Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security by obscurity is underrated

utkusen.com

Post reply on HN
Print view View original

151–160 of 530 posts

Re: Security by obscurity is underrated

#151

Post by Majromax »

daenz wrote: post #42

No mention of port knocking for SSH. I used to be scanned constantly for SSH logins. So I changed the port. The login attempts stopped for awhile, but eventually they found the port. Now with port knocking, I haven't seen a single attempt. Security by obscurity alone is bad, but as another layer, it can be great.

> Security by obscurity alone is bad, but as another layer, it can be great.

I beg to differ in your case.

Had you left SSH on its default port, what would your expected time-to-compromise be? Presumably you weren't using a root:password credential, or else your system would not have remained up enough long enough for you to implement any obscurity.

But if an attacker, with full ability to try logins, could not reasonably guess your login credential in the lifetime of the universe (i.e. public key SSH or a strong password), then you've not improved security by moving to a port-knocking model.

You have reduced nuisance, but nuisance isn't part of the standard threat model for SSH security.

To put it another way: you've not seen another unauthorized login attempt, but would you be comfortable relying on that and use root:password as your access credential?

Re: Security by obscurity is underrated

#152

Post by mcqueenjordan »

Verdex wrote: post #65
cataflam wrote: post #13

Agree with the article. People have been misinterpreting "security by obscurity is bad" to mean any obscurity and obfuscation is bad. Instead it was originally meant as "if your only security is obscurity, it's bad". Many serious real-world scenarios do use obscurity as an additional layer. If only because sometimes, you know that a dedicated attacker will be able to breach, what you are looking for is to delay them…

In nature, prey animals will sometimes jump when they spot a predator[1]. One of the explanations is that this is the animal communicating to the predator that it is a healthy prey animal that would be hard to catch and therefore the predator should choose to chase someone else. I think we can kind of view obscurity in the same way. It's a way to signal to a predator that we're a hard target and that they should give…

I think the predator/prey real world analog to "security through obscurity" would be camouflage.

Re: Security by obscurity is underrated

#153

Post by PragmaticPulp »

n0on3 wrote: post #58

It seems to me that the article is missing a few of points on what "security by obscurity" means. From Wikipedia: "reliance [...] on design or implementation secrecy as _ the main method _ of providing security [...]" So, to use the model mentioned in the article, a single slice of cheese. It's not "an additional layer of defense", it's the main one (so you have other... weaker layers? ¯\_(ツ)_/¯) Second, "reliance on…

This is actually the misunderstanding that the author is talking about:

People commonly misunderstand the concept and assume that obscurity is a bad practice in general, even when used as a secondary layer. It's not uncommon for junior engineers to object to any level of obfuscation or security because they can imagine a scenario where a sufficiently skilled attacker can defeat it, but that's missing the point. Slowing down your adversaries and weeding out the low-effort attacks is still valuable.

> So, sure, you can do non-standard stuff to make it harder for _some_ not discover your vulnerabilities (ssh non-standard port is actually a good thing given the massive amounts of bots around), but that should never be your only (or your main) layer of defense

That's exactly what the author says in the article. I don't see where the author is disagreeing with what you said.

I would go one step further and say that engineers commonly underestimate the volume of low-effort attacks that will pour in at scale. Some of these, such as brute-forcing or DDoS, can be disruptive to users unless you have perfect rate limiting (which you won't at first). Adding layers of obscurity before attackers can authenticate with and interact with core services can dramatically reduce the volume of these low-effort attacks. The skilled attackers tend to be more surgical.

Re: Security by obscurity is underrated

#154

Post by dylan604 »

acoard wrote: post #101
Verdex wrote: post #65

Earlier quoted context omitted.

In nature, prey animals will sometimes jump when they spot a predator[1]. One of the explanations is that this is the animal communicating to the predator that it is a healthy prey animal that would be hard to catch and therefore the predator should choose to chase someone else. I think we can kind of view obscurity in the same way. It's a way to signal to a predator that we're a hard target and that they should give…

>I think we can kind of view obscurity in the same way. It's a way to signal to a predator that we're a hard target and that they should give up. This has it completely backwards. Security through obscurity's goal is not to signal predators, it's the opposite. The goal is to obscure, to hide. The "signal" is there is nothing here (or nothing here worth your time). One of the best examples (it's in the article!) is ch…

In other words, changing the default SSH port number is similar to using camouflage. It just helps hide that something is there, but it does nothing to improve the defense once spotted. However, if the majority of predators don't see you, then the rest of your defenses are needed at that time.

Re: Security by obscurity is underrated

#155

Post by dfox »

saagarjha wrote: post #113
Verdex wrote: post #65

Earlier quoted context omitted.

In nature, prey animals will sometimes jump when they spot a predator[1]. One of the explanations is that this is the animal communicating to the predator that it is a healthy prey animal that would be hard to catch and therefore the predator should choose to chase someone else. I think we can kind of view obscurity in the same way. It's a way to signal to a predator that we're a hard target and that they should give…

Using obfuscation is often a signal that you are a weak target, because there are a lot of places that use obfuscation but nothing else. A better indicator that you are a hard target is to enable common mitigations like NX, stack cookies, or ASLR.

There is one giant hole in your argument: both stack cookies and ASLR are mitigations that are nothing more than automated security through obscurity in the first place.

Re: Security by obscurity is underrated

#156

Post by thinkharderdev »

c0nsumer wrote: post #146
cataflam wrote: post #13

Agree with the article. People have been misinterpreting "security by obscurity is bad" to mean any obscurity and obfuscation is bad. Instead it was originally meant as "if your only security is obscurity, it's bad". Many serious real-world scenarios do use obscurity as an additional layer. If only because sometimes, you know that a dedicated attacker will be able to breach, what you are looking for is to delay them…

For a very specific example, look at the classified ciphers used by the US Gov't TLAs. Why are they classified? Because if they are harder to get info about -- literally obscured -- then it's an additional layer of defense. Or troop movements during war... Sure, the locations can be figured out, but by not broadcasting locations that's more work for the enemy and thus a bit more secure. Obscurity is absolutely a key…

This is true but I think that its not really a binary classification and there is a spectrum from useless and trivial obscurity (base64 encoding some "secret") to actually useful obscurity. After all, you can call password authentication "security through obscurity" since you only need to know the correct sequence of characters and your security relies on that sequence remaining obscure.

Re: Security by obscurity is underrated

#157

Post by Aaronstotle »

I like the article overall and agree with the author. Only thing that stuck out to me was when he puts out the twitter poll which shows that a majority of people do scan the entire port range, it defeats the purpose of saying that most people stick to default scans.

Re: Security by obscurity is underrated

#158

Post by shadowgovt »

It has its place; the key thing to remember about it is it's not sustainable.

Security by, say, mathematically-hard problems stays secure even when the problem's design is understood. Security by obscurity breaks any time the secret gets out.

(There is an overlap point where a math problem is too simple to solve and, meanwhile, an obscure secret is "The sixteen digit number the President memorized to launch the nukes" where the security-by-obscurity can even beat out mathematically-secure, but the middle points of those two sets are separate and the reliability heavily tilted in favor of the mathematical cryptography).

Re: Security by obscurity is underrated

#159

Post by bosswipe »

bleepblorp wrote: post #120
acoard wrote: post #101

Earlier quoted context omitted.

>I think we can kind of view obscurity in the same way. It's a way to signal to a predator that we're a hard target and that they should give up. This has it completely backwards. Security through obscurity's goal is not to signal predators, it's the opposite. The goal is to obscure, to hide. The "signal" is there is nothing here (or nothing here worth your time). One of the best examples (it's in the article!) is ch…

Using a non-standard SSH port is a bad example because nmap can see through that deception in a few seconds. Any attacker who is looking for more than just the lowest of low-hanging fruit will not be even slightly deterred. A better example would be a port-knocking arrangement that hides sshd except from systems that probe a sequence of ports in a specific way. This is very much security by obscurity, because it's tr…

Changing the ssh port would still fall under security through obscurity whether its effective or not.

Re: Security by obscurity is underrated

#160

Post by JshWright »

4ad wrote: post #104
JshWright wrote: post #19

There is a reason the military doesn't paint their tanks bright pink... Armor is important, but if you don't get shot at in the first place, even better.

Security by obscurity is not painting tanks in camo. Security by obscurity is assuming your enemy won't find your tanks because you didn't broadcast on public radio where your tanks are.

That is another appropriate analogy (and it's why the military invests in SIGINT).

To the point though, no one should "assume the tanks won't be found", but it's still worthwhile to do things to make it less likely they will be found.

Post reply on HN