Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security by obscurity is underrated

utkusen.com

Post reply on HN
Print view View original

461–470 of 530 posts

Re: Security by obscurity is underrated

#461

Post by tptacek »

ThA0x2 wrote: post #448
tptacek wrote: post #372

Earlier quoted context omitted.

It solves none of your problems and adds complexity and cost to your defense without corresponding increases to attacker costs. If you believe there are unknown OpenSSH attacks, you can't coherently believe that port knocking is a real defense, since port knocking doesn't do anything to protect the SSH channel that attacks will be carried out in. Instead, if you're actually worried about OpenSSH vulnerabilities, you…

>It solves none of your problems Wrong, it solves tons of them. >adds complexity and cost Almost zero complexity and cost. Maybe if you're a bad at sysadmin work it adds cost and complexity. >defense without corresponding increases to attacker costs. It adds a _huge_, almost incalculable cost increase to attackers. >If you believe there are unknown OpenSSH attacks, you can't coherently believe that port knocking is a…

Port knocking adds a huge, almost incalculable cost increase to attackers. I'm going to remember that one, thanks!

Re: Security by obscurity is underrated

#463

Post by efreak »

voltagex_ wrote: post #420
acoard wrote: post #101

Earlier quoted context omitted.

>I think we can kind of view obscurity in the same way. It's a way to signal to a predator that we're a hard target and that they should give up. This has it completely backwards. Security through obscurity's goal is not to signal predators, it's the opposite. The goal is to obscure, to hide. The "signal" is there is nothing here (or nothing here worth your time). One of the best examples (it's in the article!) is ch…

I just turn off password authentication on SSH and moved to keys, then moved to IPv6. The automated scans haven't made it to v6 yet. The only better thing I could do is have an external v4 SSH honeypot that moves as slowly as possible to tie up a (tiny) resource.

Endlessh and tarbit do this

Re: Security by obscurity is underrated

#464

Post by blackflame7000 »

Security through obscurity is not fool proof, but neither is cryptography in general. It's all about making the problem as difficult as reasonably possible. Someone could guess a private key by incredible luck according to Murphy's law and while the probability of that happening is so extremely improbable, it is not zero, and therefore not foolproof.

Re: Security by obscurity is underrated

#465

Post by deeringc »

weare138 wrote: post #44
cataflam wrote: post #13

Agree with the article. People have been misinterpreting "security by obscurity is bad" to mean any obscurity and obfuscation is bad. Instead it was originally meant as "if your only security is obscurity, it's bad". Many serious real-world scenarios do use obscurity as an additional layer. If only because sometimes, you know that a dedicated attacker will be able to breach, what you are looking for is to delay them…

But the examples given won't help and is just bad advice in general. - Assume for every code obfuscator there's a deobfuscator or at least someone as clever as you out there. - Randomizing variable names it just a nuisance, it won't stop any competent pen tester or attacker. - Encrypting the database is an odd one. Your program will also have to decrypt the data to use it. Where do you store the encryption keys? In y…

The database key should be generated per encrypted database and then stored using something like the OSX keychain. The OS enforces that only a given application can retrieve that key (via application code signing).

Re: Security by obscurity is underrated

#467

Post by smaudet »

nordsieck wrote: post #198
thinkharderdev wrote: post #149

Earlier quoted context omitted.

Maybe a bit nitpicky but I think port-knocking is in kind of a grey area. You can think of it as a kind of password where you have to know the correct series of ports. Since the number of ports is quite large, there is also a correspondingly large number of possible port sequences so you can't, in principle, brute force it without a lot of effort.

> Maybe a bit nitpicky but I think port-knocking is in kind of a grey area. You can think of it as a kind of password where you have to know the correct series of ports. Yes. But you also have to know that port knocking is enabled at all. That's the obscurity part.

Eh, I think its how others have expressed in this thread.

Security by obscurity is bad, not because it is bad to have well secured countermeasures, but because it encourages poor thinking with regards to methods you have in place, and additionally because it usually introduces extra, unintended attack vectors.

You suffer from your own 'obscurity' - whether its because you forgot you had to port knock, use a different port, or because you somehow managed to leave a new exploit in some obscured code due a bug in the obscured code, or because you managed to open yourself up to an RCE with the port knocking, or some other obscure scenario you did not intend to create from whatever obscurity you created.

I think this is different from Defense in Depth, which just says have more than one countermeasure in place, and to keep the counter measures 'separate', but well defined. Port knocking, but on a different box than your vpn box, on a different box than your ssh box.

We aren't told to use 'well-defined' passwords, like 1234, obviously. If the point of 'obscurity' is 'secrets', that's all well and good, but that's not security, that's a password. Have a password, by all means, but tunnel it over TLS and use well defined security paths versus creating unnecessary risks.

Re: Security by obscurity is underrated

#468

Post by monsieurbanana »

Sebb767 wrote: post #170
bleepblorp wrote: post #120

Earlier quoted context omitted.

Using a non-standard SSH port is a bad example because nmap can see through that deception in a few seconds. Any attacker who is looking for more than just the lowest of low-hanging fruit will not be even slightly deterred. A better example would be a port-knocking arrangement that hides sshd except from systems that probe a sequence of ports in a specific way. This is very much security by obscurity, because it's tr…

> Using a non-standard SSH port is a bad example because nmap can see through that deception in a few seconds. Compared to milliseconds. Do yourself the favor and open one sshd on port 22 vs one on a port >10000, then compare logs after a month. The 22 one will have thousands of attempts; the other one hardly tens if even any. The 99% level we're defending against here is root:123456 or pi:raspberry on port 22. Which…

Good example, but doesn't help his point, which was:

> This has it completely backwards. Security through obscurity's goal is not to signal predators, it's the opposite. The goal is to obscure, to hide. The "signal" is there is nothing here

An attacker scanning the whole IPv4 space won't think "ah, there's no ssh on port 22, there's no ssh to attack". They will think "yep, they did at least the bare minimum to secure their server, let's move on to easier targets".

He proved the point he was trying to disprove.

Re: Security by obscurity is underrated

#469

Post by catears »

I want to tackle a misunderstanding I have seen from some posters in this thread about passwords/secrets/keys. Using a password should not be considered a form of "obscure defense".

If you are using a password there is a mathematical definition of how hard it is to crack, the number of bits of entropy contained in the password. If you use a password manager like KeePass it will tell you the number of bits in you password.

If it takes me 2^100 guesses for a 50% chance to discover your password then that is not obscurity, that is a valid defense mechanism. That the password itself is obscure is not a reason to call the strategy obscure.

Passwords and keys are used to create an artifact that will unlock access to a whole bunch of information. Instead of protecting each piece of information individually, we can now focus our efforts on protecting the password instead.

With a password we have managed to make the process of protecting information simpler, less obscure.

Sorry to discuss something a bit off-topic from the article, but I figured I had seen the "passwords are obscure" argument so many times here and that this could be a valuable opportunity to teach something about security.

Re: Security by obscurity is underrated

#470

Post by helsinkiandrew »

Unless you are Goldman Sachs, the NSA or someone else who is being specifically targeted this is always true.

Otherwise, switching ports or making your systems a bit different to the others on the internet means the majority of hackers - 'bots', 'scanners' and 'script kiddies' will move on to easier targets.

On the internet you don't have to outrun the bear, you just need to run faster than some other guy.

Post reply on HN