3 ms·

So how do you quantify "less likely to be h@xxored by some script kiddy's scripts" versus "actually able to resist a focused penetration test"? Are you saying

So how do you quantify "less likely to be h@xxored by some script kiddy's scripts" versus "actually able to resist a focused penetration test"? Are you saying the zero-day exploit "todo list" isn't a valid concern? Mathematically, perhaps there is no difference because the focused penetration attempt overwhelms the equation, but if I'm just "some IP" on the Internet, isn't the less knowledge about me better? It is very similar to the "secret military facility". The security of the facility is determined by what would stop somebody who knows about you, but you reduce the number of times that is tested through the "secret" (obscure) part of the base.

tptacek 15y ago
I have no idea what you're talking about. Nobody with OpenSSH zero-day is feeding it through an Internet-wide scanner.
- SoftwareMaven 15y ago
  The point is the scanner keeps track of versions: 148.65.45.123 is using SSH x.y. When a zero-day hits for a particular version, they are able to look at the list previously generated to see immediately where they can put a back door. If you don't advertise your ssh (eg change ports) or your version, you aren't on that zero day list. Your system isn't more secure, but your are less likely to be hacked. So, that's the scenario. The above has reduced your chances of being hacked without actually increasing how secure your systems actually are. And then the question: how do you account for that in assessing the cost/value benefits associated with security? I really am curious about this, because there is a cost to the above, so any value should be included in the calculation of whether it is worth it. How do you calculate the value of not being on that list?
JoachimSchipper 15y ago
Security plus obscurity probably does beat obscurity (as long as you're not trying to rely on scanners to find the vulnerabilities in your own network), but the people asserting this are almost always doing something horribly wrong (e.g. using SHA-256 for passwords, like this guy is doing). Even if this is not the case, moving your SSHD to a high port is unlikely to be as effective as just switching to public-key crypto, which doesn't end up taking more time. Etc. In short, you're right in theory, but in practice obscurity is pretty much never the right answer.

tptacek 15y ago

I have no idea what you're talking about. Nobody with OpenSSH zero-day is feeding it through an Internet-wide scanner.

SoftwareMaven 15y ago
The point is the scanner keeps track of versions: 148.65.45.123 is using SSH x.y. When a zero-day hits for a particular version, they are able to look at the list previously generated to see immediately where they can put a back door. If you don't advertise your ssh (eg change ports) or your version, you aren't on that zero day list. Your system isn't more secure, but your are less likely to be hacked. So, that's the scenario. The above has reduced your chances of being hacked without actually increasing how secure your systems actually are. And then the question: how do you account for that in assessing the cost/value benefits associated with security? I really am curious about this, because there is a cost to the above, so any value should be included in the calculation of whether it is worth it. How do you calculate the value of not being on that list?

JoachimSchipper 15y ago

Security plus obscurity probably does beat obscurity (as long as you're not trying to rely on scanners to find the vulnerabilities in your own network), but the people asserting this are almost always doing something horribly wrong (e.g. using SHA-256 for passwords, like this guy is doing). Even if this is not the case, moving your SSHD to a high port is unlikely to be as effective as just switching to public-key crypto, which doesn't end up taking more time. Etc. In short, you're right in theory, but in practice obscurity is pretty much never the right answer.