141–150 of 530 posts
A defense mechanism that only partially mitigates an attack vector could be considered 'security through obscurity' if deployed on its own, but that same mechanism could be considered 'defense in depth' if deployed alongside other defense layers as part of a more comprehensive security model.
Earlier quoted context omitted.
You seem to be thinking in terms of security mechanisms either perfectly blocking attacks or being useless. That's the wrong model. It's about costs. Obfuscating otherwise-open code doesn't mean that nobody can ever figure out what it does, but it raises their costs. Randomizing variables raises costs. Encrypting the DB raises costs on an amortized basis (some cracks may get the key and then it may not raise the cost…
> You seem to be thinking in terms of security mechanisms either perfectly blocking attacks or being useless. That's the wrong model. It's about costs. This is something that bothered me quite a bit in Bruce Schneier's various comments on airline security. He repeatedly wrote that profiling young Arab men as likely terrorists was pointless, because if it became harder for young Arab men to get through security, terro…
Focusing most of the security effort on Arabs is a good way to fight the war of 19 years ago, but it leaves the air travel system vulnerable to upstart terrorist movements that see the lack of universal security as an exploitable vulnerability.
For example, there's nothing to say that America's right wing terrorist groups won't decide to switch from shootings and vehicle ramming attacks to attacks on air travel. The TSA ought to be prepared for this, or any other, emerging threat.
Agree with the article. People have been misinterpreting "security by obscurity is bad" to mean any obscurity and obfuscation is bad. Instead it was originally meant as "if your only security is obscurity, it's bad". Many serious real-world scenarios do use obscurity as an additional layer. If only because sometimes, you know that a dedicated attacker will be able to breach, what you are looking for is to delay them…
Both reductions lose practical utility by omitting nuance.
* Avoid wasting your time doing performance optimization until tuning is necessary. But definitely take obvious and easy measures to ensure your software is fast, such as choosing a high-performance language or framework with which you can be productive.
* Don't exclusively rely on obscurity. But definitely take obvious and easy measures that leverage obscurity to add another layer of defense, such as changing default ports, port-knocking, or whatever.
To use the same art of reduction to counter the common interpretation: A complex password is, in a manner of thinking, security from obscurity. Your highly complex password is very obscure, hence it's better than a common (low obscurity) password from a dictionary.
Earlier quoted context omitted.
In nature, prey animals will sometimes jump when they spot a predator[1]. One of the explanations is that this is the animal communicating to the predator that it is a healthy prey animal that would be hard to catch and therefore the predator should choose to chase someone else. I think we can kind of view obscurity in the same way. It's a way to signal to a predator that we're a hard target and that they should give…
Using obfuscation is often a signal that you are a weak target, because there are a lot of places that use obfuscation but nothing else. A better indicator that you are a hard target is to enable common mitigations like NX, stack cookies, or ASLR.
However, the psychological warfare video does make me think that there's still a place for obscurity after you've already used actual security measures. If you can find any technique that makes your attacker work harder vs some other target, then it feels like there's an economic value to doing it as long as the cost to you is relatively low.
Earlier quoted context omitted.
But the examples given won't help and is just bad advice in general. - Assume for every code obfuscator there's a deobfuscator or at least someone as clever as you out there. - Randomizing variable names it just a nuisance, it won't stop any competent pen tester or attacker. - Encrypting the database is an odd one. Your program will also have to decrypt the data to use it. Where do you store the encryption keys? In y…
You seem to be thinking in terms of security mechanisms either perfectly blocking attacks or being useless. That's the wrong model. It's about costs. Obfuscating otherwise-open code doesn't mean that nobody can ever figure out what it does, but it raises their costs. Randomizing variables raises costs. Encrypting the DB raises costs on an amortized basis (some cracks may get the key and then it may not raise the cost…
Ours is an industry with a lot of people "on the spectrum".
https://thesilentwaveblog.wordpress.com/2017/03/08/aspergers...
Agree with the article. People have been misinterpreting "security by obscurity is bad" to mean any obscurity and obfuscation is bad. Instead it was originally meant as "if your only security is obscurity, it's bad". Many serious real-world scenarios do use obscurity as an additional layer. If only because sometimes, you know that a dedicated attacker will be able to breach, what you are looking for is to delay them…
Or troop movements during war... Sure, the locations can be figured out, but by not broadcasting locations that's more work for the enemy and thus a bit more secure.
Obscurity is absolutely a key piece of security, because it adds the complexity of discovery.
Arguably, most security is security through obscurity. No password -> simple password -> complex password Plaintext -> Caesar cypher -> Vernier cypher -> modern cyphers 40-bit crypto -> 56-bit crypto -> 128-bit crypto -> 256-bit crypto 0.0.0.0 network allow-list -> /24 network allow-list -> /32 (per host) network allow-list allow by default -> deny by default standard port -> non-standard port We just add layers of o…
In DC there is this concept of "the blob" which is basically shorthand for "The Washington consensus that isn't verifiable, but that most people parrot since to hold an opposing view doesn't really get you anything because even if you're right, nobody will remember. All that they'll remember is that you're that weird guy that looks at stuff with a strange perspective and that you may be too dense to social signal tha…
> But then we all implement passwords (which is just security by obscurity) No it isn't. Security by obscurity is explicitly keeping things other than passwords and keys secret.
Earlier quoted context omitted.
>I think we can kind of view obscurity in the same way. It's a way to signal to a predator that we're a hard target and that they should give up. This has it completely backwards. Security through obscurity's goal is not to signal predators, it's the opposite. The goal is to obscure, to hide. The "signal" is there is nothing here (or nothing here worth your time). One of the best examples (it's in the article!) is ch…
Using a non-standard SSH port is a bad example because nmap can see through that deception in a few seconds. Any attacker who is looking for more than just the lowest of low-hanging fruit will not be even slightly deterred. A better example would be a port-knocking arrangement that hides sshd except from systems that probe a sequence of ports in a specific way. This is very much security by obscurity, because it's tr…
We'll look at the SSH port example.
What does changing the port get you? You no longer get hit by the automated sweeping that hits basically all internet accessible IPs. Cool! So you had root/password or root/apple or whatever, you were going to get owned by the automated scans, good, you're now more secure. But you shouldn't have been using a weak password to begin with, and now there is a very real risk that you think you are more secure than you were previously.
He compares this to animals that have natural camouflage, or the President switching cars in his convoy. But there's no guarantee that you will see an owl in a tree, or be able to determine which car the President is in. But you can scan every port on an IP and find sshd listening with fingerprinting. The cost there is basically zero for someone that wants to attack you. If all I had to do was wait a few seconds longer to make sure I saw an owl or know what car the President is in, then they would not be effective either. You cannot compare situations where there are specific limitations and use them as proof positive for a situation where those limitations don't exist.
And this is important: His recommendation to run sshd on 64323 is also just actively making you LESS secure. Ports under 1024 are privileged on Linux - you must have superuser privileges or otherwise be granted access to bind to these ports. No such protections exist for 64323. Now, let's say you have a user level compromise on that server - they start a process monitoring to see if sshd ever restarts/crashes/otherwise stops listening on the port it was listening on, and as soon as it does, they start their own malicious sshd replacement. Now all it takes is someone ignoring the host key mismatch to give away their credentials, which the attack can then likely use to penetrate further into your environment.
The author doesn't fully understand the add on effects of his suggestion here, and as a result one of his security by obscurity tips makes you less secure to a focused attacker. Meanwhile, if you REALLY wanted to secure SSH you do not make it listen on internet accessible IPs, and only have it available when you VPN in and access it via a jumphost while using key based auth with 2FA on top of it.
When you start obfuscating your code, using random variable names, and generally making it harder to read, how much more likely are you to introduce bugs than you would with a clean code base? Are human introduced bugs more likely to be a security risk than variable names being random? Than code being obfuscated?
I don't disagree with encrypting the database, but I also don't consider encryption or password/key protecting something security by obscurity.
Basically: Obscuring things helps prevent you from low effort attackers that should not be scary to you to begin with. They do nothing to minimal amounts to protect you from dedicated attackers, and potentially introduce new risks that allow easier access from dedicated attackers. The sort of security measures you should be implementing to stop dedicated attackers will already eliminate the risk from the low effort attackers.
NONE of the arguments in this article are new, and they have all been argued against quite extensively in the past.