Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security by obscurity is underrated

utkusen.com

Post reply on HN
Print view View original

521–530 of 530 posts

Re: Security by obscurity is underrated

#521

Post by alexchamberlain »

acoard wrote: post #101
Verdex wrote: post #65

Earlier quoted context omitted.

In nature, prey animals will sometimes jump when they spot a predator[1]. One of the explanations is that this is the animal communicating to the predator that it is a healthy prey animal that would be hard to catch and therefore the predator should choose to chase someone else. I think we can kind of view obscurity in the same way. It's a way to signal to a predator that we're a hard target and that they should give…

>I think we can kind of view obscurity in the same way. It's a way to signal to a predator that we're a hard target and that they should give up. This has it completely backwards. Security through obscurity's goal is not to signal predators, it's the opposite. The goal is to obscure, to hide. The "signal" is there is nothing here (or nothing here worth your time). One of the best examples (it's in the article!) is ch…

I find the SSH example slightly odd, when all you need to do is disable password authentication and root access. Moving away from port 22 just seems a little excessive?

Re: Security by obscurity is underrated

#522

Post by sedatk »

austincheney wrote: post #447
sedatk wrote: post #428

Earlier quoted context omitted.

Theoretically, yes. But if it makes you get off the radar of some malicious attacker who is capable of exploiting you, then the mission is accomplished.

Not at all. The attacker will find it within a minute after running a port scan.

Not applicable to mass scanners. They simply can’t afford scanning all ports for all hosts.

Re: Security by obscurity is underrated

#523

Post by rsync »

Kalium wrote: post #514
rsync wrote: post #294

Earlier quoted context omitted.

I will again agree with you that the VPN is a more robust and more complete protection. You are correct. I think the reason I continue to prefer (and evangelize) port knocking is that the intersection of (modest) security gain and simplicity/robustness hits a sweet spot for me. Again, 10+ years in production on many hosts, worldwide, and never so much as a blip. IF knockd were to fail, it would fail in a very boring…

Not to be That Guy, but what I'm reading is that you have the wonderful opportunity before you to learn about VPNs until they fail in boring ways!

That's not how that works.

Simple systems tend to fail in boring ways. Complex systems tend to fail in interesting ways. Learning more about a complex system, while rewarding in many ways, will not change that identity.

Re: Security by obscurity is underrated

#524

Post by tha0x4 »

cthalupa wrote: post #459
ThA0x2 wrote: post #450

Earlier quoted context omitted.

>You, uh, do know who you're replying to, right? https://sockpuppet.org/me/ if not This means nothing to me? I see a shitty website from probably a has-been "security researcher". >I don't mention this to go "lol he must be right because of who he is", but calling a well respected security researcher with plenty of real world street cred ignorant is a bit much. That's sad. Speaks volumes about how meaningless that te…

>Wrong. SPA does not suffer from any MITM attacks. Care to elaborate? Not even fwknop documentation claims to be secure from all mitm attacks: >Automatic resolution of external IP address via cipherdyne.org/cgi-bin/myip (this is useful when the fwknop client is run from behind a NAT device). Because the external IP address is encrypted within each SPA packet in this mode, Man-in-the-Middle (MITM) attacks where an inl…

>Care to elaborate? Not even fwknop documentation claims to be secure from all mitm attacks:

You made the claim. You prove it with documentation.

>If I'm MITM'ing you from the same Starbucks or am otherwise behind the same NAT as you, I don't care if you've got the IP encrypted in the packet when I forward it on.

That is by definition NOT a MITM attack.

>There's not enough billion dollar unicorns out there to actually have a lot of dollars, even if 100% of them lacked corporate VPNs :D

The example is only billion dollar ones. If I include +$10m+ ones, I'd have enough to dollars to buy a new laptop ;D!

>Regardless, you don't even need a full on corporate VPN. You can throw up a tiny VM for your VPN in the same private subnet as your servers, only listen on 22 on the private IPs for the servers. You can do this in less than an hour with Wireguard. Super easy.

You just described a bastion host, and port knocking makes sense on those as well LOL. Wireguard only currently supports UDP, which can and had been a limitation in the past.

Re: Security by obscurity is underrated

#525

Post by cthalupa »

tha0x4 wrote: post #524
cthalupa wrote: post #459

Earlier quoted context omitted.

>Wrong. SPA does not suffer from any MITM attacks. Care to elaborate? Not even fwknop documentation claims to be secure from all mitm attacks: >Automatic resolution of external IP address via cipherdyne.org/cgi-bin/myip (this is useful when the fwknop client is run from behind a NAT device). Because the external IP address is encrypted within each SPA packet in this mode, Man-in-the-Middle (MITM) attacks where an inl…

>Care to elaborate? Not even fwknop documentation claims to be secure from all mitm attacks: You made the claim. You prove it with documentation. >If I'm MITM'ing you from the same Starbucks or am otherwise behind the same NAT as you, I don't care if you've got the IP encrypted in the packet when I forward it on. That is by definition NOT a MITM attack. >There's not enough billion dollar unicorns out there to actuall…

>You made the claim. You prove it with documentation.

I... er, did?

>That is by definition NOT a MITM attack.

You're intercepting the packet and blocking it by being in the path.

>You just described a bastion host, and port knocking makes sense on those as well LOL. Wireguard only currently supports UDP, which can and had been a limitation in the past.

Bastion hosts are generally SSH/RDP/VNC type affairs. SSH in to the bastion and then you have access to the other servers. This is actually how I set things up in production environments - the VPN concentrator only allows access to the jumphosts, and then there's extensive logging and auditing there.

I'm not sure why Wireguard only supporting UDP would be a problem - you can pass whatever type of traffic inside of the tunnel.

Re: Security by obscurity is underrated

#526

Post by tha0x4 »

cthalupa wrote: post #525
tha0x4 wrote: post #524

Earlier quoted context omitted.

>Care to elaborate? Not even fwknop documentation claims to be secure from all mitm attacks: You made the claim. You prove it with documentation. >If I'm MITM'ing you from the same Starbucks or am otherwise behind the same NAT as you, I don't care if you've got the IP encrypted in the packet when I forward it on. That is by definition NOT a MITM attack. >There's not enough billion dollar unicorns out there to actuall…

>You made the claim. You prove it with documentation. I... er, did? >That is by definition NOT a MITM attack. You're intercepting the packet and blocking it by being in the path. >You just described a bastion host, and port knocking makes sense on those as well LOL. Wireguard only currently supports UDP, which can and had been a limitation in the past. Bastion hosts are generally SSH/RDP/VNC type affairs. SSH in to t…

>I... er, did?

You... Ugh... Didn't? You claimed that it suffers from MITM attack. You are not able to prove that it suffers from any MITM attack (the docs specifically outline a way to mitigate a specific MITM attack, but do not outline any others). Unless you have a source that states otherwise, you're wrong.

>You're intercepting the packet and blocking it by being in the path.

Wrong, that is by definition not a MITM attack.

>Bastion hosts are generally SSH/RDP/VNC type affairs. SSH in to the bastion and then you have access to the other servers.

Correct, and you set up port knocking for these. Thanks for proving my point.

>This is actually how I set things up in production environments - the VPN concentrator only allows access to the jumphosts, and then there's extensive logging and auditing there.

There should be extensive logging and auditing on the bastion host. Port knocking reduces the noise to effectively 0.

>I'm not sure why Wireguard only supporting UDP would be a problem - you can pass whatever type of traffic inside of the tunnel.

There have been multiple instances where UDP has been block at sites in the past. Looks like you're ignorant to this. Look up why OpenVPN supports TCP.

Re: Security by obscurity is underrated

#527

Post by jeroenhd »

jameshart wrote: post #445
jeroenhd wrote: post #324

Earlier quoted context omitted.

There have been bugs found in SSH server implementations that allowed limited remote code execution or even authentication bypasses. Missing an update or two isn't bad when nobody can figure out how to connect to your server. Of course you have to update at some point. However, if someone drops a zero day on your SSH server while you're asleep you're probably glad that you've got a secret sauce to protect your server…

Why aren't you concerned that bugs will be found in your port knocking implementation? I think the main concern with port knocking is that it's observable . You're effectively sending your password in clear, so if someone can intercept or overhear your traffic then your secret is lost. Cryptographic authentication schemes like SSH itself or VPNs do not have this problem.

Port knocking is a way to decrease the amount of random 0day/brute force scripts finding their way into your server. It will only stop automated scripts and attackers that don't know who you are. It's obviously no protection against incentivized attackers.

A VPN has upsides and downsides. It obviously protects your server a lot better against directed attacks, but when you lose your laptop or when your computer gets ransomware'd, you can't get access to the server anymore.

Furthermore, code execution vulnerabilities have been found against VPN servers because of their immense complexity and OpenVPN can consume quite a lot of resources for a daemon doing nothing. WireGuard has changed the VPN landscape with its simplicity, but if you fear your server may not be updated all too often (because it's partially managed by a customer, because your colleagues might not care to do so after you leave), leaving a simple solution behind can have its upsides.

I'm not advocating that everyone should enable port knocking on their servers to make them secure or anything, but the "port knocking is always bad" crowd is often very loud despite the fact that there are small little ways port knocking can improve security with very little effort or increased attack surface.

Re: Security by obscurity is underrated

#530

Post by Kalium »

rsync wrote: post #523
Kalium wrote: post #514

Earlier quoted context omitted.

Not to be That Guy, but what I'm reading is that you have the wonderful opportunity before you to learn about VPNs until they fail in boring ways!

That's not how that works. Simple systems tend to fail in boring ways. Complex systems tend to fail in interesting ways. Learning more about a complex system, while rewarding in many ways, will not change that identity.

It's been my experience that a system's complexity (basic or complex) is less an intrinsic trait and more a matter of subjective perception, familiarity, and experience. Your experience is clearly different.
Post reply on HN