3 ms·
Port knocking is great theatre but not much good for anything else. I guess it can keep logs clear feom some drive by script kiddies.
by ChrisSD 6y ago
Port knocking is great theatre but not much good for anything else. I guess it can keep logs clear feom some drive by script kiddies.
- BenjiWiebe 6y agoIf your ssh sever had a 0day, port knocking would protect you.
- c22 6y agoWhat if your port knocking monitor has a zero day?
- flemhans 6y agoThen ssh would protect you. The two having zero days at the same time is unlikely.
- c22 6y agoI guess that sort of depends on the nature of the zero day, huh?
- barbegal 6y agoNot necessarily, imagine a port knocking monitor that stores each port attempt it sees in a large buffer. Imagine you make many attempted connections allowing you to overflow the buffer and write arbitrary data onto the heap.
- cutemonster 6y agoOr the monitor being written in c and analyzing text in the knock messages, e.g. looks and interprets a hash
- rmrfstar 6y agoThat's kind of the idea Moxie had with [1]. Only 15 lines of code run as root, and they basically just tail kern.log. [1] https://moxie.org/software/knockknock/ https://moxie.org/software/knockknock/
- ratsmack 6y agoI would think that if you are going to disparage it, you would at least give one example of why it's unnecessary.
- ChrisSD 6y agoI was not disparaging it. Indeed I commended its theatrics and suggested it may help to make logs less cluttered. As for its supposed security benefits, this is something that needs to be proven by actual security research. Not by anecdotes on the internet.
- code_duck 6y agoI can't believe the discussion is this long and someone hasn't said 'security by obscurity' yet. Personally, if I was trying to prevent a break-in to a building, I would think it was a great advantage if the attackers had to work hard to even figure out where the doors and windows were.
- doublesCs 6y agoI believe the "security by obscurity doesn't work" people fall into two types: - those that are coming from a crypto background, where you frame things as "in principle breakable" vs "not breakable, not even in principle" and there's nothing in between, a framework according to which security by obscurity goes into the "in principle breakable" bucket, - people who just mindlessly parrot people of the first type. A more nuanced (and more useful) way of viewing this is one of cost vs reward: How much does it cost an attack to break your thing, and what's the maximum cost that an attacker is lilely to be willing to invest before your thing becomes unappealing. According to this view, obscurity can significantly increase the cost of the attack. It's as simple as that.