New JavaScript Obfuscation Technique Rewrites Logic via Formatting Tools
Research reveals 186 techniques across 37+ processors that alter script behavior when formatted or minified, affecting tools like Chromium DevTools and Terser.
Key points
- distinct techniques identified across more than 37 JavaScript processors.
- Common tools like Chromium DevTools, Prettier, and WebCrack can alter script logic.
- A demonstration showed a Tetris script transforming into Snake after processing.
Researchers have identified a new class of web obfuscation techniques that allow JavaScript scripts to change their fundamental logic when processed by standard formatting or minification tools. According to a report shared on the r/netsec forum, these methods enable a single script to behave differently after being run through deobfuscators or code formatters.
The findings, submitted by user /u/trustsigRobert, detail 186 specific techniques that exploit how parsers interpret code. These techniques affect more than 37 different JavaScript processors. The report indicates that even basic formatting changes can rewrite the underlying logic of a script, turning one program into another entirely different execution path.
Scope of Affected Tools
The research highlights vulnerabilities in widely used development and analysis tools. The list of affected processors includes Chromium DevTools, Prettier, WebCrack, and Terser. These tools are commonly used by developers for code readability and by security analysts for examining potentially malicious scripts.
The implication is that the output of these tools cannot be assumed to match the input in terms of logical behavior. When a script is processed by these applications, the resulting code may execute differently than the original source intended or displayed.
Demonstration and Impact
To illustrate the potential impact of these techniques, the researcher provided a demonstration involving a Tetris script. After the script was processed by certain formatters, it transformed into a Snake game. This example serves to show how drastically the functionality of a script can change without altering the apparent structure in a way that might be immediately obvious to a casual observer.
The report does not specify whether these techniques are currently being used in active attacks against end-users. Instead, it focuses on the technical capability of these obfuscation methods to manipulate code behavior through standard processing steps.
What should you do?
What to do and how to stay safe
- Hardware-backed key storage prevents attackers from extracting credentials even if they gain physical access to the device.
- Mobile device management enforces consistent security policies across diverse operating systems and hardware configurations.
- Application sandboxing limits the damage a compromised app can cause by restricting its access to other data and system resources.
Mobile device security requires a layered approach combining hardware, software, and policy controls. Enable encryption, use strong passcodes, and keep your operating system updated to protect your data.
Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
