Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security by obscurity is underrated

utkusen.com

Post reply on HN
Print view View original

231–240 of 530 posts

Re: Security by obscurity is underrated

#231

Post by robocat »

Verdex wrote: post #65
cataflam wrote: post #13

Agree with the article. People have been misinterpreting "security by obscurity is bad" to mean any obscurity and obfuscation is bad. Instead it was originally meant as "if your only security is obscurity, it's bad". Many serious real-world scenarios do use obscurity as an additional layer. If only because sometimes, you know that a dedicated attacker will be able to breach, what you are looking for is to delay them…

In nature, prey animals will sometimes jump when they spot a predator[1]. One of the explanations is that this is the animal communicating to the predator that it is a healthy prey animal that would be hard to catch and therefore the predator should choose to chase someone else. I think we can kind of view obscurity in the same way. It's a way to signal to a predator that we're a hard target and that they should give…

Your example is advertising which is the opposite of security through obscurity.

Obscurity is another layer of hiding or indirection: like the owl has camouflage and it has a hole in a tree.

Advertising your fitness (your stotting metaphor) is effective when: you are part of a herd, and the attacker will only attack the weakest in that herd and then be satisfied. Like double locking your bike next to a similar bike that has a weaker lock.

Computer security is different because usually either:

a) everyone in the herd is being attacked at once (scattergun/IP address range scanning), or

b) you are being spear targeted individually (stotting won’t work against a human hunter with a gun, and advertising yourself won’t help against a directed attack).

An example of advertising your security might be Google project zero, or bug bounties.

Re: Security by obscurity is underrated

#232

Post by riquito »

It's like a painting in front of a safe:

- doesn't reduce the security of the safe

- ensure you don't advertise "THERE'S A SAFE HERE" to whoever visit your house, possibly reducing burglar attempts

Now, if you have just the painting over a hole in the wall, you got something wrong...

Re: Security by obscurity is underrated

#233

Post by umvi »

gowld wrote: post #199
umvi wrote: post #133

Earlier quoted context omitted.

> I'm going to find whatever port your running ssh on if your running it. Not if you have to port knock before the ssh port is open to new connections.

Why not? I'll run my automated port knocker

Huh? How would that work? You have no idea what my port knocking scheme is.

For all you know you have to knock ports 22, 46, 1776, and 8998 to the timing of "shave and a haircut" switching between udp and icmp along the way... Good luck, the entropy you have to overcome is astronomical.

Re: Security by obscurity is underrated

#234

Post by cthalupa »

rsync wrote: post #215
tptacek wrote: post #27

There's something to the idea of rehabilitating "obscurity", or at least recognizing that "cost" is part of threat models, and you can raise costs for particular attack vectors by degrees instead of "to infinity". But SSH is a terrible example, because the cost to the defender of simply not having SSH vulnerabilities is the same, or even less, than the cost of obfuscating it with nonstandard ports, "port knocking", o…

"But SSH is a terrible example, because the cost to the defender of simply not having SSH vulnerabilities is the same, or even less, than the cost of obfuscating it with nonstandard ports, "port knocking", or fail2ban, which are all silly ideas." I know who I am arguing with here but port knocking is not silly. It's fantastic . When I say fantastic, I don't mean it solves all of our problems and obviates any other pr…

Why not just block SSH access from the public internet and use a VPN? Trivially easy to setup and more secure than knocking.

All it takes is me somehow being able to listen in on your traffic - not even decrypt it - and now I know the knock sequence. I know that you have SSH listening on that server. I know you are actively doing something on it.

vs. a VPN where... all I know is you are communicating over a VPN. With DPI I might be able to determine what type of traffic you're sending, but not where it is ultimately going.

Re: Security by obscurity is underrated

#235

Post by MrXOR »

Security by obscurity is dangerous. You can eliminate any obscurity with reverse engineering, spying, etc. Obscurity makes your system prone to catastrophic collapse and loss of security. Security by open design is necessary but even insufficient.

Re: Security by obscurity is underrated

#236

Post by angry_octet »

Verdex wrote: post #65
cataflam wrote: post #13

Agree with the article. People have been misinterpreting "security by obscurity is bad" to mean any obscurity and obfuscation is bad. Instead it was originally meant as "if your only security is obscurity, it's bad". Many serious real-world scenarios do use obscurity as an additional layer. If only because sometimes, you know that a dedicated attacker will be able to breach, what you are looking for is to delay them…

In nature, prey animals will sometimes jump when they spot a predator[1]. One of the explanations is that this is the animal communicating to the predator that it is a healthy prey animal that would be hard to catch and therefore the predator should choose to chase someone else. I think we can kind of view obscurity in the same way. It's a way to signal to a predator that we're a hard target and that they should give…

I think it is the opposite -- systems with rigourous security tend to be more open, because the designers are confident they understand their system. In contrast, systems that practice security through obscurity are often owned/managed by people afraid of what will go wrong.

We should distinguish obscurity from intentionally hiding the configuration, which makes attackers undertake discovery, and hence can lead to detection. But your internal red team / security review should have all the details available. If loss of obscurity leads directly to compromise then you don't have security. Cf insider threat.

Re: Security by obscurity is underrated

#237

Post by ThA0x2 »

dec0dedab0de wrote: post #7

I'm surprised port knocking never really caught on. Does anyone know of it being used in production anywhere?

Worked for a major bank (think top 10). We had port knocking on several publicly accessible infrastructure pieces (LBs, some VMs, etc.)

Decades of running without a single intrusion. We moved to SPA port knocking and now we rely less on the VPN for certain assets.

Re: Security by obscurity is underrated

#238

Post by Sebb767 »

justinsaccount wrote: post #221
Sebb767 wrote: post #194

Earlier quoted context omitted.

> * The boxes using port knocking would be safe. No, saf er . It is very well possible to brute-force port knocking or eavesdropping the ports since that information is not encrypted. Is it harder? Of course, a lot, but if you think scanning 65k ports on each host on the internet is reasonable, then evading a port knock is very much, too.

eavesdropping, maybe. There are tools like https://github.com/mrash/fwknop that are not vulnerable to that or brute-forcing. But brute forcing in general? not a chance. There are 18446744073709551616 4 port sequences.

And there are roughly 1267650600228229401496703205376 port 22's in the IPv6 space - I've substracted a few for reserved and unassigned spaces, but at this scale a few orders of magnitude hardly matter.

Here, for comparison:

  281474976710656 - total ports in IPv4 space
  18446744073709551616 - 4 port combinations
  1267650600228229401496703205376 - my estimation for 22 in IPv6
And if you don't block the knocking when receiving traffic on another port, brute forcing gets quite a bit easier. I mean, it's still unreasonable. But my point is, when we accept 0,001% chance as possible, I don't think we can say that 0,000001% is impossible - just a lot less possible ;)

Re: Security by obscurity is underrated

#239

Post by umvi »

e40 wrote: post #207
cataflam wrote: post #13

Agree with the article. People have been misinterpreting "security by obscurity is bad" to mean any obscurity and obfuscation is bad. Instead it was originally meant as "if your only security is obscurity, it's bad". Many serious real-world scenarios do use obscurity as an additional layer. If only because sometimes, you know that a dedicated attacker will be able to breach, what you are looking for is to delay them…

The number of times I've seen people shitting all over port knocking is truly confusing. Since we added it several years ago, we've not had a single case of hackers trying to break into sshd. Before port knocking, 100's a day, even though it was on a very unusual port. I try to tell people this, when they poo poo port knocking, but they just don't get it. EDIT: s/the/they/

Just respond "don't knock it 'til you try it... or rather, don't try it 'til you knock it!"

Re: Security by obscurity is underrated

#240

Post by minerjoe »

gowld wrote: post #199
umvi wrote: post #133

Earlier quoted context omitted.

> I'm going to find whatever port your running ssh on if your running it. Not if you have to port knock before the ssh port is open to new connections.

Why not? I'll run my automated port knocker

I would thing that blocking IP's of insessant knockers would be easy to implement.
Post reply on HN