4 ms·

I would like to hear about it more. What use cases does it have and any supporting evidence for it. Genuinely curious.

barking 8y ago
I'd be guessing that there is no evidence because that would destroy the obscurity and thereby the security.
dosshell 8y ago
I do not know if this counts but: - change default port for sshd will take away 99.9% off all random attacks. - many copy protections may count as this. Some of them uncrypt themself before running so that it is harder to disassemble the bin file on disc. Also some more creative protections have been around, https://www.makeuseof.com/tag/5-strange-video-game-copy-protection-measures-used-in-history/ https://www.makeuseof.com/tag/5-strange-video-game-copy-prot...
- Fnoord 8y ago
  > change default port for sshd will take away 99.9% off all random attacks. Not running SSH takes away 100% of all SSH attacks. Only allowing certain IPs to connect also takes away more than just changing the port number. Its a matter of convenience and effort though.
TickleSteve 8y ago
Lots of systems are based on "defence in depth", i.e. multiple layers of security. This approach acknowledges that any single layer of security will have holes somewhere just waiting to be found no matter how theoretically secure you think it is. The implementation matters, not the theory and quite often this is where the holes exist. "Obscurity" is just one of those layers. Given no security, e.g. wide open front door, adding a door will reduce the number of successful attackers. Having a lock & key is a level up, hiding the key would reduce the chances of a successful burglary even more. Armed guards on the door would again reduce the chances of you getting burgled. Adding barbed-wire around your house improves the situation again... and it goes on. None of those levels of defence are impenetrable, but they all help. "Security by obscurity alone is discouraged and not recommended by standards bodies" (https://en.wikipedia.org/wiki/Security_through_obscurity https://en.wikipedia.org/wiki/Security_through_obscurity)
nickpsecurity 8y ago
Well, we often differentiate between "security by obscurity" and "obfuscation" since former became a common insult/no-no. The former is when enemies not knowing how something works is the security strategy. Lots of those systems fall easily. The latter is when it's an extra defense on top of otherwise good, security practices or at least a baseline not much different than what's common. I've found obfuscation an essential tool to delaying or defeating high-strength attackers. I tried to apply it to every level of the computing stack in my research. Here's a write-up with examples you could use: https://news.ycombinator.com/item?id=11856351 https://news.ycombinator.com/item?id=11856351
- irundebian 8y ago
  I appreciate most of your posts regarding high-assurance but don't get used to your ideas on security by obscurity. Of course you shouldn't make it easy for attackers to get much information of your systems but you probably should do it for security evaluators. If security by obscurity doesn't take much effort and doesn't interfere with standard security principles (actually it does already when we think about open design/Kerckhoffs's principle , but what I mean is something like complexity increase) it may not harm your security. But if you spent to much effort, that effort could have probably been better used to increase the assurance of the system to be protected. I mean it does not sound very trivial and very beneficial to hide your CPU architecture from attackers. Maybe the effort is just is better spent in the assurance of the exposed network service or the compartmentalization of it.
  - nickpsecurity 8y ago
    "that effort could have probably been better used to increase the assurance of the system to be protected." Think about that kind of hard. The average person or developer would have to know how to block about everything a hacker can think of on their known configuration. Whereas, a hacker or group knowing nothing of their configuration aiming for highest number of compromises will focus on something widely known or used. Even the recent router hacks were devices that sold by the truckload. Even for a targeted scenario, they still gotta get information most of your employees won't even have if it's backend stuff. Much of what runs at my company is terminal, client server, and web apps on non-descript boxes all through VPN's and such. The attackers have to breach the strongest components or convince someone in IT to give them necessary information. How easy that con is varies company to company but there's methods for reducing risk of it, too. Using a different PDF reader, web server, embedded ISA, and so on takes barely any effort or brains. If its own defaults are decent, the switch immediately gives benefit of less, successful attacks with less downtime or restores needed. Even better if behind a guard that hides what things are running by faking an Intel Windows or Linux box. The few that implemented this strategy told me they went years without problems. If any of it gets popular, that benefit might go away. Worse is Better works in our favor for obfuscation, though. The crowds chase the worse things. The attackers stay right behind them. ;) EDIT: "If security by obscurity doesn't take much effort and doesn't interfere with standard security principles (actually it does already when we think about open design/Kerckhoffs's principle , but what I mean is something like complexity increase) it may not harm your security." Yeah, that's basically how I look at it. It shouldn't invalidate the existing mechanisms. It shouldn't take too much effort. Maybe a bit upfront one time for setup with maintenance being rather low. What one is looking for with obfuscations is that they knock out the average attacker's foothold into boxes or networks without using much time for defender. For high-strength attackers, they should be combined with detection mechanisms so they might expose themselves blindly trying attacks.

I'd be guessing that there is no evidence because that would destroy the obscurity and thereby the security.

I do not know if this counts but: - change default port for sshd will take away 99.9% off all random attacks. - many copy protections may count as this. Some of them uncrypt themself before running so that it is harder to disassemble the bin file on disc. Also some more creative protections have been around, https://www.makeuseof.com/tag/5-strange-video-game-copy-protection-measures-used-in-history/ https://www.makeuseof.com/tag/5-strange-video-game-copy-prot...

Fnoord 8y ago
> change default port for sshd will take away 99.9% off all random attacks. Not running SSH takes away 100% of all SSH attacks. Only allowing certain IPs to connect also takes away more than just changing the port number. Its a matter of convenience and effort though.

TickleSteve 8y ago

Lots of systems are based on "defence in depth", i.e. multiple layers of security. This approach acknowledges that any single layer of security will have holes somewhere just waiting to be found no matter how theoretically secure you think it is. The implementation matters, not the theory and quite often this is where the holes exist. "Obscurity" is just one of those layers. Given no security, e.g. wide open front door, adding a door will reduce the number of successful attackers. Having a lock & key is a level up, hiding the key would reduce the chances of a successful burglary even more. Armed guards on the door would again reduce the chances of you getting burgled. Adding barbed-wire around your house improves the situation again... and it goes on. None of those levels of defence are impenetrable, but they all help. "Security by obscurity alone is discouraged and not recommended by standards bodies" (https://en.wikipedia.org/wiki/Security_through_obscurity https://en.wikipedia.org/wiki/Security_through_obscurity)

nickpsecurity 8y ago

Well, we often differentiate between "security by obscurity" and "obfuscation" since former became a common insult/no-no. The former is when enemies not knowing how something works is the security strategy. Lots of those systems fall easily. The latter is when it's an extra defense on top of otherwise good, security practices or at least a baseline not much different than what's common. I've found obfuscation an essential tool to delaying or defeating high-strength attackers. I tried to apply it to every level of the computing stack in my research. Here's a write-up with examples you could use: https://news.ycombinator.com/item?id=11856351 https://news.ycombinator.com/item?id=11856351

irundebian 8y ago
I appreciate most of your posts regarding high-assurance but don't get used to your ideas on security by obscurity. Of course you shouldn't make it easy for attackers to get much information of your systems but you probably should do it for security evaluators. If security by obscurity doesn't take much effort and doesn't interfere with standard security principles (actually it does already when we think about open design/Kerckhoffs's principle , but what I mean is something like complexity increase) it may not harm your security. But if you spent to much effort, that effort could have probably been better used to increase the assurance of the system to be protected. I mean it does not sound very trivial and very beneficial to hide your CPU architecture from attackers. Maybe the effort is just is better spent in the assurance of the exposed network service or the compartmentalization of it.
- nickpsecurity 8y ago
  "that effort could have probably been better used to increase the assurance of the system to be protected." Think about that kind of hard. The average person or developer would have to know how to block about everything a hacker can think of on their known configuration. Whereas, a hacker or group knowing nothing of their configuration aiming for highest number of compromises will focus on something widely known or used. Even the recent router hacks were devices that sold by the truckload. Even for a targeted scenario, they still gotta get information most of your employees won't even have if it's backend stuff. Much of what runs at my company is terminal, client server, and web apps on non-descript boxes all through VPN's and such. The attackers have to breach the strongest components or convince someone in IT to give them necessary information. How easy that con is varies company to company but there's methods for reducing risk of it, too. Using a different PDF reader, web server, embedded ISA, and so on takes barely any effort or brains. If its own defaults are decent, the switch immediately gives benefit of less, successful attacks with less downtime or restores needed. Even better if behind a guard that hides what things are running by faking an Intel Windows or Linux box. The few that implemented this strategy told me they went years without problems. If any of it gets popular, that benefit might go away. Worse is Better works in our favor for obfuscation, though. The crowds chase the worse things. The attackers stay right behind them. ;) EDIT: "If security by obscurity doesn't take much effort and doesn't interfere with standard security principles (actually it does already when we think about open design/Kerckhoffs's principle , but what I mean is something like complexity increase) it may not harm your security." Yeah, that's basically how I look at it. It shouldn't invalidate the existing mechanisms. It shouldn't take too much effort. Maybe a bit upfront one time for setup with maintenance being rather low. What one is looking for with obfuscations is that they knock out the average attacker's foothold into boxes or networks without using much time for defender. For high-strength attackers, they should be combined with detection mechanisms so they might expose themselves blindly trying attacks.