Moving sshd to a non-standard port is certainly a good example. If only because it turns down the log noise. So that an "unauthorized connection" stands out.
Security by obscurity is underrated
11–20 of 530 posts
Re: Security by obscurity is underrated
#12I think that most initially looked down on the security through obscurity layer as flawed only because many people, a few years ago, thought that this is the only layer they needed. Somehow over time many people began to think that this layer is not useful at all. A little bit of thinking about the issue would absolve one of the approach to completely exclude that layer.
Also it is so easy and cheap to implement is another reason to discard it because in many organizations today people think that security can only be had by spending boatloads of money on people and software. Surely a simple, fast and cheap solution can't really reduce risk now can it?
And then on top of those things people do not think about, nor fully understand risk, hence the whole Covid 19 scare and the many other things in the world people are afraid of.
Re: Security by obscurity is underrated
#13Agree with the article.
People have been misinterpreting "security by obscurity is bad" to mean any obscurity and obfuscation is bad. Instead it was originally meant as "if your only security is obscurity, it's bad".
Many serious real-world scenarios do use obscurity as an additional layer. If only because sometimes, you know that a dedicated attacker will be able to breach, what you are looking for is to delay them as much as possible, and make a successful attack take enough time that it's not relevant anymore when it's broken.
Re: Security by obscurity is underrated
#14I'm surprised port knocking never really caught on. Does anyone know of it being used in production anywhere?
I'm guess because VPN's and SSH became so ubiquitous? Having a single point of entry, especially when combined with 2FA, is probably good enough for most situations.
Re: Security by obscurity is underrated
#15In DC there is this concept of "the blob" which is basically shorthand for "The Washington consensus that isn't verifiable, but that most people parrot since to hold an opposing view doesn't really get you anything because even if you're right, nobody will remember. All that they'll remember is that you're that weird guy that looks at stuff with a strange perspective and that you may be too dense to social signal that you're in the blob."
I've noticed the same thing with software developers.
- "Client side encryption in JavaScript is useless!" Until CloudBleed came out and the only company that was safe was a password manager that used it. To thwart client side encryption you need to actually modify the contents of the JS payload, which is detectable. But no matter how much evidence I give that this tactic works and is actually used in production and that it actually stops attacks, programmers just don't care.
- "Don't do security by obscurity!" But then we all implement passwords (which is just security by obscurity) and the best people in intelligence don't have LinkedIn accounts. Anyone can join an OSINT forum and see the actual tools that get used. Security by obscurity works for many, many actors.
There are many, many little bits of stuff like this. Think to yourself: How many times has code that you've written lead to an RCE vuln that was exploited. Personally, I can only give a lower bound, and that lower bound is zero because I'm extremely careful, but I don't pretend that it's never happened. Anyone that is familiar with data science or economics or political economy understands that when a signal is dampened the response is dampened.
Re: Security by obscurity is underrated
#16I had a Mac SE with an ethernet card in 2001, around when Red Worm was loose. We put an HTTPd server on it, and watched as each RedWorm attempt came in. This ancient super slow machine not only stayed completely safe despite being on Mac OS 7.5 or something around there, while Windows machines of current vintage were being taken apart around the world. Added bonus, the slow speed of the SE meant it took about 10 time…
In case anyone else is confused at first, I'm assuming you meant
s/Red Worm/Code Red/gRe: Security by obscurity is underrated
#17Ultimately if governments (such as Australia, US) continue to prevent citizens from using encryption, we will have no choice but to employ security-by-obscurity atop secure-by-design principles to have privacy.
For example, making ciphertext look like cleartext[1], or hiding text in images[2].
Re: Security by obscurity is underrated
#18Obscurity has been used for detection of bots engaged in profitable ad fraud, by having web clients execute a JS payload whose behavior can be profiled. Temporary payload obscurity enables a silent alarm, which can be used to stop financial payouts.
Unlike many approaches to cybercrime defense, obscurity-enhanced bot detection has lead to both prosecution and extradition of accused attackers, https://www.cyberscoop.com/tag/methbot/
White Ops technical talk at PSEC18, https://youtube.com/watch?v=Aqdn09myGlM
Re: Security by obscurity is underrated
#19There is a reason the military doesn't paint their tanks bright pink... Armor is important, but if you don't get shot at in the first place, even better.
Re: Security by obscurity is underrated
#20I'm surprised port knocking never really caught on. Does anyone know of it being used in production anywhere?
It's generally more convoluted than the equivalent alternatives, with less features. You need a shared secret - you could use totp - or you could use vpn/ssh with key based auth - both offer authentication of/to both sides and encryption/confidentiality.
Blocking all icmp traffic breaks tcp - so true "invisibility" isn't that grät either.