3 ms·

I've often felt there was an interesting discussion to have about obscurity. It's interesting because although the infosec community has such a strong reaction

I've often felt there was an interesting discussion to have about obscurity. It's interesting because although the infosec community has such a strong reaction to the phrase "security by obscurity", it has a very different reaction to the phrase "obfuscation". I'd like to propose a distinction between the two: - "security by obscurity" would refer to the non-declaration of configuration and parameters - "obfuscation" would refer to the deliberate fuzzing of statistical means by which such configuration and parameters can be discovered. The distinction is admittedly fuzzy, but the idea is that "security by obscurity" is trivially defeated by treating the target system as a statistical problem. If said system can be repeatedly probed, then useful information can be gleaned. With obfuscation, one is deliberately injecting noise into the signal that the attacker is trying to analyze. What do you all think? Is this a useful distinction? To be perfectly clear, I don't mean to imply that obfuscation is a sufficient security mechanism, but rather: 1. that obfuscation is more useful than plain-old obscurity 2. we should understand that infosec attacks are often statistical in nature Regarding point 2, I think this ends up shedding more light on what, exactly, is wrong with "security by obscurity" as it's often debated.

blakesterz 10y ago
1. & 2. Totally agree. On point 2 I've recently come to the conclusion that I can't worry about every damn thing. I follow all the ITSec news pretty closely and there's just SO MUCH WRONG with everything (or at least it feels like it). Security researchers seem to love to freak out about everything (it's their job after all)_but I just don't have the time. If something is going to be a likely attack, easily done, remotely, today or next month, then it's something I need to worry about. If this is a theoretical attack based on something happening in the room next door I need to shrug it off, for now. There's many many things that fall in between those two extremes, and that's where I'm afraid I'm not sure what to worry about sometimes.
- omginternets 10y ago
  I'd like to follow up on your post because you raise a lot of good points. In particular, we have a problem in infosec whereby "security" is implicitly equated to "security with cryptographic guarantees". I understand that "cryptographically secure" is the gold standard for infosec, but this misses a certain reality on the ground. Often times, your system doesn't need to be Fort Knox: it just needs to be a more difficult target than the other guy's system. I think this is where obfuscation comes in. With regards to well-known vulnerabilities, clearly cryptographic-grade solutions are required, but the best defense against zero-day attacks is to make your system hard to probe for odd behaviors. Why waste time doing statistical analyses on a system in the hopes of extracting a faint signal when another system literally responds to a port scan? I think the camouflage analogy in the article is a good one. Hardening your asset is necessary, but hiding it is even better. In my former military days, we were always told that "concealment is better than cover". It's hard to pull a flanking maneuver on a target you can't locate, but trivial to do so against a target you simply can't hit. I wouldn't go as far as to claim that the same is true in infosec, but it stands to reason that there's a place for concealment.
  - AstralStorm 10y ago
    But will you still detect the problems on your security make-up if you mostly rely on the fact that the vulnerability is not seen? I cringe every time someone says "it will never happen" or "it is too hard to exploit".
    - omginternets 10y ago
      >I cringe every time someone says "it will never happen" or "it is too hard to exploit". I think you misunderstand me. I'm not saying "it's too hard to exploit"; I'm saying "this helps me keep a low-profile and makes me a less appealing target". It's primarily a social-engineering hack in the sense that for all but the most targeted attacks, attackers chose easy targets. By analogy, I'm suggesting you not walk alone in a shady alley at night. >But will you still detect the problems on your security make-up if you mostly rely on the fact that the vulnerability is not seen? This is a valid and interesting question, imho. I would reply with the following questions, in trying to determine whether the cost of obfuscation outweighs it's benefits: 1. do you really have the means to continuously audit your attack surface? 2. what is to prevent you from rolling back your obfuscation mechanisms for a periodic audit? 3. can you configure things such that your obfuscation layer only points to external traffic (thus allowing for continuous auditing via some private port)? 4. more to your point: you seem to be implying that you'll never have a configuration error on your system. Isn't it true that obfuscation can potentially guard against the occasional glitch? There is a definite trade-off involved in obfuscation, but unless you're one of those (admirable!) people who use the best cryptography to privately discuss the best cryptography, I think the judicious use of "camouflage" generally improves security.
  - ryanlol 10y ago
    >Often times, your system doesn't need to be Fort Knox: it just needs to be a more difficult target than the other guy's system. This is, of course, until someone actually wants to hack you. >but the best defense against zero-day attacks is to make your system hard to probe for odd behaviors This really isn't in line with the previous statement I quoted, rather unlikely that you'll get targeted with zero-day attacks unless someone is actually trying to hack you.

blakesterz 10y ago

1. & 2. Totally agree. On point 2 I've recently come to the conclusion that I can't worry about every damn thing. I follow all the ITSec news pretty closely and there's just SO MUCH WRONG with everything (or at least it feels like it). Security researchers seem to love to freak out about everything (it's their job after all)_but I just don't have the time. If something is going to be a likely attack, easily done, remotely, today or next month, then it's something I need to worry about. If this is a theoretical attack based on something happening in the room next door I need to shrug it off, for now. There's many many things that fall in between those two extremes, and that's where I'm afraid I'm not sure what to worry about sometimes.

omginternets 10y ago
I'd like to follow up on your post because you raise a lot of good points. In particular, we have a problem in infosec whereby "security" is implicitly equated to "security with cryptographic guarantees". I understand that "cryptographically secure" is the gold standard for infosec, but this misses a certain reality on the ground. Often times, your system doesn't need to be Fort Knox: it just needs to be a more difficult target than the other guy's system. I think this is where obfuscation comes in. With regards to well-known vulnerabilities, clearly cryptographic-grade solutions are required, but the best defense against zero-day attacks is to make your system hard to probe for odd behaviors. Why waste time doing statistical analyses on a system in the hopes of extracting a faint signal when another system literally responds to a port scan? I think the camouflage analogy in the article is a good one. Hardening your asset is necessary, but hiding it is even better. In my former military days, we were always told that "concealment is better than cover". It's hard to pull a flanking maneuver on a target you can't locate, but trivial to do so against a target you simply can't hit. I wouldn't go as far as to claim that the same is true in infosec, but it stands to reason that there's a place for concealment.
- AstralStorm 10y ago
  But will you still detect the problems on your security make-up if you mostly rely on the fact that the vulnerability is not seen? I cringe every time someone says "it will never happen" or "it is too hard to exploit".
  - omginternets 10y ago
    >I cringe every time someone says "it will never happen" or "it is too hard to exploit". I think you misunderstand me. I'm not saying "it's too hard to exploit"; I'm saying "this helps me keep a low-profile and makes me a less appealing target". It's primarily a social-engineering hack in the sense that for all but the most targeted attacks, attackers chose easy targets. By analogy, I'm suggesting you not walk alone in a shady alley at night. >But will you still detect the problems on your security make-up if you mostly rely on the fact that the vulnerability is not seen? This is a valid and interesting question, imho. I would reply with the following questions, in trying to determine whether the cost of obfuscation outweighs it's benefits: 1. do you really have the means to continuously audit your attack surface? 2. what is to prevent you from rolling back your obfuscation mechanisms for a periodic audit? 3. can you configure things such that your obfuscation layer only points to external traffic (thus allowing for continuous auditing via some private port)? 4. more to your point: you seem to be implying that you'll never have a configuration error on your system. Isn't it true that obfuscation can potentially guard against the occasional glitch? There is a definite trade-off involved in obfuscation, but unless you're one of those (admirable!) people who use the best cryptography to privately discuss the best cryptography, I think the judicious use of "camouflage" generally improves security.
- ryanlol 10y ago
  >Often times, your system doesn't need to be Fort Knox: it just needs to be a more difficult target than the other guy's system. This is, of course, until someone actually wants to hack you. >but the best defense against zero-day attacks is to make your system hard to probe for odd behaviors This really isn't in line with the previous statement I quoted, rather unlikely that you'll get targeted with zero-day attacks unless someone is actually trying to hack you.