Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security by obscurity is underrated

utkusen.com

Post reply on HN
Print view View original

301–310 of 530 posts

Re: Security by obscurity is underrated

#301

Post by pera »

acdha wrote: post #87
justinsaccount wrote: post #69

Earlier quoted context omitted.

> Just use SSH keys, and disable passwords. CVE-2001-0144 - SSH1 CRC-32 compensation attack detector allows remote attackers to execute arbitrary commands on an SSH server or client via an integer overflow CVE-2008-0166 - OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that generates predictable numbers, which makes it easier for remote attackers to con…

Only the 4th point is really true: if you run SSH on a non-standard port but it's otherwise accessible, you'll still see scans on a regular basis. Port knocking isn't a terrible idea but I generally prefer locking down the networks (or, these days, using AWS SSM / GCP IAP to avoid listening publicly at all) since having something on the internet means you're just one mistake away from problems and need to staff monit…

> you'll still see scans on a regular basis.

Not in my experience, I would even say that full range port scanning is extremely rare. Botnets (again, in my experience) seem to only be interested in vanilla installations and will test standard ports exclusively. But of course, if you are in charge of some very tempting target (eg a cryptocurrency exchange) your experience will be totally different than mine.

Re: Security by obscurity is underrated

#302

Post by kjgkjhfkjf »

Yes, making security breaches harder for attackers at zero cost is obviously good. But obscurity does not have zero cost if it makes the system less efficient to operate. Having multiple cars in a presidential convoy is inefficient; using non-standard ports adds complexity; obfuscating data makes debugging harder; etc.

Re: Security by obscurity is underrated

#303

Post by cthalupa »

riquito wrote: post #298
cthalupa wrote: post #248

Earlier quoted context omitted.

Now, assume that every painting in your house can be checked for a safe behind it in milliseconds (total, for all safes) by the people in your house. Did you actually accomplish anything?

Why would you think it's in milliseconds? Are you generalising on port scanning? You could say that uuid as urls are obscurity, but it's not that fast to break through (and then hopefully you get some kind of protection layer) There's also an additional monetary cost for the attacker, it adds up

>Why would you think it's in milliseconds? Are you generalising on port scanning?

I am, since that seems to be the primary example used in the original article and the main example being discussed in the comments.

I think that's fair, since obscurity does the most to help against non-persistent threats. Persistent threats have targeted you for some reason, and that targeting means they are willing to employ more resources to get through your security. In that situation you should be focusing on adding as many layers of security that you know have protections besides just 'not being known' as you can, especially when there are tools out there that are specific in helping make them known.

Re: Security by obscurity is underrated

#304

Post by asah »

mr__y wrote: post #268
e40 wrote: post #207

Earlier quoted context omitted.

The number of times I've seen people shitting all over port knocking is truly confusing. Since we added it several years ago, we've not had a single case of hackers trying to break into sshd. Before port knocking, 100's a day, even though it was on a very unusual port. I try to tell people this, when they poo poo port knocking, but they just don't get it. EDIT: s/the/they/

Do you use single-port knocking or a sequence of port-knocks?

OP would respond but then that would break the obscurity! :-)

Re: Security by obscurity is underrated

#305

Post by adontz »

I think the article misses more important attack vector focusing on brute force, instead of human weaknesses.

Obscurity is naturally fragile, vulnerable to social engineering. Social engineering is the real problem. We can filter out brute force easily. It can be fail2ban, or even simplest ip-tables rules like

    iptables -A INPUT -j REJECT -p tcp --dport 22 -m state --state NEW -m recent --name TCP_SSH --update --rttl --seconds 600 --hitcount 15 --reject-with icmp-port-unreachable
    iptables -A INPUT -j REJECT -p tcp --dport 22 -m state --state NEW -m recent --name TCP_SSH --update --rttl --seconds 60 --hitcount 5 --reject-with icmp-port-unreachable
    iptables -A INPUT -j ACCEPT -p tcp --dport 22 -m state --state NEW,ESTABLISHED -m recent --name TCP_SSH --set
If you move from passwords to SSH keys, it increases security not really because number of possible keys is larger than number of possible passwords. More important is that you eliminate bad practice. One cannot share SSH key over phone conversation, write it down on a piece of paper and stick it to a monitor. Change is nothing similar to upgrading from 1024 bit SSH keys to 3072 bit SSH keys. If you store SSH key on some HSM, like YubiKey, even better, no one can copy this key, only steal.

You cannot really hide IP address or port number. You'll send this information to your colleagues and partners over SMS, Facebook Messenger, Whatsapp, Viber, Telegram, E-mail, Skype, Zoom, many times, multiple channels. Or you will write it down on a Wiki, like Confluence, which is public to entire organization, and that knowledge is not a secret anymore.

My greatest fear is not a script kiddo with botnet, but an addict employee with debts.

Re: Security by obscurity is underrated

#306

Post by bosswipe »

iso8859-1 wrote: post #292
snowwrestler wrote: post #285

All software security comes down to obscurity: it depends on the selection of specific numbers that are known to the authorized parties, but are extremely difficult to guess (i.e. very obscure) to the unauthorized parties. The extreme of this strategy is to make a successful guess cost more than anyone can possibly pay, for example by using numbers so obscure that all known algorithms for guessing them will take long…

Security can also be achieved by physical separation or identity based on physical human traits. Now we're getting philosophical, but if the security crew of the data center knows my face, and does not allow other people to enter, would you reduce my face to a value that is "extremely difficult to guess"?

Right. There are three types of authentication factors: something you know, something you have, something you are.

Obscurity and passwords fall under "something you know". Biometrics like what you describe would fall under "something you are". A physical key such as a yubikey or the sim card matching an SMS challenge would be "something you have". Multi-factor authentication is more secure but it doesn't negate the discussion here about hardening the "something you know" factor.

Re: Security by obscurity is underrated

#307

Post by branon »

acoard wrote: post #210
bleepblorp wrote: post #120

Earlier quoted context omitted.

Using a non-standard SSH port is a bad example because nmap can see through that deception in a few seconds. Any attacker who is looking for more than just the lowest of low-hanging fruit will not be even slightly deterred. A better example would be a port-knocking arrangement that hides sshd except from systems that probe a sequence of ports in a specific way. This is very much security by obscurity, because it's tr…

The article addresses this. He did a poll, and just under 50% of people use the default ports. So just by changing your default port, you eliminate half the break-in attempts. Now you're absolutely right that this only deters less-skilled/inept hackers, a more competent hacker easily gets past this. But it's worth dwelling on the fact that we still stopped a substantial number of requests. Port knocking is definitely…

The poll is my biggest issue with an otherwise agreeable article, the sample size and representation on Twitter doesn't make for anything close to reliable percentages.

I understand its use as a demonstrative aid but especially in the context of security, hinging your policies on the outcome of a Twitter poll seems like... well, security through obscurity.

Re: Security by obscurity is underrated

#308

Post by boredpenguin »

yjftsjthsd-h wrote: post #132
p49k wrote: post #103

Earlier quoted context omitted.

With heartbleed, a bug in the implementation of the protocol led to the server randomly leaking contents of the server’s memory, which could be anything from private keys to user or system passwords to other confidential information. No passwords or MitM was required. You can read more at heartbleed.com

And it still doesn't matter, because sshd literally never has the private key that allows access. If a server only allows access via SSH key, you could literally have a complete RAM dump of the whole system and not be able to access it.

> still doesn't matter (...) you could literally have a complete RAM dump of the whole system and not be able to access it.

I'd say that matters. Think about all the secrets (tls keys, whatever) a server has in memory.

If you can't connect to the sshd daemon, you can't attack it.

Re: Security by obscurity is underrated

#309

Post by crazygringo »

e40 wrote: post #207
cataflam wrote: post #13

Agree with the article. People have been misinterpreting "security by obscurity is bad" to mean any obscurity and obfuscation is bad. Instead it was originally meant as "if your only security is obscurity, it's bad". Many serious real-world scenarios do use obscurity as an additional layer. If only because sometimes, you know that a dedicated attacker will be able to breach, what you are looking for is to delay them…

The number of times I've seen people shitting all over port knocking is truly confusing. Since we added it several years ago, we've not had a single case of hackers trying to break into sshd. Before port knocking, 100's a day, even though it was on a very unusual port. I try to tell people this, when they poo poo port knocking, but they just don't get it. EDIT: s/the/they/

But serious question -- what exactly is the benefit? Before, it's not like they were getting in anyways if you were using keys.

So I confess I still don't "get it". Unless you just want cleaner logs or something. I assume you're still getting the same number of initial connection attempts per day, but just not recording them?

Is it something to do with network or CPU consumption related to failed subsequent attempts by the same actor? (Which, the same as port knocking, should be rate limited anyways?)

Re: Security by obscurity is underrated

#310

Post by dec0dedab0de »

cthalupa wrote: post #255
dec0dedab0de wrote: post #7

I'm surprised port knocking never really caught on. Does anyone know of it being used in production anywhere?

For production use cases in a business environment it's just not as good as the alternatives. Setting up VPNs and blocking SSH access to the internet is just as easy, less overhead, and more secure. Let's say you're a bank. You implement port knocking as your security measure of choice to keep SSH secure. I know from your job postings that your developers and IT department work at X location in Y city. I know the IP…

There's just not really any reason to use port knocking over a VPN when the difference in overhead and complexity is minimal and the benefits you get with a VPN vs. port knocking are so massive.

But I would say in addition to a VPN, not instead of. Imagine the vpn client had it built in to do the knock, before connecting. So the VPN ports are not opened until the knock is performed and only for the source IP that did them.

Post reply on HN