3 ms·

I think your disagreement stems from a failure (on your part and the author's) to distinguish between targeted and dragnet attacks. With regards to the former,

I think your disagreement stems from a failure (on your part and the author's) to distinguish between targeted and dragnet attacks. With regards to the former, I emphatically agree with you. If you've been singled out by a competent attacker, you're subject to his statistical probing of your system, which is bound to reveal most (if not all) of the configuration/parametrization info you're trying to hide. In the case of dragnet attacks, however, I emphatically disagree. There is asymmetric cost imposed upon the attacker: time. Your door doesn't have to be impenetrable; it just has to be stronger than your neighbor's. Thoughts?

AstralStorm 10y ago
Why would you ever want to be vulnerable to targeted attack while only keeping dragnet ones at bay? Also such measures do not help any kind of a system that has to be really exposed. Want to hide your http and mail server behind a port knocking mechanism? A rarely supported or proprietary TLS method only?
- detaro 10y ago
  It doesn't make you more vulnerable to targeted attack, so why would you not want to additionally keep dragnet ones at bay?
  - tptacek 10y ago
    Because it's not doing anything to stop dragnet attacks either!
    - omginternets 10y ago
      Maybe "dragnet" wasn't the best term to use. I'm not talking about the NSA, but rather about automated brute-force attempts (think: random attempted ssh connections from the internet). With regards to that, not stopping automated attacks in general is fully-independent of being a less appealing target for such attacks. The latter -- even on it's own -- improves security.
      - tptacek 10y ago
        It's not doing anything to stop brute-force attempts! SSH keys already stop that attack cold!
        zippergz 10y ago
        So is this an argument that defense in depth is not a worthwhile strategy as long as you have a single "really good" layer of defense?
        tptacek 10y ago
        No, it's an argument not to waste time with pointless layers that impose no significant costs on attackers. Surely, you can't believe that "defense in depth" justifies arbitrary layers, or you'd also advocate for ROT-13 tunnels.
        zippergz 10y ago
        No, but I disagree that running sshd on an alternate port is an arbitrary layer. It is PROVEN that it prevents the automated mass scanners from even attempting to login. This you admit yourself when you mention the reduction in log noise. You are correct that a properly configured sshd has nothing to worry about with respect to these mass scanners. However, can we guarantee that we'll never make a configuration error? You're also correct that a pre-auth sshd vuln would be a HUGE deal. But can we guarantee one will never happen? Do you disagree that if a misconfiguration or a world-changing vulnerability were to happen, that a little time more to deal with it would be helpful? If I run something that is in any way vulnerable (whether via bug or misconfiguration) on port 22, it will be found within minutes (based on how often I see that port getting scanned today). Unless I'm being specifically targeted, an sshd running on an arbitrary port isn't going to get hit until/unless someone is running full port scans across the internet looking for it. I don't understand how you can argue that this is worthless. A measure that isn't useful against a determined and targeted attacker can still be useful. The adversaries that most of us face in the real world are looking for the path of least resistance, not access to our specific systems.
- deleted 10y ago
  [deleted]
crumpled 10y ago
I agree, for example: When a WordPress vulnerability is found, millions of sites are at risk. The large installation base is enough incentive for people to relentlessly scrutinize WordPress for vulnerabilities. Your home-made CMS isn't going to attract attackers because the spoils are limited to one site, and the code isn't readily available. That doesn't mean your CMS is more secure; it probably isn't. But it's going to take a focused effort to attack, and an exploit becomes less likely.
- zippergz 10y ago
  Even making minor changes to the Wordpress URLs from the defaults is enough to avoid getting hit by most (if not all) of the automated exploit I see on a day to day basis.

AstralStorm 10y ago

Why would you ever want to be vulnerable to targeted attack while only keeping dragnet ones at bay? Also such measures do not help any kind of a system that has to be really exposed. Want to hide your http and mail server behind a port knocking mechanism? A rarely supported or proprietary TLS method only?

detaro 10y ago
It doesn't make you more vulnerable to targeted attack, so why would you not want to additionally keep dragnet ones at bay?
- tptacek 10y ago
  Because it's not doing anything to stop dragnet attacks either!
  - omginternets 10y ago
    Maybe "dragnet" wasn't the best term to use. I'm not talking about the NSA, but rather about automated brute-force attempts (think: random attempted ssh connections from the internet). With regards to that, not stopping automated attacks in general is fully-independent of being a less appealing target for such attacks. The latter -- even on it's own -- improves security.
    - tptacek 10y ago
      It's not doing anything to stop brute-force attempts! SSH keys already stop that attack cold!
      - zippergz 10y ago
        So is this an argument that defense in depth is not a worthwhile strategy as long as you have a single "really good" layer of defense?
        tptacek 10y ago
        No, it's an argument not to waste time with pointless layers that impose no significant costs on attackers. Surely, you can't believe that "defense in depth" justifies arbitrary layers, or you'd also advocate for ROT-13 tunnels.
        zippergz 10y ago
        No, but I disagree that running sshd on an alternate port is an arbitrary layer. It is PROVEN that it prevents the automated mass scanners from even attempting to login. This you admit yourself when you mention the reduction in log noise. You are correct that a properly configured sshd has nothing to worry about with respect to these mass scanners. However, can we guarantee that we'll never make a configuration error? You're also correct that a pre-auth sshd vuln would be a HUGE deal. But can we guarantee one will never happen? Do you disagree that if a misconfiguration or a world-changing vulnerability were to happen, that a little time more to deal with it would be helpful? If I run something that is in any way vulnerable (whether via bug or misconfiguration) on port 22, it will be found within minutes (based on how often I see that port getting scanned today). Unless I'm being specifically targeted, an sshd running on an arbitrary port isn't going to get hit until/unless someone is running full port scans across the internet looking for it. I don't understand how you can argue that this is worthless. A measure that isn't useful against a determined and targeted attacker can still be useful. The adversaries that most of us face in the real world are looking for the path of least resistance, not access to our specific systems.
deleted 10y ago
[deleted]

crumpled 10y ago

I agree, for example: When a WordPress vulnerability is found, millions of sites are at risk. The large installation base is enough incentive for people to relentlessly scrutinize WordPress for vulnerabilities. Your home-made CMS isn't going to attract attackers because the spoils are limited to one site, and the code isn't readily available. That doesn't mean your CMS is more secure; it probably isn't. But it's going to take a focused effort to attack, and an exploit becomes less likely.

zippergz 10y ago
Even making minor changes to the Wordpress URLs from the defaults is enough to avoid getting hit by most (if not all) of the automated exploit I see on a day to day basis.