Security by obscurity is underrated • Hacker News Board

Re: Security by obscurity is underrated

#501

Post by speleding » Sat, Sep 12, 2020, 1:35 PM UTC

tptacek wrote: post #27

There's something to the idea of rehabilitating "obscurity", or at least recognizing that "cost" is part of threat models, and you can raise costs for particular attack vectors by degrees instead of "to infinity". But SSH is a terrible example, because the cost to the defender of simply not having SSH vulnerabilities is the same, or even less, than the cost of obfuscating it with nonstandard ports, "port knocking", o…

I agree that changing the SSH port may not be the best example of a low cost measure, since bypassing is also low cost.

I would like to see a list of suggestions of "low cost" ways to obscure systems that are (relatively) harder to counteract. But I guess as soon as anyone publishes such a list then hackers will start checking for them.

Re: Security by obscurity is underrated

#502

Post by kristianpaul » Sat, Sep 12, 2020, 1:37 PM UTC

cataflam wrote: post #13

Agree with the article. People have been misinterpreting "security by obscurity is bad" to mean any obscurity and obfuscation is bad. Instead it was originally meant as "if your only security is obscurity, it's bad". Many serious real-world scenarios do use obscurity as an additional layer. If only because sometimes, you know that a dedicated attacker will be able to breach, what you are looking for is to delay them…

Agree, Its a good/cheap first step !

Re: Security by obscurity is underrated

#503

Post by [deleted] » Sat, Sep 12, 2020, 1:49 PM UTC

[deleted]

Re: Security by obscurity is underrated

#504

Post by lowwave » Sat, Sep 12, 2020, 2:14 PM UTC

Totally! Security by obscurity is awsome!!!! Had a software running for over 10 years for many users. Never a hack because the backend is some very obscure framework on jvm. Just upgrade the JDK and everything still runs fine after over 10 years.

Re: Security by obscurity is underrated

#505

Post by BlueTemplar » Sat, Sep 12, 2020, 2:14 PM UTC

justinsaccount wrote: post #124

acdha wrote: post #87

Earlier quoted context omitted.

Only the 4th point is really true: if you run SSH on a non-standard port but it's otherwise accessible, you'll still see scans on a regular basis. Port knocking isn't a terrible idea but I generally prefer locking down the networks (or, these days, using AWS SSM / GCP IAP to avoid listening publicly at all) since having something on the internet means you're just one mistake away from problems and need to staff monit…

> Only the 4th point is really true: if you run SSH on a non-standard port but it's otherwise accessible, you'll still see scans on a regular basis. Possibly.. It does depend on the port. 222 and 2222 often are scanned with 22. 2200-2299 is probably common now. I was using 2221 for a bit but after a few years that started seeing some auth attempts. I mostly watched entire /16s, not single hosts.. the scan patterns fo…

What about entire /56s ? (Home user on IPv6.)

Re: Security by obscurity is underrated

#506

Post by lowwave » Sat, Sep 12, 2020, 2:17 PM UTC

lowwave wrote: post #504

Totally! Security by obscurity is awsome!!!! Had a software running for over 10 years for many users. Never a hack because the backend is some very obscure framework on jvm. Just upgrade the JDK and everything still runs fine after over 10 years.

However, comments like "SSH runs in port 22 and my credentials are utku:123456. What is the likelihood of being compromised?"

You have any idea what kind of RAM and computing power an average user have access now days. Think of better obscurity abstractions than that.

Try bcrypt/scrypt hash your shadow password on linux.

Re: Security by obscurity is underrated

#507

Post by BlueTemplar » Sat, Sep 12, 2020, 2:25 PM UTC

cthalupa wrote: post #459

ThA0x2 wrote: post #450

Earlier quoted context omitted.

>You, uh, do know who you're replying to, right? https://sockpuppet.org/me/ if not This means nothing to me? I see a shitty website from probably a has-been "security researcher". >I don't mention this to go "lol he must be right because of who he is", but calling a well respected security researcher with plenty of real world street cred ignorant is a bit much. That's sad. Speaks volumes about how meaningless that te…

>Wrong. SPA does not suffer from any MITM attacks. Care to elaborate? Not even fwknop documentation claims to be secure from all mitm attacks: >Automatic resolution of external IP address via cipherdyne.org/cgi-bin/myip (this is useful when the fwknop client is run from behind a NAT device). Because the external IP address is encrypted within each SPA packet in this mode, Man-in-the-Middle (MITM) attacks where an inl…

How does this work on IPv6 ?

Re: Security by obscurity is underrated

#508

Post by BlueTemplar » Sat, Sep 12, 2020, 2:35 PM UTC

wglb wrote: post #370

Raising the cost of attacks is a good thing, particularly if the cost of doing so is not too great. However, beware that obscurity is in the eye of the beholder, or more relevantly, in the eye of the attacker. For example, script kiddie attackers may be the ones who in the twitter example only scan the default ports. This is an important element to defend against. But a seriously skilled attacker isn't going to use s…

Is this why ~half of the people say that firewalls are not worth it for IPv6 ?

Re: Security by obscurity is underrated

#509

Post by AlexCoventry » Sat, Sep 12, 2020, 2:51 PM UTC

nordsieck wrote: post #198

thinkharderdev wrote: post #149

Earlier quoted context omitted.

Maybe a bit nitpicky but I think port-knocking is in kind of a grey area. You can think of it as a kind of password where you have to know the correct series of ports. Since the number of ports is quite large, there is also a correspondingly large number of possible port sequences so you can't, in principle, brute force it without a lot of effort.

> Maybe a bit nitpicky but I think port-knocking is in kind of a grey area. You can think of it as a kind of password where you have to know the correct series of ports. Yes. But you also have to know that port knocking is enabled at all. That's the obscurity part.

I think this implementation avoids that problem.

https://github.com/moxie0/knockknock

Re: Security by obscurity is underrated

#510

Post by ufmace » Sat, Sep 12, 2020, 2:57 PM UTC

aborsy wrote: post #486

cthalupa wrote: post #284

Earlier quoted context omitted.

>Imagine a 0day for SSH drops tomorrow. Almost immediately script kiddies all over the world will be trying to take over everything running on port 22. Yep! And I should be clear: I am not saying just don't change the SSH port. I'm saying if you care about security, at a minimum disallow public access to SSH and set up a VPN at a minimum. >Unfortunately that's all too rare in most web-servers I see ( I'm a bit confus…

For a non-expert individual who would like to replace commercial cloud storage with a self hosted server such as a NAS, do all these steps apply equally? I am limiting the services to simple storage. Looks like maintaining a secure self cloud requires knowledge, effort and continuous monitoring and vigilance.

Most of those are good practices for a substantial cloud of servers that are already expected to have sophisticated configuration management. They're easy to set up in that situation, and a good idea too because large clouds of servers are an attractive target - they may be expected to have lots of private data that an attacker might want to steal and lots of resources to be exploited.

A single server run by an individual and serving minimal traffic would have different requirements. It's a much less attractive target, and much harder to do most of those things. For example, it's always easy and a good idea to run SSH with root login and password authentication disabled, run services on non-root accounts with minimum required permissions, and not allow things to listen on public interfaces that shouldn't be. Setting up VPNs, jumpboxes, 2FA, etc is kind of pointless on that kind of setup.