during checkout.

So we'll go to a store.

And during the checkout process, we'll

use near-field communication to transfer that token

into the payment system.

So instead of sending our actual credit card number,

we are now paying with one of the tokens

that we originally received from the token service server.

The merchant then sends that token

to the token service server.

And it does a reverse lookup to determine

what the actual credit card number happens to be.

Now that this system knows the actual credit card number,

it can check to validate that you have the proper funds

or credit to be able to perform this transaction.

It validates the token and approves the transaction

for the merchant.

Now that this token has been used,

your phone is going to throw that token away.

It can no longer be used for any future transactions.

Your phone then readies the next token

that's in your list or it requests

a new token from the token service server.

And that's the token that will be

used for the next transaction.

When you get the receipt for your payment,

you may notice there's additional obfuscation that

is used on the receipt itself.

If you look at the credit card number on your receipt,

you'll usually see a string of asterisks and usually,

the last four digits of the credit card.

This is called data masking, where

we are hiding parts of the original number

and only showing you a portion of that number on the receipt.

This is obviously preventing someone

from gaining access to your receipts

and being able to use those credit card numbers to make

their own payments.

Obviously, the entire credit card number

is known by your credit card company.

But for the purposes of printing a receipt,

only a portion of that number is shown.

This type of data masking might also

be used for a customer service representative.

So if you call in to your credit card company,

they may tell you, we're looking at the credit card

with the last four digits of 2512.

To protect the security of the entire number,

it's not uncommon for companies to limit who

has access to that information.

And the person you're calling on the phone

may only be able to see a portion of your credit card

number.

There are a number of different ways to mask a number.

You don't have to use asterisks.

We could simply rearrange the numbers

or replace certain numbers with others that we could then

reverse later on.