5 ms·

One thing to keep in mind here is that there is no absolute security. There is only security against some specific threat. If the threat is "someone is specifi

One thing to keep in mind here is that there is no absolute security. There is only security against some specific threat. If the threat is "someone is specifically targeting you", then changing the port is indeed useless. However, if the threat is "a botnet trying to abuse a new openSSH vulnerability", then changing the port does help. Because no bot takes the time to scan tens of thousands of ports in that case when there are millions of other hosts around who listen on port 22. By the way, when I lived in a dormitory, it was actually best practice to hide your valuables from view if you lived in a ground floor apartment. Literally obscuring the thing, but thieves only broke into the apartment where they knew there's something to steal quickly. A napkin over your wallet might not help in a bar but it did help in this case.

thaumasiotes 6y ago
> Literally obscuring the thing, but thieves only broke into the apartment where they knew there's something to steal quickly. A napkin over your wallet might not help in a bar but it did help in this case. The same approach works well for leaving stuff in cars. Visible bags or electronics tend to get stolen. The same thing under a sweatshirt doesn't.
peterwwillis 6y ago
> However, if the threat is "a botnet trying to abuse a new openSSH vulnerability", then changing the port does help. Because no bot takes the time to scan tens of thousands of ports in that case when there are millions of other hosts around who listen on port 22. It takes about 8 minutes to scan the whole internet for port 22. If there's an SSH 0day, and I have a botnet, I am going to make the entire botnet scan the entire internet on every port, because I know people move their SSH port. With 5,000 hosts, I can scan all 65,535 TCP ports across the entire internet in 104 minutes. How fast can you patch your server after the 0day's been announced? What if you're asleep? The time it takes to change the SSH port could also be used to harden the sshd config, which would eliminate several classes of previous exploits. A little more time and the entire system could be hardened, so that even if you are attacked, the attacker can't do much of anything.
- reincarnate0x14 6y ago
  Have you done much with IPv6 scanning? I know some researchers have set up public services like NTP servers to try and build a catalog of active addresses but with the privacy address extensions even that seems functionally infeasible to me. But most of the things I care about are on private networks these days so I haven't had much cause to seriously investigate.
  - peterwwillis 6y ago
    I haven't; there are definitely some protocol scanning differences. But off the top of my head, you could try 1) do a reverse lookup on a v4 address and then query the name for a v6 address, 2) do DNS probing for a domain you're interested in, 3) try the v6-in-v4 mapping to find v6 addresses mapped to v4 addresses. If you could sit on a backbone and sniff DNS traffic or something, that'd be a nice sized cache of addresses.

thaumasiotes 6y ago

> Literally obscuring the thing, but thieves only broke into the apartment where they knew there's something to steal quickly. A napkin over your wallet might not help in a bar but it did help in this case. The same approach works well for leaving stuff in cars. Visible bags or electronics tend to get stolen. The same thing under a sweatshirt doesn't.

peterwwillis 6y ago

> However, if the threat is "a botnet trying to abuse a new openSSH vulnerability", then changing the port does help. Because no bot takes the time to scan tens of thousands of ports in that case when there are millions of other hosts around who listen on port 22. It takes about 8 minutes to scan the whole internet for port 22. If there's an SSH 0day, and I have a botnet, I am going to make the entire botnet scan the entire internet on every port, because I know people move their SSH port. With 5,000 hosts, I can scan all 65,535 TCP ports across the entire internet in 104 minutes. How fast can you patch your server after the 0day's been announced? What if you're asleep? The time it takes to change the SSH port could also be used to harden the sshd config, which would eliminate several classes of previous exploits. A little more time and the entire system could be hardened, so that even if you are attacked, the attacker can't do much of anything.

reincarnate0x14 6y ago
Have you done much with IPv6 scanning? I know some researchers have set up public services like NTP servers to try and build a catalog of active addresses but with the privacy address extensions even that seems functionally infeasible to me. But most of the things I care about are on private networks these days so I haven't had much cause to seriously investigate.
- peterwwillis 6y ago
  I haven't; there are definitely some protocol scanning differences. But off the top of my head, you could try 1) do a reverse lookup on a v4 address and then query the name for a v6 address, 2) do DNS probing for a domain you're interested in, 3) try the v6-in-v4 mapping to find v6 addresses mapped to v4 addresses. If you could sit on a backbone and sniff DNS traffic or something, that'd be a nice sized cache of addresses.