Editing Security Through Obscurity

[[Category:Common terms]]
Security through Obscurity is a practice where companies obfuscate or hide the logic behind their product to supposedly enhance their security.

== Obscurity Cannot Improve Security ==
Obscurity in practice is intentionally changing the appearance of something such that it becomes difficult to understand without changing its end function. Obscurity is commonly used in the software development as it can be done automatically but it is possible for obscurity to be implemented in hardware as well. There are many ways that companies go about doing this:

# Software Refactoring: companies may refactor computer code in production by renaming values from human intelligible to machine intellgible. As an example the function "sendKey()" may be renamed to "f_019278()" throughout the entire codebase. This does not truly promote security because any person can reverse-engineer what the code does and come up with their own naming schemes for the renamed values. A prime example of this is Minecraft whose source code is refactored in production. Minecraft's code refactoring has been bypassed years ago and projects such as the [https://docs.spongepowered.org/5.1.0/en/plugin/internals/mcp.html Minecraft Coder Pack] provide environments where intelligible code is viewable.
# Software Obfuscation: companies may obfuscate computer code by changing the instructions. This may include adding instructions that do meaningless actions or replacing actual instructions with more complicated ones. The end result of obfuscation is always such that the end functionality of the program is unchanged even though the steps are different and possibly unintelligible. This can also involve adding decoy code that has no purpose at all and merely exists to slow reverse-engineering.
# Software Encryption: companies may provide software in an encrypted format that must be decrypted before running.  A problem to this form of obscurity is that the consumer will need a key to decrypt the program and run it so a reverse-engineer could obtain this key and read the program.
# Physical Refactoring: companies may remove identifying information from physical components or change component appearance. Notably in the [[Tom Evans Audio Copyright Strike]] identifying numbers were scraped from nearly all components to make repair more difficult. [https://www.youtube.com/@MendItMark Mend it Mark] was able to reverse engineer the entire product regardless.
# Confidential Schematics: companies, like [[Apple]] may keep schematics confidential. This will never stop someone with enough time and resources from reverse engineering a product and creating schematics of their own.
# Physical Obfuscation: companies can design physical products such that they have the same functionality but are unintelligible. As an example, consider a set of scissors that can only be moved by a giant [[wikipedia:Rube_Goldberg_machine|Rube Goldberg Machine]]. The scissors still cut paper but the steps taken to cut the paper is ridiculously overcomplicated.

Ultimately, vulnerabilities will exist in functionality regardless of how a product's appearance is changed. Obscuring product information merely increases the amount of time it will take to reverse-engineer a product and does not actually provide any benefit to security.

== Relation to Consumer Rights ==
Sometimes, companies choose to withhold details about their products in the name of "security".  In the process, consumer rights are often taken away. These decisions make diagnosing problems more difficult and repair more challenging. In addition, consumers lose the ability to confirm that their product functions exactly as expected rather than in unexpected and potentially malicious ways. These decisions can take away consumer control over the product they bought and paid for after the security through obscurity is implemented. Moreover, since this practice only obfuscates or attempts to conceal, instead of actually implementing proper security, the workings of the device are often reverse-engineered in a short time. See: [[Reverse Engineering Bambu Connect]]

== List of Security Through Obscurity Instances ==

* [[Bambu Lab Authorization Control System]] (Encryption and patching through [https://github.com/sleeyax/asarmor asarmor])
* [[Tom Evans Audio Copyright Strike]] (Physical Refactoring, Confidential Schematics)