5 ms·

Martin Fowler's Gothic Hotel Model – How It Should Be Done

71 points by UltraDark 9y ago

iaw 9y ago
Can anyone dumb this down just a little?
- BrentOzar 9y ago
  Simplified example: to open up access to a database server port, you’d have to send specific packets in a specific sequence on specific ports. It’s kinda like doing a secret knock on a series of doors in a neighborhood before an entirely new door opens up in the side of a building. And if you knock blindly on a few doors, the system knows you’re an intruder, and no soup for you even if you stumble into the right knock sequence.
  - otoburb 9y ago
    >>to open up access to a database server port, you’d have to send specific packets in a specific sequence on specific ports AKA port knocking[1], minus the special twist at the end where an intrusion/network detection system (IDS or NDS) automagically detects failed port knocks and responds accordingly. [1] https://en.wikipedia.org/wiki/Port_knocking https://en.wikipedia.org/wiki/Port_knocking
    - rhizome 9y ago
      I used to use portsentry in a similar way, but this looks interesting as a preset sequence of port knocks, rather than shitcanning any client that steps on a landmine port.
  - darkmighty 9y ago
    Why not just a password? (you can also lock out after X incorrect attempts) I don't see benefits except for additional security through obscurity factor, which crypto wisdom dictates should not be relied upon.
    - ShaneWilton 9y ago
      Security through obscurity is a very misunderstood concept. It should never be used at the expense of proper security (i.e. rolling your own crypto), and you should always act under the assumption that targeted attackers can see through your obscurity, but it can be a valuable part of defense in depth: especially against unskilled attackers. Consider an 0day for example. When the 0day is published, attackers are going to mass-scan the internet for vulnerable applications. Your WAFs, etc won't yet block the attack, and if you have a vulnerable application that must be externally facing, you may get hit by this mass-scan. If your applications are protected with port knocking, however, you'll have that extra window of time to apply patches and protect yourself before you're directly targeted.
      - darkmighty 9y ago
        Well, but if port knocking was a great effective security tool, everyone would be using it, which defeats the obscurity advantage and would bring it back on par with good old passwords. It might be a decent extra tool for very delicate situations, but I find it reasonably clear that it's largely self-defeating and not to be relied upon. It can also introduce further bugs. I can see it could have an appeal as a proper password system though (not an obscurity device), since it's really the first step in interacting with a server. With password protocols, you usually have a more complicated interaction that can open a greater surface area. It seems good practice to authenticate absolutely as soon as possible.
        ShaneWilton 9y ago
        The benefit of port knocking is that it essentially gives you a channel to transmit a password over, without revealing the existence of the system that's being authenticated for. A traditional password, on the other hand, requires some sort of socket that leaks the presence of a listening server. Even if everybody were to use port knocking, knowing that fact doesn't give you any knowledge about whether a given IP hosts zero, one, or some arbitrary number of possibly vulnerable services.
        pc86 9y ago
  - trhway 9y ago
    to me it sounds like a typical safe lock - 2 turns left, 3 and half right, ... >to send specific packets in a specific sequence on specific ports. like Gothic Motel model itself it looks like an unnecessary complication. I think we can get pretty much the same effect if typical password (its hash) was sent in a sequence of say 10 packets instead of 1.
  - revelation 9y ago
    Guys, try reading the linked article first? This is just an example on a state machine and the linked article is on how to model them. It has nothing at all to do with port knocking.
    - mannykannot 9y ago
      Having not heard of this Analysis Design Matrix thing before, it was not clear to me what the linked article was going on about. From the home page, I read that "Matrix is a fundamentally new conceptual framework for thinking about Software Engineering and Model Compiler development", though at first sight, it looks very 1990s / CASE - like. It is perhaps unfortunate that the introduction page contains a 45-line "hello world" program, as this presumably does not show its intended purpose.
      - UltraDark 9y ago
        What you're reading here is the second example model based on Martin Fowler's original model. It's one of a series of demo models that shows off the Matrix modeling language. A theme of the site is to push the idea generating code from models by using Model Compilers to continuously improve and optimise future Model Compilers as shown graphically in the Analysis Design Matrix Diagram.
  - InvisibleCities 9y ago
    Maybe I am missing something, but wouldn't this be vulnerable to a man in the middle attack?
    - solotronics 9y ago
      not if the sequence changes based on some predetermined pattern
      - InvisibleCities 9y ago
        Hmmmm. I don't know if I buy that. If the pattern is not cryptographically secure, then you're still vulnerable to man in the middle, and if it is cryptographically secure, wouldn't you get roughly the same security by just doing standard SSH key based auth?
        mannykannot 9y ago
        Isn't the point to have some defense in depth, so if there is a zero-day exploit found for your SSH authentication, you are not wide open? In a way like the grooves on a key for a pin-tumbler lock.
      - quincunx 9y ago
        That would cover a replay attack, but not a man in the middle attack (as the mitm would just intercept the new port knock pattern.)
    - ShaneWilton 9y ago
      Only in the case of naive port knocking. You can always generate the knocking sequence with something like TOTP to avoid replay attacks, while also detecting attempts at replaying a previous knock. Edit: Sorry I misread your comment as talking about replay attacks, not MITM'ing. I'm not an expert, but I believe MITM attacks are typically mitigated by performing the knock out of band over a covert channel (DNS, etc). AFAIK, there isn't really a way to prevent them entirely.
    - icebraining 9y ago
- UltraDark 9y ago
  The main point is that it's far better to model a system by thinking about the things which already exist in that system than it is to fit all the functionality into a single state machine implementation.
retrogradeorbit 9y ago
Who gave it such a ridiculous name? Trust Fowler to take something that's been around for thirty years and give it a name that doesn't invoke any sense of what it actually is. This has been around since at least the 90s, but back then it was called port knocking. I remember seeing an implementation in the 90s that required different ICMP echo packet sizes (say 56, 64, 64, then 56 bytes) sent in order for the system to unfirewall a particular service port for that incoming IP.
- loopbit 9y ago
  Although I kind of share your anger at giving weird names to stuff that's been there for decades[0], port knocking could be considered as just one specific case of this pattern and not the general case. What if we don't use different ports? Your example uses ICMP packages with different sizes, not ports. What if you use something at the application layer that doesn't require ports, maybe a sequence of (invalid) calls to separate end-points? Personally, I don't care how it's called as long as everyone agrees on what it is and here, again, I agree with you in that "Gothic Hotel" might not be the best name. [0] Just the other day I heard a plain-old FTP server described as "cloud-based storage service".
- eggy 9y ago
  Agree on the naming bit. Haskell - named after a famous logician; LISP - LISt Processor; APL - A Programming Language...Fortran, Ada, all have sensible names, or easy to reason about or guess. Now, 'kitten', Rust, Lua, Joy, Python, well, I like them, but you get the point. Don't even mention startup company names!
codeulike 9y ago
People are discussing this in a security context, but that's not what its about. This article is about modelling and analysis and the 'gothic hotel' model is just an interesting imaginary situation to try and analyse. And its a very useful example because its a state machine.

71 points by UltraDark 9y ago

iaw 9y ago

Can anyone dumb this down just a little?

BrentOzar 9y ago
Simplified example: to open up access to a database server port, you’d have to send specific packets in a specific sequence on specific ports. It’s kinda like doing a secret knock on a series of doors in a neighborhood before an entirely new door opens up in the side of a building. And if you knock blindly on a few doors, the system knows you’re an intruder, and no soup for you even if you stumble into the right knock sequence.
- otoburb 9y ago
  >>to open up access to a database server port, you’d have to send specific packets in a specific sequence on specific ports AKA port knocking[1], minus the special twist at the end where an intrusion/network detection system (IDS or NDS) automagically detects failed port knocks and responds accordingly. [1] https://en.wikipedia.org/wiki/Port_knocking https://en.wikipedia.org/wiki/Port_knocking
  - rhizome 9y ago
    I used to use portsentry in a similar way, but this looks interesting as a preset sequence of port knocks, rather than shitcanning any client that steps on a landmine port.
- darkmighty 9y ago
  Why not just a password? (you can also lock out after X incorrect attempts) I don't see benefits except for additional security through obscurity factor, which crypto wisdom dictates should not be relied upon.
  - ShaneWilton 9y ago
    Security through obscurity is a very misunderstood concept. It should never be used at the expense of proper security (i.e. rolling your own crypto), and you should always act under the assumption that targeted attackers can see through your obscurity, but it can be a valuable part of defense in depth: especially against unskilled attackers. Consider an 0day for example. When the 0day is published, attackers are going to mass-scan the internet for vulnerable applications. Your WAFs, etc won't yet block the attack, and if you have a vulnerable application that must be externally facing, you may get hit by this mass-scan. If your applications are protected with port knocking, however, you'll have that extra window of time to apply patches and protect yourself before you're directly targeted.
    - darkmighty 9y ago
      Well, but if port knocking was a great effective security tool, everyone would be using it, which defeats the obscurity advantage and would bring it back on par with good old passwords. It might be a decent extra tool for very delicate situations, but I find it reasonably clear that it's largely self-defeating and not to be relied upon. It can also introduce further bugs. I can see it could have an appeal as a proper password system though (not an obscurity device), since it's really the first step in interacting with a server. With password protocols, you usually have a more complicated interaction that can open a greater surface area. It seems good practice to authenticate absolutely as soon as possible.
      - ShaneWilton 9y ago
        The benefit of port knocking is that it essentially gives you a channel to transmit a password over, without revealing the existence of the system that's being authenticated for. A traditional password, on the other hand, requires some sort of socket that leaks the presence of a listening server. Even if everybody were to use port knocking, knowing that fact doesn't give you any knowledge about whether a given IP hosts zero, one, or some arbitrary number of possibly vulnerable services.
      - pc86 9y ago
- trhway 9y ago
  to me it sounds like a typical safe lock - 2 turns left, 3 and half right, ... >to send specific packets in a specific sequence on specific ports. like Gothic Motel model itself it looks like an unnecessary complication. I think we can get pretty much the same effect if typical password (its hash) was sent in a sequence of say 10 packets instead of 1.
- revelation 9y ago
  Guys, try reading the linked article first? This is just an example on a state machine and the linked article is on how to model them. It has nothing at all to do with port knocking.
  - mannykannot 9y ago
    Having not heard of this Analysis Design Matrix thing before, it was not clear to me what the linked article was going on about. From the home page, I read that "Matrix is a fundamentally new conceptual framework for thinking about Software Engineering and Model Compiler development", though at first sight, it looks very 1990s / CASE - like. It is perhaps unfortunate that the introduction page contains a 45-line "hello world" program, as this presumably does not show its intended purpose.
    - UltraDark 9y ago
      What you're reading here is the second example model based on Martin Fowler's original model. It's one of a series of demo models that shows off the Matrix modeling language. A theme of the site is to push the idea generating code from models by using Model Compilers to continuously improve and optimise future Model Compilers as shown graphically in the Analysis Design Matrix Diagram.
- InvisibleCities 9y ago
  Maybe I am missing something, but wouldn't this be vulnerable to a man in the middle attack?
  - solotronics 9y ago
    not if the sequence changes based on some predetermined pattern
    - InvisibleCities 9y ago
      Hmmmm. I don't know if I buy that. If the pattern is not cryptographically secure, then you're still vulnerable to man in the middle, and if it is cryptographically secure, wouldn't you get roughly the same security by just doing standard SSH key based auth?
      - mannykannot 9y ago
        Isn't the point to have some defense in depth, so if there is a zero-day exploit found for your SSH authentication, you are not wide open? In a way like the grooves on a key for a pin-tumbler lock.
    - quincunx 9y ago
      That would cover a replay attack, but not a man in the middle attack (as the mitm would just intercept the new port knock pattern.)
  - ShaneWilton 9y ago
    Only in the case of naive port knocking. You can always generate the knocking sequence with something like TOTP to avoid replay attacks, while also detecting attempts at replaying a previous knock. Edit: Sorry I misread your comment as talking about replay attacks, not MITM'ing. I'm not an expert, but I believe MITM attacks are typically mitigated by performing the knock out of band over a covert channel (DNS, etc). AFAIK, there isn't really a way to prevent them entirely.
  - icebraining 9y ago
UltraDark 9y ago
The main point is that it's far better to model a system by thinking about the things which already exist in that system than it is to fit all the functionality into a single state machine implementation.

retrogradeorbit 9y ago

Who gave it such a ridiculous name? Trust Fowler to take something that's been around for thirty years and give it a name that doesn't invoke any sense of what it actually is. This has been around since at least the 90s, but back then it was called port knocking. I remember seeing an implementation in the 90s that required different ICMP echo packet sizes (say 56, 64, 64, then 56 bytes) sent in order for the system to unfirewall a particular service port for that incoming IP.

loopbit 9y ago
Although I kind of share your anger at giving weird names to stuff that's been there for decades[0], port knocking could be considered as just one specific case of this pattern and not the general case. What if we don't use different ports? Your example uses ICMP packages with different sizes, not ports. What if you use something at the application layer that doesn't require ports, maybe a sequence of (invalid) calls to separate end-points? Personally, I don't care how it's called as long as everyone agrees on what it is and here, again, I agree with you in that "Gothic Hotel" might not be the best name. [0] Just the other day I heard a plain-old FTP server described as "cloud-based storage service".
eggy 9y ago
Agree on the naming bit. Haskell - named after a famous logician; LISP - LISt Processor; APL - A Programming Language...Fortran, Ada, all have sensible names, or easy to reason about or guess. Now, 'kitten', Rust, Lua, Joy, Python, well, I like them, but you get the point. Don't even mention startup company names!

codeulike 9y ago

People are discussing this in a security context, but that's not what its about. This article is about modelling and analysis and the 'gothic hotel' model is just an interesting imaginary situation to try and analyse. And its a very useful example because its a state machine.