4 ms·

>Often times, your system doesn't need to be Fort Knox: it just needs to be a more difficult target than the other guy's system. This is, of course, until some

by ryanlol 10y ago

>Often times, your system doesn't need to be Fort Knox: it just needs to be a more difficult target than the other guy's system. This is, of course, until someone actually wants to hack you. >but the best defense against zero-day attacks is to make your system hard to probe for odd behaviors This really isn't in line with the previous statement I quoted, rather unlikely that you'll get targeted with zero-day attacks unless someone is actually trying to hack you.

omginternets 10y ago
Yes, as I've stated elsewhere, obfuscation does little against targeted attacks. It's really about being an unappealing target because some degree manual work is involved. To be clear: these are not very strong security benefits, but I question the notion that they're marginal.
- ethbro 10y ago
  In contrast, I think they're getting progressively more and more useful in light of an increasingly larger and more automatedly hostile world network. I imagine in the 1970s there weren't a whole lot of hacks that began with "scan the entirety of ARPANET to find a few vulnerable machines, then apply vulnerability."
  - DanBC 10y ago
    >I imagine in the 1970s there weren't a whole lot of hacks that began with "scan the entirety of ARPANET to find a few vulnerable machines, then apply vulnerability." The RTM worm (1986?) springs to mind. Eugene Spafford write up: http://docs.lib.purdue.edu/cgi/viewcontent.cgi?article=1701&context=cstech http://docs.lib.purdue.edu/cgi/viewcontent.cgi?article=1701&... A different write up: https://news.ycombinator.com/item?id=5302924 https://news.ycombinator.com/item?id=5302924 With Microscope and Tweezers: http://www.mit.edu/~eichin/virus/main.html http://www.mit.edu/~eichin/virus/main.html
    - ethbro 10y ago
      Great links! (Refreshing my knowledge now) :-) My point was that the economics that justified 80s worms didn't exist in the 70s and earlier. There simply weren't enough systems networked to make an automated attack preferable over a bespoke, single-system approach. And extrapolate that change into the future with more and more machines of standardized config being connected to the internet... and automated attack and use becomes more and more attractive. Which means prevention of automated attack should become more useful.
  - omginternets 10y ago
    I tend to agree with you, but I'm a bit at a loss as to how we can gain some formal insight into this question. If an obfuscation layer were to reduce risk, what would that look like and how could we measure it? I'd be really interested in running an informal study.

by ryanlol 10y ago

omginternets 10y ago

Yes, as I've stated elsewhere, obfuscation does little against targeted attacks. It's really about being an unappealing target because some degree manual work is involved. To be clear: these are not very strong security benefits, but I question the notion that they're marginal.

ethbro 10y ago
In contrast, I think they're getting progressively more and more useful in light of an increasingly larger and more automatedly hostile world network. I imagine in the 1970s there weren't a whole lot of hacks that began with "scan the entirety of ARPANET to find a few vulnerable machines, then apply vulnerability."
- DanBC 10y ago
  >I imagine in the 1970s there weren't a whole lot of hacks that began with "scan the entirety of ARPANET to find a few vulnerable machines, then apply vulnerability." The RTM worm (1986?) springs to mind. Eugene Spafford write up: http://docs.lib.purdue.edu/cgi/viewcontent.cgi?article=1701&context=cstech http://docs.lib.purdue.edu/cgi/viewcontent.cgi?article=1701&... A different write up: https://news.ycombinator.com/item?id=5302924 https://news.ycombinator.com/item?id=5302924 With Microscope and Tweezers: http://www.mit.edu/~eichin/virus/main.html http://www.mit.edu/~eichin/virus/main.html
  - ethbro 10y ago
    Great links! (Refreshing my knowledge now) :-) My point was that the economics that justified 80s worms didn't exist in the 70s and earlier. There simply weren't enough systems networked to make an automated attack preferable over a bespoke, single-system approach. And extrapolate that change into the future with more and more machines of standardized config being connected to the internet... and automated attack and use becomes more and more attractive. Which means prevention of automated attack should become more useful.
- omginternets 10y ago
  I tend to agree with you, but I'm a bit at a loss as to how we can gain some formal insight into this question. If an obfuscation layer were to reduce risk, what would that look like and how could we measure it? I'd be really interested in running an informal study.