Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security by obscurity is underrated

utkusen.com

Post reply on HN
Print view View original

491–500 of 530 posts

Re: Security by obscurity is underrated

#491

Post by nickcw »

I'd argue that all security is security by obscurity, it is just a question of how many attacker-seconds it takes to break.

Obscurity means keeping something private that if the attacker knew they could access your service. Traditionally security by obscurity is something like putting your ssh login port on port 61329 rather than port 22.

I'd argue that the above is 16 bits of obscurity, whereas your ssh key you log in with is 1024 bits of obscurity. The attacker needs that 16 bits of port number obscurity and the 1024 bits of ssh key obscurity to log in.

However the attacker-seconds to break the 16 bit port number is a rounding error compared to the attacker-seconds to break the 1024 bit ssh key

Which is where, I guess, the idea that "security through obscurity" is bad came from.

I'd argue that the attacker-seconds is still higher with your ssh on port 61329 though, so why not use that too.

Re: Security by obscurity is underrated

#492

Post by aschatten »

rsync wrote: post #215
tptacek wrote: post #27

There's something to the idea of rehabilitating "obscurity", or at least recognizing that "cost" is part of threat models, and you can raise costs for particular attack vectors by degrees instead of "to infinity". But SSH is a terrible example, because the cost to the defender of simply not having SSH vulnerabilities is the same, or even less, than the cost of obfuscating it with nonstandard ports, "port knocking", o…

"But SSH is a terrible example, because the cost to the defender of simply not having SSH vulnerabilities is the same, or even less, than the cost of obfuscating it with nonstandard ports, "port knocking", or fail2ban, which are all silly ideas." I know who I am arguing with here but port knocking is not silly. It's fantastic . When I say fantastic, I don't mean it solves all of our problems and obviates any other pr…

I understand how port knocking can throw off nmap and reduce brute force traffic.

Does it solve anything else?

> I believe there are sshd vulns extant that you and I don't know about and port knocking allows me to worry less about them.

Wouldn't you need to worry about vulnerabilities in knockd?

Re: Security by obscurity is underrated

#493

Post by athrowaway3z »

nickcw wrote: post #491

I'd argue that all security is security by obscurity, it is just a question of how many attacker-seconds it takes to break. Obscurity means keeping something private that if the attacker knew they could access your service. Traditionally security by obscurity is something like putting your ssh login port on port 61329 rather than port 22. I'd argue that the above is 16 bits of obscurity, whereas your ssh key you log…

Ik like this taken on it. But the math isnt complete. You need to account for each attack path taken.

For example: a generic SSH vulnerability means somebody is going to make a botnet to check every port 22, leaving your 1024 bits useless and the 16 bits worth more.

Re: Security by obscurity is underrated

#494

Post by theelous3 »

Macha wrote: post #206
Sebb767 wrote: post #170

Earlier quoted context omitted.

> Using a non-standard SSH port is a bad example because nmap can see through that deception in a few seconds. Compared to milliseconds. Do yourself the favor and open one sshd on port 22 vs one on a port >10000, then compare logs after a month. The 22 one will have thousands of attempts; the other one hardly tens if even any. The 99% level we're defending against here is root:123456 or pi:raspberry on port 22. Which…

So I get 10s of attempts a day for my sshd on port 7xxx. If I had an account with say ubuntu:ubuntu, it'd totally have been found by now.

So scale the other aide up too. Just imagine what it's like on 22.

Re: Security by obscurity is underrated

#495

Post by tptacek »

rsync wrote: post #478
tptacek wrote: post #376

Earlier quoted context omitted.

It doesn't add enough to compensate for its costs, which are commensurate with those of VPNs, which provide drastically more return on the investment. But VPNs don't have a cheering section, because they're so obviously useful that nobody has any incentive to make that banal observation. "Port knocking" is idiosyncratic and widely looked down on by security engineering teams, so there's a contrarian impulse that make…

""Port knocking" is idiosyncratic and widely looked down on by security engineering teams" I can't comment on that. I'm not a UNIX sysadmin because it's a rewarding career path with excellent opportunities for advancement. I'm a UNIX sysadmin because I truly love doing it and always have. I would do it for free.

That's why I do software security!

Re: Security by obscurity is underrated

#496

Post by rjkennedy98 »

miles wrote: post #98

Changing SSH port is far more efficacious at reducing nonsense than the Twitter poll in the article suggests: > "I ran an experiment with a virtual machine exposed to the internet which had sshd listening on port 22. The server stayed online for one week and then I changed the ssh port to 222. The number of attacks dropped by 98%. Even though this is solely empirical evidence, it’s clear that moving off the standard…

It's also way less effective than they mentioned because they didn't get hacked either way. So there was 0% difference in effectiveness between port 24 and 22 since the ssh was properly configured.

Security by obscurity only matters if you aren't secure in the first place. It can be a good extra layer of protection, but the worst examples of security mishaps I've seen are because people find the security unnecessarily burdensome and so they bypass it entirely. So in that way obscurity in that case has a real cost.

Re: Security by obscurity is underrated

#497

Post by austincheney »

blackflame7000 wrote: post #487
austincheney wrote: post #485

Earlier quoted context omitted.

If you cannot distinguish a trusted party from a malicious party everything is then potentially malicious. This is why we have certificates, certificate revocation, and trust authorities.

And that works great until a trust authority gets compromised. It's for this reason why the US DoD has it's own root certificate authorities and thus many military websites actually look like they have invalid https certs. Browsers don't ship with DoD root certs installed as trusted.

Yeah, I am on a DODIN as I write this. In the civilian world a CA falls back on a decentralized scheme called Web of Trust which allows CAs to recipricate certs from other CAs and invalidate other CAs as necessary.

The DOD chose to create their own CA scheme originally for financial reasons in that over a long enough time line new infrastructure pays for itself with expanded capabilities while minimizing operation costs dependent upon an outside service provider. This was before CACs were in use.

https://en.wikipedia.org/wiki/Web_of_trust

Re: Security by obscurity is underrated

#498

Post by zemnmez »

Security by obscurity is harder to reason about. Heavily obfuscated code is always more insecure once the obfuscation is reversed. The other big difference is you can incrementally break it; you are not going to be privy to if someone is selling your deobfuscated code online. Lastly, the example of randomising the presidential car i’d likely not call security by obscurity. Security by obscurity does not mean that there are secrets inherent to the protocol (or private keys would be obscurity!) if it was the same car every time, and they relied on nobody telling anybody, that’d be security by obscurity for me, otherwise it’s just a random value with a low keyspace

Re: Security by obscurity is underrated

#499

Post by blackflame7000 »

austincheney wrote: post #497
blackflame7000 wrote: post #487

Earlier quoted context omitted.

And that works great until a trust authority gets compromised. It's for this reason why the US DoD has it's own root certificate authorities and thus many military websites actually look like they have invalid https certs. Browsers don't ship with DoD root certs installed as trusted.

Yeah, I am on a DODIN as I write this. In the civilian world a CA falls back on a decentralized scheme called Web of Trust which allows CAs to recipricate certs from other CAs and invalidate other CAs as necessary. The DOD chose to create their own CA scheme originally for financial reasons in that over a long enough time line new infrastructure pays for itself with expanded capabilities while minimizing operation co…

Thanks for the additional info, I didnt know (but probably should have assumed) that finance was the primary motivator. I just had to implement CAC authentication for a webapp and they still use their own CAs for client-side certs aka cac’s so it seems like it was a pretty savy investment at the time that’s not going away anytime soon

Re: Security by obscurity is underrated

#500

Post by BlueTemplar »

voltagex_ wrote: post #420
acoard wrote: post #101

Earlier quoted context omitted.

>I think we can kind of view obscurity in the same way. It's a way to signal to a predator that we're a hard target and that they should give up. This has it completely backwards. Security through obscurity's goal is not to signal predators, it's the opposite. The goal is to obscure, to hide. The "signal" is there is nothing here (or nothing here worth your time). One of the best examples (it's in the article!) is ch…

I just turn off password authentication on SSH and moved to keys, then moved to IPv6. The automated scans haven't made it to v6 yet. The only better thing I could do is have an external v4 SSH honeypot that moves as slowly as possible to tie up a (tiny) resource.

IPv6 seems to be a good example of security by obscurity, with up to 64 bits of random IP adresses per machine, making scanning impossible in practice ?
Post reply on HN