Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security by obscurity is underrated

utkusen.com

Post reply on HN
Print view View original

511–520 of 530 posts

Re: Security by obscurity is underrated

#511

Post by thomasahle »

MrStonedOne wrote: post #449
jameshart wrote: post #445

Earlier quoted context omitted.

Why aren't you concerned that bugs will be found in your port knocking implementation? I think the main concern with port knocking is that it's observable . You're effectively sending your password in clear, so if someone can intercept or overhear your traffic then your secret is lost. Cryptographic authentication schemes like SSH itself or VPNs do not have this problem.

but what does getting past port knocking help with? now they have to find a bug with ssh.

If OP has a false sense of security due to port knocking the ssh may not have been updated as recently.

Re: Security by obscurity is underrated

#512

Post by ufmace »

wazoox wrote: post #82
tptacek wrote: post #27

There's something to the idea of rehabilitating "obscurity", or at least recognizing that "cost" is part of threat models, and you can raise costs for particular attack vectors by degrees instead of "to infinity". But SSH is a terrible example, because the cost to the defender of simply not having SSH vulnerabilities is the same, or even less, than the cost of obfuscating it with nonstandard ports, "port knocking", o…

I use SSH keys, and disabled passwords. However when I was running SSH on port 22, the number of attempts was slowing my machine to a crawl at times. Moving the port to some obscure random one divided the number of requests from several thousands per hour to a few per day. Definitely an improvement by any measure : suddenly you can analyze the attacks if necessary. I run fail2ban on top of it, because why not? In cas…

I gotta wonder - how in the world can you ever get enough failed SSH login attempts to noticeably affect system performance?

I usually have several cloud servers running with a normally secured SSHD running. There's some failed login attempts yeah. I've never seen even 1% CPU usage from them. I doubt even posting my server address on every hacking forum I could find and daring them to try and hack me would result in getting enough failed SSH login attempts to blip my CPU usage. I have no idea how that could even happen, aside from somebody intentionally targeting your server with a really weird attack for whatever reason.

Re: Security by obscurity is underrated

#513

Post by MaxBarraclough »

daenz wrote: post #42

No mention of port knocking for SSH. I used to be scanned constantly for SSH logins. So I changed the port. The login attempts stopped for awhile, but eventually they found the port. Now with port knocking, I haven't seen a single attempt. Security by obscurity alone is bad, but as another layer, it can be great.

If you don't need to support access from arbitrary IPs, IP whitelisting is another good additional layer over SSH. Keeps the SSH scanners out, and also significantly raises the bar for a determined attacker.

Re: Security by obscurity is underrated

#514

Post by Kalium »

rsync wrote: post #294
cthalupa wrote: post #256

Earlier quoted context omitted.

I guess my point is largely: I can set up a VPN in a roughly similar timeframe to setting up port knocking, and it has roughly similar overhead for end user, but the VPN gives me significantly more security while also solving the same issue port knocking does. In that case, why not just set up a VPN instead of port knocking?

I will again agree with you that the VPN is a more robust and more complete protection. You are correct. I think the reason I continue to prefer (and evangelize) port knocking is that the intersection of (modest) security gain and simplicity/robustness hits a sweet spot for me. Again, 10+ years in production on many hosts, worldwide, and never so much as a blip. IF knockd were to fail, it would fail in a very boring…

Not to be That Guy, but what I'm reading is that you have the wonderful opportunity before you to learn about VPNs until they fail in boring ways!

Re: Security by obscurity is underrated

#515

Post by ThA0x2 »

cthalupa wrote: post #459
ThA0x2 wrote: post #450

Earlier quoted context omitted.

>You, uh, do know who you're replying to, right? https://sockpuppet.org/me/ if not This means nothing to me? I see a shitty website from probably a has-been "security researcher". >I don't mention this to go "lol he must be right because of who he is", but calling a well respected security researcher with plenty of real world street cred ignorant is a bit much. That's sad. Speaks volumes about how meaningless that te…

>Wrong. SPA does not suffer from any MITM attacks. Care to elaborate? Not even fwknop documentation claims to be secure from all mitm attacks: >Automatic resolution of external IP address via cipherdyne.org/cgi-bin/myip (this is useful when the fwknop client is run from behind a NAT device). Because the external IP address is encrypted within each SPA packet in this mode, Man-in-the-Middle (MITM) attacks where an inl…

>Care to elaborate? Not even fwknop documentation claims to be secure from all mitm attacks:

You made the claim. You prove it with documentation.

>If I'm MITM'ing you from the same Starbucks or am otherwise behind the same NAT as you, I don't care if you've got the IP encrypted in the packet when I forward it on.

That is by definition NOT a MITM attack.

>There's not enough billion dollar unicorns out there to actually have a lot of dollars, even if 100% of them lacked corporate VPNs :D

The example is only billion dollar ones. If I include +$10m+ ones, I'd have enough to dollars to buy a new laptop ;D!

>Regardless, you don't even need a full on corporate VPN. You can throw up a tiny VM for your VPN in the same private subnet as your servers, only listen on 22 on the private IPs for the servers. You can do this in less than an hour with Wireguard. Super easy.

You just described a bastion host, and port knocking makes sense on those as well LOL. Wireguard only currently supports UDP, which can and had been a limitation in the past.

Re: Security by obscurity is underrated

#516

Post by e40 »

crazygringo wrote: post #309
e40 wrote: post #207

Earlier quoted context omitted.

The number of times I've seen people shitting all over port knocking is truly confusing. Since we added it several years ago, we've not had a single case of hackers trying to break into sshd. Before port knocking, 100's a day, even though it was on a very unusual port. I try to tell people this, when they poo poo port knocking, but they just don't get it. EDIT: s/the/they/

But serious question -- what exactly is the benefit? Before, it's not like they were getting in anyways if you were using keys. So I confess I still don't "get it". Unless you just want cleaner logs or something. I assume you're still getting the same number of initial connection attempts per day, but just not recording them? Is it something to do with network or CPU consumption related to failed subsequent attempts…

It is as simple as reducing an attack surface. If attackers can't talk to sshd, then can't try to hack it. In a world where zero days are real, why chance it?

Why is that so hard to grasp. Still boggles my mind.

Re: Security by obscurity is underrated

#517

Post by e40 »

thomasahle wrote: post #511
MrStonedOne wrote: post #449

Earlier quoted context omitted.

but what does getting past port knocking help with? now they have to find a bug with ssh.

If OP has a false sense of security due to port knocking the ssh may not have been updated as recently.

We update sshd daily, as we are on CentOS and use the official updates. Nice guess, though.

Re: Security by obscurity is underrated

#518

Post by 10000truths »

rjkennedy98 wrote: post #496
miles wrote: post #98

Changing SSH port is far more efficacious at reducing nonsense than the Twitter poll in the article suggests: > "I ran an experiment with a virtual machine exposed to the internet which had sshd listening on port 22. The server stayed online for one week and then I changed the ssh port to 222. The number of attacks dropped by 98%. Even though this is solely empirical evidence, it’s clear that moving off the standard…

It's also way less effective than they mentioned because they didn't get hacked either way. So there was 0% difference in effectiveness between port 24 and 22 since the ssh was properly configured. Security by obscurity only matters if you aren't secure in the first place. It can be a good extra layer of protection, but the worst examples of security mishaps I've seen are because people find the security unnecessaril…

Even unsuccessful SSH attempts can have operational costs, though. The machine still accepts the TCP connection and does the SSH handshake. If I’m running a server and I’m billed by data usage or by vCPU minutes, I don’t want to waste my allotted resources by making it easy for every half-baked crawler around the world to make connections to my machine. Using a non-default port cuts down those numbers significantly. Sure, a targeted attack won’t be thwarted, but at least the server is not being DDoS’ed anymore.

Re: Security by obscurity is underrated

#519

Post by Merrill »

"Roll your own crypto" may not be entirely bad either.

Suppose that you encrypt your message using "my own crypto". The result is ciphertext that looks like a random bit sring. Then encrypt the ciphertext using a standard algorithm such as AES.

An attacker will have difficulty since a successful decryption of AES is hard to recognize as such.

Re: Security by obscurity is underrated

#520

Post by thomasahle »

Merrill wrote: post #519

"Roll your own crypto" may not be entirely bad either. Suppose that you encrypt your message using "my own crypto". The result is ciphertext that looks like a random bit sring. Then encrypt the ciphertext using a standard algorithm such as AES. An attacker will have difficulty since a successful decryption of AES is hard to recognize as such.

Or you could spend that extra compute on just using a longer AES key. (Or if you distrust AES itself, make your second layer some other well thought through encryption scheme.)
Post reply on HN