Security by obscurity is underrated • Hacker News Board

Re: Security by obscurity is underrated

#441

Post by peterwwillis » Sat, Sep 12, 2020, 3:00 AM UTC

Risk is not just a formula. Risk is also "formulaic": when you get people used to an idea, they become blind to things outside of that idea, and there in lies the danger.

If your corporate IT group regularly asks users to send in their passwords via e-mail in order to perform some remote maintenance, then the users will be habituated to sending their password to a familiar e-mail address. If someone from outside their company asked them for their password, they would immediately say no. But an e-mail with the right "From: " address, they would quickly fall for. So it becomes easy to trick the users into sending their password to an attacker in some circumstances, because of the assumptions they make.

Security by obscurity is just another form of this: a practice which isn't really secure, but people may think is secure, because it seems to avoid the simplest, most stupid attacks. But literally any action you take could prevent the simplest, most stupid attacks. That doesn't mean that any action you take makes you "more secure".

Hiding a key under a door mat or in a sun visor isn't "more secure" than leaving it in plain view. Anyone who's not a total moron will find it, and if that's your whole security posture, you're screwed.

Re: Security by obscurity is underrated

#442

Post by paradox242 » Sat, Sep 12, 2020, 3:08 AM UTC

Yes, this is one of those rules that is designed for novices. It's actually a reasonable part of any security strategy for the reasons you mentioned.

Re: Security by obscurity is underrated

#443

Post by jjoonathan » Sat, Sep 12, 2020, 3:14 AM UTC

0xFluegel wrote: post #172

iso1631 wrote: post #162

Earlier quoted context omitted.

> But definitely take obvious and easy measures that leverage obscurity to add another layer of defense, such as changing default ports, port-knocking, or whatever. Except that can lead to operational problems down the road. For example "oh yes, we're nice and secure, not only do you need a 512bit private key to get into this device, you also need to connect from a secure network" Then along comes covid, and you can'…

I would call that system secure. It does not just rely on an obscure password but is actually restricted by a list of whitelisted networks. The failure in that case is only that the admin didn't consider that normal work might be done from home at some point or that the middle or upper manager thinks that he should be able to freely administrate his critical infrastructure from anywhere...

IP whitelists break so often for "unanticipated reasons" that I've lost all sympathy for not anticipating it. Doubly so for using a whitelist to lock yourself out of the whitelist admin.

It's so common the security community should make it a meme to spread awareness: Don't get pwned by DHCP while running from SSH 0-day RCEs.

Re: Security by obscurity is underrated

#444

Post by pabs3 » Sat, Sep 12, 2020, 3:15 AM UTC

yabones wrote: post #165

tptacek wrote: post #27

There's something to the idea of rehabilitating "obscurity", or at least recognizing that "cost" is part of threat models, and you can raise costs for particular attack vectors by degrees instead of "to infinity". But SSH is a terrible example, because the cost to the defender of simply not having SSH vulnerabilities is the same, or even less, than the cost of obfuscating it with nonstandard ports, "port knocking", o…

I think a lot of the people in this comment thread are missing the point when using the `sshd` example. There is no single infallible way to secure ssh, but there are a lot of things that can be done together to make it pretty darn hard to hack, and most of those countermeasures have some degree of 'obscurity' to them. Example: * Use RSA keys instead of passwords -> This will eliminate most risk, except for exploits…

I'd suggest using jump hosts (-J or ProxyJump) rather than agent forwarding to a bastion host. IIRC the latter gives the bastion host access to your keys.

Re: Security by obscurity is underrated

#445

Post by jameshart » Sat, Sep 12, 2020, 3:21 AM UTC

jeroenhd wrote: post #324

crazygringo wrote: post #309

Earlier quoted context omitted.

But serious question -- what exactly is the benefit? Before, it's not like they were getting in anyways if you were using keys. So I confess I still don't "get it". Unless you just want cleaner logs or something. I assume you're still getting the same number of initial connection attempts per day, but just not recording them? Is it something to do with network or CPU consumption related to failed subsequent attempts…

There have been bugs found in SSH server implementations that allowed limited remote code execution or even authentication bypasses. Missing an update or two isn't bad when nobody can figure out how to connect to your server. Of course you have to update at some point. However, if someone drops a zero day on your SSH server while you're asleep you're probably glad that you've got a secret sauce to protect your server…

Why aren't you concerned that bugs will be found in your port knocking implementation?

I think the main concern with port knocking is that it's observable. You're effectively sending your password in clear, so if someone can intercept or overhear your traffic then your secret is lost. Cryptographic authentication schemes like SSH itself or VPNs do not have this problem.

Re: Security by obscurity is underrated

#446

Post by ayyy » Sat, Sep 12, 2020, 3:29 AM UTC

acoard wrote: post #273

cthalupa wrote: post #230

Earlier quoted context omitted.

I know we've spoken in another thread, but I think it's important for people to understand that this sshd thing is a perfect example of why it isn't this easy: You reduce log spam moving to a non-privileged port, but also reduce overall security - a non-privileged user can bind to a port above 10k, but can't bind to 22. sshd restarts for an upgrade, or your iptables rules remapping a high port to 22 get flushed, that…

Here's a counter-example (I said else-where in this thread): Imagine a 0day for SSH drops tomorrow. Almost immediately script kiddies all over the world will be trying to take over everything running on port 22. I'll also point out that we're generally talking about different threat vectors here, so it's good to lay them out. I don't think obscurity helps against a persistent threat probing your network, it helps aga…

> Unfortunately that's all too rare in most web-servers I see (If you made a list of things like this which annoy you, I would enjoy reading it.

Re: Security by obscurity is underrated

#447

Post by austincheney » Sat, Sep 12, 2020, 3:32 AM UTC

sedatk wrote: post #428

austincheney wrote: post #421

Earlier quoted context omitted.

That is also not a security control.

Theoretically, yes. But if it makes you get off the radar of some malicious attacker who is capable of exploiting you, then the mission is accomplished.

Not at all. The attacker will find it within a minute after running a port scan.

Re: Security by obscurity is underrated

#448

Post by ThA0x2 » Sat, Sep 12, 2020, 3:49 AM UTC

tptacek wrote: post #372

rsync wrote: post #215

Earlier quoted context omitted.

"But SSH is a terrible example, because the cost to the defender of simply not having SSH vulnerabilities is the same, or even less, than the cost of obfuscating it with nonstandard ports, "port knocking", or fail2ban, which are all silly ideas." I know who I am arguing with here but port knocking is not silly. It's fantastic . When I say fantastic, I don't mean it solves all of our problems and obviates any other pr…

It solves none of your problems and adds complexity and cost to your defense without corresponding increases to attacker costs. If you believe there are unknown OpenSSH attacks, you can't coherently believe that port knocking is a real defense, since port knocking doesn't do anything to protect the SSH channel that attacks will be carried out in. Instead, if you're actually worried about OpenSSH vulnerabilities, you…

>It solves none of your problems

Wrong, it solves tons of them.

>adds complexity and cost

Almost zero complexity and cost. Maybe if you're a bad at sysadmin work it adds cost and complexity.

>defense without corresponding increases to attacker costs.

It adds a _huge_, almost incalculable cost increase to attackers.

>If you believe there are unknown OpenSSH attacks, you can't coherently believe that port knocking is a real defense, since port knocking doesn't do anything to protect the SSH channel that attacks will be carried out in.

Looks like you don't understand the concept of 0-days. Several CVEs we're listed elsewhere. I suggest researching 0-day exploits so you understand how port knocking mitigates them.

Port knocking mitigates 0-days.

>Instead, if you're actually worried about OpenSSH vulnerabilities, you shouldn't be exposing SSH to the public Internet at all.

I don't disagree here, VPN is a great solution. Nonetheless, for some shops simple port-knocking on a bastion host solves, a lot of these issues, and removed the complexity that VPNs add.

>I'm not super worried about OpenSSH server vulnerabilities, but I would never recommend that teams leave SSH exposed; they should just hide that stuff behind WireGuard.

No one is super worried about things like shellshock, heart bleed, etc. until they happen.

Port knocking solved a lot of problems, protects you from zero-days, and makes SSH noise a non-issue (huge signal-to-noise gains).

Used in production for years. It's fantastic.

Re: Security by obscurity is underrated

#449

Post by MrStonedOne » Sat, Sep 12, 2020, 3:49 AM UTC

jameshart wrote: post #445

jeroenhd wrote: post #324

Earlier quoted context omitted.

There have been bugs found in SSH server implementations that allowed limited remote code execution or even authentication bypasses. Missing an update or two isn't bad when nobody can figure out how to connect to your server. Of course you have to update at some point. However, if someone drops a zero day on your SSH server while you're asleep you're probably glad that you've got a secret sauce to protect your server…

Why aren't you concerned that bugs will be found in your port knocking implementation? I think the main concern with port knocking is that it's observable . You're effectively sending your password in clear, so if someone can intercept or overhear your traffic then your secret is lost. Cryptographic authentication schemes like SSH itself or VPNs do not have this problem.

but what does getting past port knocking help with? now they have to find a bug with ssh.

Re: Security by obscurity is underrated

#450

Post by ThA0x2 » Sat, Sep 12, 2020, 3:57 AM UTC

cthalupa wrote: post #410

ThA0x2 wrote: post #247

Earlier quoted context omitted.

>But SSH is a terrible example, because the cost to the defender of simply not having SSH vulnerabilities is the same, or even less, than the cost of obfuscating it with nonstandard ports, "port knocking", or fail2ban, which are all silly ideas. This just shows how ignorant you (and most) are on the topic of port knocking. SPA port knocking is cryptographically secure and does not suffer from replay attacks. Similarl…

>This just shows how ignorant you (and most) are on the topic of port knocking. You, uh, do know who you're replying to, right? https://sockpuppet.org/me/ if not - I don't mention this to go "lol he must be right because of who he is", but calling a well respected security researcher with plenty of real world street cred ignorant is a bit much. >SPA port knocking is cryptographically secure and does not suffer from r…

>You, uh, do know who you're replying to, right? https://sockpuppet.org/me/ if not

This means nothing to me? I see a shitty website from probably a has-been "security researcher".

>I don't mention this to go "lol he must be right because of who he is", but calling a well respected security researcher with plenty of real world street cred ignorant is a bit much.

That's sad. Speaks volumes about how meaningless that term has become.

>SPA port knocking doesn't suffer from passive replay attacks, but it does suffer from block and replay attacks. An active MITM can still get you.

Wrong. SPA does not suffer from any MITM attacks.

>His suggestion hasn't been "if you care about security just don't do port knocking", his suggestion has been

No one suggests otherwise.

>"if you care about security just throw up a VPN it'll be more secure and just as much work"

Not the same amount of work, so no, wrong. If I had a dollar for every billion dollar unicorn that that didn't have a corporate VPN, I'd have a lot of dollars.