Obfuscation Flashcards

Making data difficult to understand or detect — hiding it, replacing it with meaningless substitutes, or showing only partial information. Unlike encryption, the goal is invisibility or substitution rather than mathematical unreadability.

Hiding secret data within ordinary carrier data (images, audio, video, network traffic) so that the existence of the hidden message is concealed. The carrier looks completely normal. Unlike encryption, it hides that anything is hidden at all.

Replaces the least significant bit of each pixel's color value with a bit from the hidden message. Changing a pixel from 200 to 201 is imperceptible to human eyes. A 10 MP image can hide ~1 MB of data this way, completely invisibly.

The ordinary file used to conceal hidden data. Common carriers: JPEG/PNG images, MP3/WAV audio, video files, PDF documents. The carrier appears and functions completely normally — its hidden payload is invisible to ordinary viewers.

Replacing a sensitive value with a random token that has no mathematical relationship to the original. The mapping is stored only in a token vault. Used for credit cards (PCI-DSS scope reduction), SSNs, and session authentication. Cannot be reversed by algorithm — only the vault knows the mapping.

The secure system storing the mapping between tokens and original values. The only way to recover the original from a token. If the vault is compromised, all tokenized data is exposed. Protecting the vault is the critical security requirement in tokenization.

By ensuring real card numbers never enter the merchant's systems — only tokens do. Systems that don't process real card numbers fall out of PCI-DSS scope. The payment processor's token vault is in scope; the merchant's database is not. Dramatically reduces the compliance burden.

Modifying data presentation to hide part of it while keeping it recognizable. Examples: showing only the last four digits of a card number (**** **** **** 4242), replacing characters with asterisks, or year-only birth dates. The underlying data may be unchanged — the view is limited.

Creating a persistent copy of a database with sensitive values permanently replaced. The copy has no real PII and can be given to dev/test teams. The original database is unmodified. Used to create safe dev and test environments from production data structures.

Applying masking in real-time at query time based on user role — the original data is unchanged, but different users see different amounts. A call center agent sees last four digits; the billing system sees the full number. Role-based visibility without modifying stored data.

Encryption uses an algorithm + key to transform data (reversible with the key). Tokenization replaces data with a random token — no algorithm, no key. Reversal requires the vault, not a key. If a key is stolen, encrypted data is exposed. If a token is stolen, the vault must also be compromised.

An invisible steganographic marker embedded in a document or file identifying its origin or authorized recipient. Survives copying and printing. Used to track which authorized copy of a document was leaked. Not protecting access to the content — tracking the source of unauthorized distribution.

Hiding data in network protocol fields — unused TCP header bits, DNS query subdomains, ICMP payloads, HTTP headers. Used by malware for covert C2 channels that blend with normal traffic. Defeats content-based inspection; detected by protocol analysis looking for statistical anomalies.

DLP systems typically scan file content for sensitive keywords, patterns, and file signatures. A JPEG image with hidden text embedded in LSBs passes all content checks — it looks like an ordinary image. The hidden data triggers no keyword matches. Advanced DLP includes steganalysis, but basic DLP is blind to steganographic content.

A tokenization variant where the token has the same format as the original. A 16-digit credit card number tokenizes to a different 16-digit number that passes format validation. Allows legacy systems to accept tokens without modification, since the token looks structurally identical to a valid card number.

Tokenization: completely replaces the value with an opaque random token — the original is in the vault, not recognizable from the token. Data masking: shows partial data — still recognizable as the same type (last four digits of a card still looks like a card). Masking = visible partial; Tokenization = complete replacement.