Security by obscurity is underrated

I think the article confuses two concepts. "Security by obscurity is bad" usually applies to things like "our own proprietary hash function", or "our own proprietary remote control protocol", or sometimes even just "well, noone has the code, right?". I call this obscurity proper. This is often little more than an omission.

All the positive examples in the article mean actively obscuring the view of an attacker. This is an addition of things like camouflage or distraction.

Proper obscurity is obviously bad, because there simply is no security concept behind it. Additive obscurity is obviously smart because it adds to an existing concept.

Obscurity takes many forms, and some are useful, particularly to common hackers, and others are completely useless. There are a number of code walking tools and disassemblers that will rename all variables and function linkages and provide annotated source. Someone still has to crawl through that source, but all the obfuscation is removed. I know professionals that use these tools, not to hack, but to perform security audits on products that they use within highly secure settings.

I attended a security conference a few years ago, cannot think of the speakers name right now, but he said you should assume that professional hackers have better tools and larger budgets than you will ever have access to.

Which comes all the way around to: a VPN sounds like a better option in every respect. More secure, universally supported.

I think the main reason you'd use port knocking is because it's fun and cool.

Making security by obscurity actually work

The reality is security by obscurity CAN work, but only if three critical elements are met:

The first is to know when the obscurity has failed

The second is to be able to quickly change the obscured component (e.g. a password)

The third element is the hardest, security by obscurity only really works if you can survive exposure of the obscured data/system

Which leads to the fourth element: security through obscurity IS NOT security through secrecy (so either I'm a liar or bad at counting, leave your vote in the comments below)

Let's start with the 4th element, obscurity vs secrecy. Passwords. Passwords generally only work if they are secret. Some password systems like Kerberos take great pains to ensure passwords remain secret, for example by NOT sending the password itself to a remote system, but by sending proof that the user has the password (grossly simplified, but generally correct, now you understand Kerberos!). Secrecy involves hiding things that if exposed will be a problem that can't be solved, like your password, the formula to Coca-Cola and so on.

Obscurity won't work for things that need to be secret. Obscurity won't work for things that once exposed result in the game ending.

Even when an item can be obscured, it is still important to know when it is no longer obscured, otherwise you now have an element of your security system that has effectively been breached. For example if you are using randomized port numbers to prevent SSH scanners from constantly trying default username/password combinations and someone (like shodan.io) port scans you and publishes your SSH server ports you either need to change that, or not be relying on that obscurity for your security (e.g. I used to change my SSH port #'s just to reduce logging activity and make it easier to filter/read logs for actually malicious activity).

The second element is that once your obscurity becomes known you need to be able to change it, if you can't change your SSH port # (because you don't have a way to tell clients where it is) then you have a security control that cannot be recovered and you lose it. Security elements should always strive for long term survivability because the simple fact is attackers get to try more than once.

The third and final element (because we started counting at 4!) is your system cannot simply fail because the obscure element was discovered. Using a no standard port for SSH works if you also use strong passwords or (ideally) key based login. Obscuring SSH ports and leaving a default admin:1234 login is brittle, and as evidenced by scanners like shodan.io easily exploited.

I think, honestly, the best use case for "security by obscurity" is to cut down on the noise of logs and casual scanning/scripted hacking, which can be valuable, having less chaff to sort through for actual attacks can both save time and money, but also give you a better chance of finding the real attacks.

https://app.voice.com/post/@kurtseifried/making-security-by-...

Ehh the majority of companies practice security by obscurity as an extra layer.

There's the idea in security that an attacker knowing your algorithm/practices shouldn't mean anything yet you rarely see companies detail the security measures they take on internal systems because we know keeping this secret has no downside.