Cryptography and Network Security Basics Every Beginner Should Know

Blacked-out text in a PDF can be uncovered when redaction is applied as a visual overlay rather than true data deletion. Selecting the covered area and copying it, or running the file through a PDF parser, reveals the original text in full. Proper redaction permanently destroys the underlying data layer — a visual black box does not.

• Key Takeaway 1: The four pillars of information security are confidentiality, integrity, authentication and non-repudiation. Every cryptographic tool maps to at least one of them.
• Key Takeaway 2: Hashing is one-way; encryption is two-way. MD5 is broken for security use. SHA-256 is the current safe default for integrity checks.
• Key Takeaway 3: A digital signature uses asymmetric cryptography to prove who signed a document and that the document has not changed since signing.
• Key Takeaway 4: Fake redaction (drawing a black box over text) is one of the most common and embarrassing security failures in legal and government documents.
• Key Takeaway 5: Steganography hides a message inside an innocent-looking file. It is not encryption, but it is a real technique used by both attackers and researchers.

How to Uncover Blacked Out Text: Why It Works and How to Stop It

Understanding how to uncover blacked out text starts with understanding what redaction actually is. When a PDF editor draws a black rectangle over sensitive content, it creates a visual layer on top of the existing text. The text data remains in the file structure underneath. Anyone who knows how to uncover blacked out text can select that region, copy it, and paste it into a plain text editor. The original content appears in full.

In 2019, a US federal court filing related to Paul Manafort was released with exactly this flaw. Journalists copied the blacked-out sections and pasted them into a text editor. The text appeared immediately. The same failure occurs in Microsoft Word when tracked changes or comments contain the original content but the document is shared without accepting all changes and stripping metadata.

Proper tools for how to read blacked out text that has been correctly redacted will return nothing, because the data no longer exists in the file. Adobe Acrobat’s built-in Redact feature, and enterprise tools like Relativity and Nuix, permanently remove the underlying data rather than covering it. The output is a flattened, text-stripped version of the document. If you work in compliance, legal or a Security Operations Centre, understanding the difference between visual masking and true redaction is basic operational hygiene.

Step-by-Step: How to Uncover Blacked Out Text in a Poorly Redacted PDF

1. Open the PDF in any standard PDF reader such as Adobe Acrobat Reader or a browser-based viewer.
2. Use your cursor to click and drag across the blacked-out region as if selecting text.
3. Copy the selection using Ctrl+C (Windows) or Cmd+C (Mac).
4. Paste into a plain text editor such as Notepad or TextEdit.
5. If text appears, the redaction was applied as a visual overlay only. The document was not properly sanitised.
6. Alternatively, run the PDF through a parser tool such as pdftotext (Linux/Mac) or use Python’s PyPDF2 library to extract all text layers programmatically.

This process is why knowing how to uncover blacked out text is not a hacking skill. It requires no special tools and no technical expertise when the redaction was done incorrectly. It is a document handling failure, not a software vulnerability.

The Four Pillars: What Cryptography Is Actually Trying to Do

Cryptography is a structured set of tools designed to protect information across four properties: confidentiality, integrity, authentication and non-repudiation. Get comfortable with these four words and the rest of the subject clicks into place.

Confidentiality means only the intended recipient can read the data. Encryption handles this. Integrity means the data has not been altered in transit. Hashing handles this. Authentication confirms you are who you say you are. Digital signatures and certificates handle this. Non-repudiation means you cannot deny having sent or signed something once you have done it. This is where PKI (Public Key Infrastructure) becomes essential.

Hashing vs Encryption: Not the Same Thing

A hash function takes an input of any size and produces a fixed-length output. You cannot reverse it. Run “hello” through SHA-256 and you get a 64-character hex string every single time. Change one letter and the hash changes completely. That is what makes hashing ideal for integrity verification.

Encryption, unlike hashing, is designed to be reversed. You encrypt with a key, and the recipient decrypts with a key. AES-256 is the current standard for symmetric encryption. RSA is common for asymmetric encryption where a public key encrypts and a private key decrypts.

MD5 was once the standard hashing algorithm. It is now considered cryptographically broken. Researchers demonstrated MD5 collision attacks as far back as 2004, and by 2008 attackers had forged SSL certificates using MD5 weaknesses. According to NIST’s official algorithm deprecation guidance, MD5 and SHA-1 are both formally deprecated for all security applications as of 2023. If you are still using MD5 for anything security-related, stop. Use SHA-256 or SHA-3.

Cryptanalysis: Breaking What Others Built

Cryptanalysis is the study of how to break cryptographic systems. It is mathematical analysis of weaknesses in algorithms, key management or implementation. Differential cryptanalysis, linear cryptanalysis and side-channel attacks are all real cryptanalysis techniques.

Understanding cryptanalysis is part of what makes a good ethical hacker effective. You cannot defend a system you do not understand how to break.

Digital Signatures, Certificates and the Redaction Problem

A digital signature is created by hashing a document and then encrypting that hash with the sender’s private key. The recipient decrypts the hash using the sender’s public key and compares it to a fresh hash of the received document. If both hashes match, the document is intact and genuinely came from that sender. If they do not match, something changed.

To verify a digital signature in a PDF, open the document in Adobe Acrobat Reader, click the signature panel, and check the certificate chain. Windows users can also view trusted certificates through Certificate Manager (run certmgr.msc from the command prompt). India’s Controller of Certifying Authorities (CCA) issues licensed digital signature certificates under the IT Act 2000, and Indian courts accept digitally signed documents as legally valid.

The connection between digital signatures and how to uncover blacked out text is direct: a properly signed and redacted document will show signature invalidation if anyone tampers with the file after signing. This is one layer of protection that proper document workflows use to detect post-signing alterations.

Password Management and Protecting Storage Devices

Password management in cryptography is about storing credentials as salted hashes so that even if a database is breached, the original passwords are not exposed. Bcrypt, scrypt and Argon2 are the recommended algorithms for password hashing because they are deliberately slow, making brute-force attacks expensive.

For physical storage, Windows BitLocker encrypts entire drives including USB pendrives. On Android, you can use apps like DiskDecipher or third-party encrypted containers such as VeraCrypt volumes to protect a pendrive connected via OTG. Setting a password for a pendrive without third-party software on Windows requires BitLocker To Go, available in Windows 10 and 11 Pro editions.

Steganography, Surveillance Awareness and Logs

Steganography hides data inside ordinary-looking files. An image file, an audio clip, even a video can contain a hidden message without any visible sign. The cover file looks completely normal. Tools like Steghide, OpenStego and DeepSound are commonly used in CTF (Capture the Flag) challenges and in real-world covert communication research.

Unlike encryption, which makes data unreadable, steganography makes data invisible. You do not know there is a message to find. Combining both techniques, encrypting a message and then hiding it with steganography, gives you both secrecy and concealment.

When Your Webcam Light Is On

If your webcam light is on unexpectedly, it is a genuine warning sign. Most modern laptops sold in India by Dell, HP and Lenovo wire the camera LED directly to the camera hardware circuit, so software alone cannot activate the camera without triggering the light. That said, some older models and cheap webcams do not have hardware-enforced LEDs.

A 2014 research paper by Brocker and Checkoway at Johns Hopkins University demonstrated that MacBook cameras from 2008-era models could be activated without triggering the LED by reprogramming the camera’s iSight firmware controller. The researchers confirmed the attack required no kernel-level access. Newer Apple models addressed this with hardware-enforced LED circuits. An unexplained active webcam light is a reason to check your running processes, review your installed applications and run a malware scan immediately.

Logs in cyber security are your audit trail. Windows Event Logs, Linux syslog and application logs record who accessed what and when. A cybersecurity analyst reviewing logs can often spot the exact moment a system was compromised. Log integrity is also a non-repudiation mechanism: tamper-evident logs prove what happened and who did it.

NetBIOS, Ports and Checking Remote Computers

NetBIOS runs on port 137 (UDP/TCP), 138 (UDP) and 139 (TCP). It is a legacy protocol that allows computers on a LAN to share names and services. To check whether a remote computer is reachable and what services it is exposing, tools like nmap, ping and nbtstat are standard. Running nbtstat -A [IP address] on Windows queries the NetBIOS name table of a remote machine.

Understanding which ports are open on a network is foundational to both offensive security and defensive monitoring. If you are building skills toward a career as a SOC analyst, port and protocol knowledge is non-negotiable.

Frequently Asked Questions

How do you uncover blacked out text in a PDF?

To uncover blacked out text in a poorly redacted PDF, click and drag your cursor across the blacked-out area to select it, then copy and paste into a plain text editor. If the text appears, the redaction was applied as a visual overlay only. You can also use command-line tools like pdftotext or Python’s PyPDF2 library to extract all text layers from the file programmatically. Properly redacted documents will return nothing because the data has been permanently deleted.

Is it illegal to uncover blacked out text in a document?

It depends on the document and jurisdiction. If a document was publicly released with a redaction failure, reading the visible content is generally not illegal. However, deliberately circumventing redaction on confidential government, legal or medical documents to access protected information may violate laws including India’s IT Act 2000, the Official Secrets Act or US federal statutes. Always consider the legal context before attempting to read blacked out text in sensitive documents.

What tools are used for proper PDF redaction?

Proper PDF redaction tools include Adobe Acrobat Pro’s built-in Redact feature, Relativity, Nuix and open-source tools like ExifTool for metadata stripping. These tools permanently remove the underlying text data and flatten the document so no text layer remains. Simply drawing a black box using a PDF annotation tool does not constitute proper redaction and leaves the original data recoverable.

What does non-repudiation mean in security?

Non-repudiation means a party cannot deny having performed an action, typically sending a message or signing a document. It is enforced through digital signatures and audit logs. If you sign a PDF with your private key, the signature proves it was you. You cannot later claim you did not sign it. It is a core principle in legal and financial systems.

How does a digital signature actually verify a document?

The sender hashes the document and encrypts that hash with their private key. The recipient decrypts the hash using the sender’s public key, then hashes the received document independently. If both hashes match, the document is authentic and unaltered. If they differ, the document was changed after signing. This process is what lets you verify a digital signature in a PDF reliably.

How is hashing different from encryption?

Hashing is a one-way process. You cannot reverse a hash to get the original input. Encryption is two-way: you encrypt data with a key and decrypt it with a key. Hashing is used for integrity checks and password storage. Encryption is used for confidentiality. MD5 and SHA-256 are hash functions. AES and RSA are encryption algorithms. They solve different problems.

What is steganography used for?

Steganography hides secret data inside ordinary files like images, audio or video without changing how those files look or sound to a normal viewer. It is used in digital watermarking, covert communication research and CTF security challenges. Attackers have also used it to hide malware payloads inside image files. It is a real threat vector that security teams monitor for in network traffic.

If you are serious about building a career in this field, the path is clearer than it looks. Start with the fundamentals covered here, get hands-on with tools like Wireshark, OpenSSL and Nmap, and then stack a recognised certification on top. The Certified Ethical Hacker v13 is one of the most respected entry-to-mid-level credentials globally, and it directly tests your understanding of cryptography, network security and attack techniques.

Salaries in this space reflect the demand. According to AmbitionBox data for India in 2024, cybersecurity professionals with 2-5 years of experience earn between Rs 6 lakh and Rs 18 lakh per annum depending on specialisation and location. The factors influencing cybersecurity salaries in India include certifications, domain specialisation and the type of employer.

The global picture is equally compelling. The (ISC)2 Cybersecurity Workforce Study 2023 estimated a global workforce gap of 4 million cybersecurity professionals. India is one of the fastest-growing markets for security talent, and demand is outpacing supply significantly. NASSCOM’s 2023 technology sector report identified cybersecurity as one of the top three skill shortage areas across Indian IT employers, with demand growing at over 30% year-on-year.

Your practical next steps this week: open a PDF you have received and check its digital signature panel. Run certmgr.msc on Windows to explore your certificate store. Download a sample steganography challenge from a CTF platform like PicoCTF. Try hashing a file using certutil -hashfile filename SHA256 on Windows or sha256sum filename on Linux. These are the exact tasks a real analyst performs.

3.0 University offers online certification programmes in cybersecurity courses, ethical hacking, AI, Blockchain and Web3, built for students, working professionals and career switchers across India. The curriculum is practical, the instructors are industry practitioners, and the credentials are recognised by employers. If you are ready to move from reading about security to actually practising it, explore what 3.0 University has available and take the next step this week.

Last updated: June 2025. Reviewed by the 3University editorial team.