5 ms·

Simplified example: to open up access to a database server port, you’d have to send specific packets in a specific sequence on specific ports. It’s kinda like d

Simplified example: to open up access to a database server port, you’d have to send specific packets in a specific sequence on specific ports. It’s kinda like doing a secret knock on a series of doors in a neighborhood before an entirely new door opens up in the side of a building. And if you knock blindly on a few doors, the system knows you’re an intruder, and no soup for you even if you stumble into the right knock sequence.

otoburb 9y ago
>>to open up access to a database server port, you’d have to send specific packets in a specific sequence on specific ports AKA port knocking[1], minus the special twist at the end where an intrusion/network detection system (IDS or NDS) automagically detects failed port knocks and responds accordingly. [1] https://en.wikipedia.org/wiki/Port_knocking https://en.wikipedia.org/wiki/Port_knocking
- rhizome 9y ago
  I used to use portsentry in a similar way, but this looks interesting as a preset sequence of port knocks, rather than shitcanning any client that steps on a landmine port.
darkmighty 9y ago
Why not just a password? (you can also lock out after X incorrect attempts) I don't see benefits except for additional security through obscurity factor, which crypto wisdom dictates should not be relied upon.
- ShaneWilton 9y ago
  Security through obscurity is a very misunderstood concept. It should never be used at the expense of proper security (i.e. rolling your own crypto), and you should always act under the assumption that targeted attackers can see through your obscurity, but it can be a valuable part of defense in depth: especially against unskilled attackers. Consider an 0day for example. When the 0day is published, attackers are going to mass-scan the internet for vulnerable applications. Your WAFs, etc won't yet block the attack, and if you have a vulnerable application that must be externally facing, you may get hit by this mass-scan. If your applications are protected with port knocking, however, you'll have that extra window of time to apply patches and protect yourself before you're directly targeted.
  - darkmighty 9y ago
    Well, but if port knocking was a great effective security tool, everyone would be using it, which defeats the obscurity advantage and would bring it back on par with good old passwords. It might be a decent extra tool for very delicate situations, but I find it reasonably clear that it's largely self-defeating and not to be relied upon. It can also introduce further bugs. I can see it could have an appeal as a proper password system though (not an obscurity device), since it's really the first step in interacting with a server. With password protocols, you usually have a more complicated interaction that can open a greater surface area. It seems good practice to authenticate absolutely as soon as possible.
    - ShaneWilton 9y ago
      The benefit of port knocking is that it essentially gives you a channel to transmit a password over, without revealing the existence of the system that's being authenticated for. A traditional password, on the other hand, requires some sort of socket that leaks the presence of a listening server. Even if everybody were to use port knocking, knowing that fact doesn't give you any knowledge about whether a given IP hosts zero, one, or some arbitrary number of possibly vulnerable services.
    - pc86 9y ago
      "If this was good everyone would be doing it" is... shaky logic, at best.
      - CamTin 9y ago
        I think the intent is an argument that basically says "if everyone were doing it, it wouldn't be good" which is less shaky (though see ShaneWilton's comment as to why this isn't so).
    - fulafel 9y ago
      One clear downside: you've now created an easy low-bandwidth way for anyone to deny you from opening connections there, since others can easily interfere with your port knocking sequence.
trhway 9y ago
to me it sounds like a typical safe lock - 2 turns left, 3 and half right, ... >to send specific packets in a specific sequence on specific ports. like Gothic Motel model itself it looks like an unnecessary complication. I think we can get pretty much the same effect if typical password (its hash) was sent in a sequence of say 10 packets instead of 1.
revelation 9y ago
Guys, try reading the linked article first? This is just an example on a state machine and the linked article is on how to model them. It has nothing at all to do with port knocking.
- mannykannot 9y ago
  Having not heard of this Analysis Design Matrix thing before, it was not clear to me what the linked article was going on about. From the home page, I read that "Matrix is a fundamentally new conceptual framework for thinking about Software Engineering and Model Compiler development", though at first sight, it looks very 1990s / CASE - like. It is perhaps unfortunate that the introduction page contains a 45-line "hello world" program, as this presumably does not show its intended purpose.
  - UltraDark 9y ago
    What you're reading here is the second example model based on Martin Fowler's original model. It's one of a series of demo models that shows off the Matrix modeling language. A theme of the site is to push the idea generating code from models by using Model Compilers to continuously improve and optimise future Model Compilers as shown graphically in the Analysis Design Matrix Diagram.
InvisibleCities 9y ago
Maybe I am missing something, but wouldn't this be vulnerable to a man in the middle attack?
- solotronics 9y ago
  not if the sequence changes based on some predetermined pattern
  - InvisibleCities 9y ago
    Hmmmm. I don't know if I buy that. If the pattern is not cryptographically secure, then you're still vulnerable to man in the middle, and if it is cryptographically secure, wouldn't you get roughly the same security by just doing standard SSH key based auth?
    - mannykannot 9y ago
      Isn't the point to have some defense in depth, so if there is a zero-day exploit found for your SSH authentication, you are not wide open? In a way like the grooves on a key for a pin-tumbler lock.
  - quincunx 9y ago
    That would cover a replay attack, but not a man in the middle attack (as the mitm would just intercept the new port knock pattern.)
- ShaneWilton 9y ago
  Only in the case of naive port knocking. You can always generate the knocking sequence with something like TOTP to avoid replay attacks, while also detecting attempts at replaying a previous knock. Edit: Sorry I misread your comment as talking about replay attacks, not MITM'ing. I'm not an expert, but I believe MITM attacks are typically mitigated by performing the knock out of band over a covert channel (DNS, etc). AFAIK, there isn't really a way to prevent them entirely.
- icebraining 9y ago

otoburb 9y ago

>>to open up access to a database server port, you’d have to send specific packets in a specific sequence on specific ports AKA port knocking[1], minus the special twist at the end where an intrusion/network detection system (IDS or NDS) automagically detects failed port knocks and responds accordingly. [1] https://en.wikipedia.org/wiki/Port_knocking https://en.wikipedia.org/wiki/Port_knocking

rhizome 9y ago
I used to use portsentry in a similar way, but this looks interesting as a preset sequence of port knocks, rather than shitcanning any client that steps on a landmine port.

darkmighty 9y ago

Why not just a password? (you can also lock out after X incorrect attempts) I don't see benefits except for additional security through obscurity factor, which crypto wisdom dictates should not be relied upon.

ShaneWilton 9y ago
Security through obscurity is a very misunderstood concept. It should never be used at the expense of proper security (i.e. rolling your own crypto), and you should always act under the assumption that targeted attackers can see through your obscurity, but it can be a valuable part of defense in depth: especially against unskilled attackers. Consider an 0day for example. When the 0day is published, attackers are going to mass-scan the internet for vulnerable applications. Your WAFs, etc won't yet block the attack, and if you have a vulnerable application that must be externally facing, you may get hit by this mass-scan. If your applications are protected with port knocking, however, you'll have that extra window of time to apply patches and protect yourself before you're directly targeted.
- darkmighty 9y ago
  Well, but if port knocking was a great effective security tool, everyone would be using it, which defeats the obscurity advantage and would bring it back on par with good old passwords. It might be a decent extra tool for very delicate situations, but I find it reasonably clear that it's largely self-defeating and not to be relied upon. It can also introduce further bugs. I can see it could have an appeal as a proper password system though (not an obscurity device), since it's really the first step in interacting with a server. With password protocols, you usually have a more complicated interaction that can open a greater surface area. It seems good practice to authenticate absolutely as soon as possible.
  - ShaneWilton 9y ago
    The benefit of port knocking is that it essentially gives you a channel to transmit a password over, without revealing the existence of the system that's being authenticated for. A traditional password, on the other hand, requires some sort of socket that leaks the presence of a listening server. Even if everybody were to use port knocking, knowing that fact doesn't give you any knowledge about whether a given IP hosts zero, one, or some arbitrary number of possibly vulnerable services.
  - pc86 9y ago
    "If this was good everyone would be doing it" is... shaky logic, at best.
    - CamTin 9y ago
      I think the intent is an argument that basically says "if everyone were doing it, it wouldn't be good" which is less shaky (though see ShaneWilton's comment as to why this isn't so).
  - fulafel 9y ago
    One clear downside: you've now created an easy low-bandwidth way for anyone to deny you from opening connections there, since others can easily interfere with your port knocking sequence.

trhway 9y ago

to me it sounds like a typical safe lock - 2 turns left, 3 and half right, ... >to send specific packets in a specific sequence on specific ports. like Gothic Motel model itself it looks like an unnecessary complication. I think we can get pretty much the same effect if typical password (its hash) was sent in a sequence of say 10 packets instead of 1.

revelation 9y ago

Guys, try reading the linked article first? This is just an example on a state machine and the linked article is on how to model them. It has nothing at all to do with port knocking.

mannykannot 9y ago
Having not heard of this Analysis Design Matrix thing before, it was not clear to me what the linked article was going on about. From the home page, I read that "Matrix is a fundamentally new conceptual framework for thinking about Software Engineering and Model Compiler development", though at first sight, it looks very 1990s / CASE - like. It is perhaps unfortunate that the introduction page contains a 45-line "hello world" program, as this presumably does not show its intended purpose.
- UltraDark 9y ago
  What you're reading here is the second example model based on Martin Fowler's original model. It's one of a series of demo models that shows off the Matrix modeling language. A theme of the site is to push the idea generating code from models by using Model Compilers to continuously improve and optimise future Model Compilers as shown graphically in the Analysis Design Matrix Diagram.

InvisibleCities 9y ago

Maybe I am missing something, but wouldn't this be vulnerable to a man in the middle attack?

solotronics 9y ago
not if the sequence changes based on some predetermined pattern
- InvisibleCities 9y ago
  Hmmmm. I don't know if I buy that. If the pattern is not cryptographically secure, then you're still vulnerable to man in the middle, and if it is cryptographically secure, wouldn't you get roughly the same security by just doing standard SSH key based auth?
  - mannykannot 9y ago
    Isn't the point to have some defense in depth, so if there is a zero-day exploit found for your SSH authentication, you are not wide open? In a way like the grooves on a key for a pin-tumbler lock.
- quincunx 9y ago
  That would cover a replay attack, but not a man in the middle attack (as the mitm would just intercept the new port knock pattern.)
ShaneWilton 9y ago
Only in the case of naive port knocking. You can always generate the knocking sequence with something like TOTP to avoid replay attacks, while also detecting attempts at replaying a previous knock. Edit: Sorry I misread your comment as talking about replay attacks, not MITM'ing. I'm not an expert, but I believe MITM attacks are typically mitigated by performing the knock out of band over a covert channel (DNS, etc). AFAIK, there isn't really a way to prevent them entirely.
icebraining 9y ago