On the Possibility of Malicious Obfuscation

We study a new variant of malicious obfuscation, where untrusted third-party obfuscation tools/platforms covertly insert master backdoor in software programs. We show that such malicious obfuscation could be hard to identify by the software developer who knows the original unobfuscated program. We demonstrate both undetectable and detectable malicious obfuscators for a number of obfuscation schemes in the theoretical literature, in particular conjunction obfuscation, compute-and-compare obfuscation, hamming-distance obfuscation, and point-function obfuscation.