Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security by obscurity is underrated

utkusen.com

Post reply on HN
Print view View original

241–250 of 530 posts

Re: Security by obscurity is underrated

#241

Post by Avamander »

tptacek wrote: post #27

There's something to the idea of rehabilitating "obscurity", or at least recognizing that "cost" is part of threat models, and you can raise costs for particular attack vectors by degrees instead of "to infinity". But SSH is a terrible example, because the cost to the defender of simply not having SSH vulnerabilities is the same, or even less, than the cost of obfuscating it with nonstandard ports, "port knocking", o…

> are all silly ideas.

Changing the port is not silly, it increases the SNR in logs, that's already a worthy goal.

Re: Security by obscurity is underrated

#242

Post by rsync »

cthalupa wrote: post #234
rsync wrote: post #215

Earlier quoted context omitted.

"But SSH is a terrible example, because the cost to the defender of simply not having SSH vulnerabilities is the same, or even less, than the cost of obfuscating it with nonstandard ports, "port knocking", or fail2ban, which are all silly ideas." I know who I am arguing with here but port knocking is not silly. It's fantastic . When I say fantastic, I don't mean it solves all of our problems and obviates any other pr…

Why not just block SSH access from the public internet and use a VPN? Trivially easy to setup and more secure than knocking. All it takes is me somehow being able to listen in on your traffic - not even decrypt it - and now I know the knock sequence. I know that you have SSH listening on that server. I know you are actively doing something on it. vs. a VPN where... all I know is you are communicating over a VPN. With…

Again, this is where all port knocking debates devolve to ...

Port knocking is not the christ child that will wash away all of our sins ... and therefore is not worth implementing.

You're right!

It doesn't add that much. But it's non-zero and has almost zero cost. It's very elegant, in my mind, and it makes me very happy.

Re: Security by obscurity is underrated

#243

Post by cthalupa »

yabones wrote: post #165
tptacek wrote: post #27

There's something to the idea of rehabilitating "obscurity", or at least recognizing that "cost" is part of threat models, and you can raise costs for particular attack vectors by degrees instead of "to infinity". But SSH is a terrible example, because the cost to the defender of simply not having SSH vulnerabilities is the same, or even less, than the cost of obfuscating it with nonstandard ports, "port knocking", o…

I think a lot of the people in this comment thread are missing the point when using the `sshd` example. There is no single infallible way to secure ssh, but there are a lot of things that can be done together to make it pretty darn hard to hack, and most of those countermeasures have some degree of 'obscurity' to them. Example: * Use RSA keys instead of passwords -> This will eliminate most risk, except for exploits…

>* Change the default port from 22 to something in the 40k+ range, which will keep you from being scanned, and

I'm replying to these suggestions all over this item because I think it's important, so I apologize if you've since seen this comment elsewhere, but:

This introduces new security risks. Non-privileged users can bind on ports in the 40k+ range and cannot bind on 22. If you restart sshd for a software upgrade or some other reason, or the iptables rules you're using to remap the ports get flushed, the malicious non-privileged user can now bind to the port people were communicating with your sshd on, and if they ignore the host key mismatch, everything they send can be captured by the malicious user.

Older openssh clients have default configurations that can result in the leak of the whole private key, if you use password auth or 2FA they can outright steal those, perhaps their fake sshd will do more than just steal credentials and will actually mimic a shell and let them gain more understanding of how the system ticks, etc.

Is this level of attack something most people are going to run into? No. But neither is an attack more sophisticated than brute force password attempts. It's definitely information people should be keeping in mind when making these sorts of decisions, too.

Re: Security by obscurity is underrated

#244

Post by Sebb767 »

cthalupa wrote: post #230
Sebb767 wrote: post #170

Earlier quoted context omitted.

> Using a non-standard SSH port is a bad example because nmap can see through that deception in a few seconds. Compared to milliseconds. Do yourself the favor and open one sshd on port 22 vs one on a port >10000, then compare logs after a month. The 22 one will have thousands of attempts; the other one hardly tens if even any. The 99% level we're defending against here is root:123456 or pi:raspberry on port 22. Which…

I know we've spoken in another thread, but I think it's important for people to understand that this sshd thing is a perfect example of why it isn't this easy: You reduce log spam moving to a non-privileged port, but also reduce overall security - a non-privileged user can bind to a port above 10k, but can't bind to 22. sshd restarts for an upgrade, or your iptables rules remapping a high port to 22 get flushed, that…

Fair enough, I've edited the comment to reflect this :)

Re: Security by obscurity is underrated

#245

Post by b0rsuk »

Verdex wrote: post #65
cataflam wrote: post #13

Agree with the article. People have been misinterpreting "security by obscurity is bad" to mean any obscurity and obfuscation is bad. Instead it was originally meant as "if your only security is obscurity, it's bad". Many serious real-world scenarios do use obscurity as an additional layer. If only because sometimes, you know that a dedicated attacker will be able to breach, what you are looking for is to delay them…

In nature, prey animals will sometimes jump when they spot a predator[1]. One of the explanations is that this is the animal communicating to the predator that it is a healthy prey animal that would be hard to catch and therefore the predator should choose to chase someone else. I think we can kind of view obscurity in the same way. It's a way to signal to a predator that we're a hard target and that they should give…

I've heard a better analogy - security by obscurity is like camouflage on a tank. A tank has massive armor and a terrifying gun to defend itself with. But even a half-assed camouflage can delay enemy reaction by a few seconds. Sometimes it's all it takes, because it lets you shoot first. In addition, the cost of camouflage paint or a net is laughably low and can be replaced in the field. It's simply an extra layer of protection and a very inexpensive one.

Re: Security by obscurity is underrated

#246

Post by lizknope »

I bought a new virtual machine and I waited about a day until I logged in. The SSH logs showed over 100 failed login attempts. I hadn't even logged in!

I changed the default SSH port to a random high number.

I had zero failed login attempts in 2 months.

Of course use strong security methods but I suggest changing the default port numbers just to clean up the log files.

Re: Security by obscurity is underrated

#247

Post by ThA0x2 »

tptacek wrote: post #27

There's something to the idea of rehabilitating "obscurity", or at least recognizing that "cost" is part of threat models, and you can raise costs for particular attack vectors by degrees instead of "to infinity". But SSH is a terrible example, because the cost to the defender of simply not having SSH vulnerabilities is the same, or even less, than the cost of obfuscating it with nonstandard ports, "port knocking", o…

>But SSH is a terrible example, because the cost to the defender of simply not having SSH vulnerabilities is the same, or even less, than the cost of obfuscating it with nonstandard ports, "port knocking", or fail2ban, which are all silly ideas.

This just shows how ignorant you (and most) are on the topic of port knocking.

SPA port knocking is cryptographically secure and does not suffer from replay attacks.

Similarly, it defends you against 0-day hacks, and greatly increases your signal-to-noise ratio. With port knocking, ANY failed attempt is super suspicious. Before you'd get hundreds of attempts a day.

Re: Security by obscurity is underrated

#248

Post by cthalupa »

riquito wrote: post #232

It's like a painting in front of a safe: - doesn't reduce the security of the safe - ensure you don't advertise "THERE'S A SAFE HERE" to whoever visit your house, possibly reducing burglar attempts Now, if you have just the painting over a hole in the wall, you got something wrong...

Now, assume that every painting in your house can be checked for a safe behind it in milliseconds (total, for all safes) by the people in your house.

Did you actually accomplish anything?

Re: Security by obscurity is underrated

#249

Post by rudolph9 »

lizknope wrote: post #246

I bought a new virtual machine and I waited about a day until I logged in. The SSH logs showed over 100 failed login attempts. I hadn't even logged in! I changed the default SSH port to a random high number. I had zero failed login attempts in 2 months. Of course use strong security methods but I suggest changing the default port numbers just to clean up the log files.

What ports did the firewall have open?

Re: Security by obscurity is underrated

#250

Post by ballenf »

dylan604 wrote: post #154
acoard wrote: post #101

Earlier quoted context omitted.

>I think we can kind of view obscurity in the same way. It's a way to signal to a predator that we're a hard target and that they should give up. This has it completely backwards. Security through obscurity's goal is not to signal predators, it's the opposite. The goal is to obscure, to hide. The "signal" is there is nothing here (or nothing here worth your time). One of the best examples (it's in the article!) is ch…

In other words, changing the default SSH port number is similar to using camouflage. It just helps hide that something is there, but it does nothing to improve the defense once spotted. However, if the majority of predators don't see you, then the rest of your defenses are needed at that time.

It's also an indication that there are no default passwords in use. So even if you know what port SSH lives on, there's a lower ROI to attacking it than a default port.
Post reply on HN