4 ms·

> While security researchers love the entropy of randomized function layouts I don't think any competent security researcher has anything positive to say about

> While security researchers love the entropy of randomized function layouts I don't think any competent security researcher has anything positive to say about "security through obscurity" at best this is lawyer position

hsbauauvhabzb 7mo ago
It’s not about security, it’s about wasting a crackers time. Some people find cracking them interesting and fun.
- corysama 7mo ago
  Agreed. I’ve done trivial obfuscation for games. In my observation, if you make it trivial to hack your game, huge numbers will trivially hack it. If you make it even slightly non-trivial, the numbers decrease exponentially. The more you waste their time, put up hurdles, the lower the number of successful hackers goes. The goal is not perfect security in all situations for all products. The goal is to make the effort required for your particular product excessive compared to the payoff.
zer0zzz 7mo ago
ASLR (for example) is a pretty standard technique, I thought all commercial OSes enabled this generally. What's the purpose of picking at this portion?
lm411 7mo ago
I disagree, obscurity wastes attacker resources and easily fools a lot of simple vulnerability scanners. Obscurity is totally underrated. Attacker resources are limited.
- dahcryn 7mo ago
  thank you, I had this debate at work so many times. Sure it's not a security measure as such, but it's still a worthwile component to the overall defense system.
  - fsflover 7mo ago
    The problem with this is, you spend a lot of effort for low benefit. You should spend it on actual security instead.
    - literalAardvark 7mo ago
      Changing a port and enabling aslr are not "a lot of effort".
      - nithril 7mo ago
        Changing the port is not the kind of security measure that will consume a lot of the attacker resources
        literalAardvark 7mo ago
        It will conserve a lot of defender resources, it will completely bypass all mass scans, and it will make "determined attackers" much more visible as they will have to find the port first which will show up in logs and potentially land them in a tarpit.
        Sohcahtoa82 7mo ago
        Sure, it'll do nothing to stop a determined attacker, but it does wonders to stop the noise from passive scanners. Are you familiar with the Swiss cheese model of risk management[0]? Obscurity is just another slice of Swiss cheese. It's not your only security measure. You still use all the other measures. [0] https://en.wikipedia.org/wiki/Swiss_cheese_model https://en.wikipedia.org/wiki/Swiss_cheese_model
    - alkonaut 7mo ago
      What would be "actual security" in this context? This isn't about security of the same kind as authentication/encryption etc where security by obscurity is a bad idea. This is an effort where obscurity is almost the only idea there is, and where even a marginal increase in difficulty for tampering/inspecting/exploiting is well worth it.
- otikik 7mo ago
  It’s kind of having a line of cardboard tanks. Can be helpful in some circumstances, but it can’t always replace actual tanks
  - fluoridation 7mo ago
    If you have 500 tanks and 500 cardboard tanks, someone with only as many real tanks as you have may not bother attacking. Thus, having the cardboard tanks saved you a battle. If someone with 1000 tanks attacks, it's a battle you would not have won anyway.
    - otikik 7mo ago
      And yet, cardboard tanks have been useful only a handful of times during wartime. Tanks on the other hand have proven their usefulness many times.
  - Geof25 7mo ago
    Actually decoys are very useful in Ukraine Russian war. It is usually decoys of air defense or long range precision fires like Himars and target is to waste resources of opponents long range fires which are limited and/or expensive. Further more you can also reveal position of the attacker and counterfire.
- fortyseven 7mo ago
  I'm going to assume whatever efficacy obscurity brings will take increasing hits as AI tooling becomes more commonplace.
dagmx 7mo ago
Security through obscurity is bad only if the obscurity is the only measure
landr0id 7mo ago
It's not something to over-index on, but it's not a strong protection measure. It simply raises the overall cost to attack and analyze a system. Take the PS5 for example. It has execute-only memory. Even if you find a bug, how do you exploit it if you can't read the executable text of your ROP/JOP target?
Starlevel004 7mo ago
Security through obscurity is an excellent first-line defense, as long as you have other real defenses at the next layer.
m-schuetz 7mo ago
Security through obscurity is like a bike lock. It can be cracked with the right tools and effort, but massively improves security compared to leaving it out unlocked.
Geof25 7mo ago
You can consider obscurity as concealment. You can't be attacked if you are not seen. And to be seen attacker needs much more resources to see you.
jayd16 7mo ago
You would think but in my experience, if you ask to just open something up they'll start talking about "defense in depth" and it suddenly matters a lot.

hsbauauvhabzb 7mo ago

It’s not about security, it’s about wasting a crackers time. Some people find cracking them interesting and fun.

corysama 7mo ago
Agreed. I’ve done trivial obfuscation for games. In my observation, if you make it trivial to hack your game, huge numbers will trivially hack it. If you make it even slightly non-trivial, the numbers decrease exponentially. The more you waste their time, put up hurdles, the lower the number of successful hackers goes. The goal is not perfect security in all situations for all products. The goal is to make the effort required for your particular product excessive compared to the payoff.

zer0zzz 7mo ago

ASLR (for example) is a pretty standard technique, I thought all commercial OSes enabled this generally. What's the purpose of picking at this portion?

lm411 7mo ago

I disagree, obscurity wastes attacker resources and easily fools a lot of simple vulnerability scanners. Obscurity is totally underrated. Attacker resources are limited.

dahcryn 7mo ago
thank you, I had this debate at work so many times. Sure it's not a security measure as such, but it's still a worthwile component to the overall defense system.
- fsflover 7mo ago
  The problem with this is, you spend a lot of effort for low benefit. You should spend it on actual security instead.
  - literalAardvark 7mo ago
    Changing a port and enabling aslr are not "a lot of effort".
    - nithril 7mo ago
      Changing the port is not the kind of security measure that will consume a lot of the attacker resources
      - literalAardvark 7mo ago
        It will conserve a lot of defender resources, it will completely bypass all mass scans, and it will make "determined attackers" much more visible as they will have to find the port first which will show up in logs and potentially land them in a tarpit.
      - Sohcahtoa82 7mo ago
        Sure, it'll do nothing to stop a determined attacker, but it does wonders to stop the noise from passive scanners. Are you familiar with the Swiss cheese model of risk management[0]? Obscurity is just another slice of Swiss cheese. It's not your only security measure. You still use all the other measures. [0] https://en.wikipedia.org/wiki/Swiss_cheese_model https://en.wikipedia.org/wiki/Swiss_cheese_model
  - alkonaut 7mo ago
    What would be "actual security" in this context? This isn't about security of the same kind as authentication/encryption etc where security by obscurity is a bad idea. This is an effort where obscurity is almost the only idea there is, and where even a marginal increase in difficulty for tampering/inspecting/exploiting is well worth it.
otikik 7mo ago
It’s kind of having a line of cardboard tanks. Can be helpful in some circumstances, but it can’t always replace actual tanks
- fluoridation 7mo ago
  If you have 500 tanks and 500 cardboard tanks, someone with only as many real tanks as you have may not bother attacking. Thus, having the cardboard tanks saved you a battle. If someone with 1000 tanks attacks, it's a battle you would not have won anyway.
  - otikik 7mo ago
    And yet, cardboard tanks have been useful only a handful of times during wartime. Tanks on the other hand have proven their usefulness many times.
- Geof25 7mo ago
  Actually decoys are very useful in Ukraine Russian war. It is usually decoys of air defense or long range precision fires like Himars and target is to waste resources of opponents long range fires which are limited and/or expensive. Further more you can also reveal position of the attacker and counterfire.
fortyseven 7mo ago
I'm going to assume whatever efficacy obscurity brings will take increasing hits as AI tooling becomes more commonplace.

dagmx 7mo ago

Security through obscurity is bad only if the obscurity is the only measure

landr0id 7mo ago

It's not something to over-index on, but it's not a strong protection measure. It simply raises the overall cost to attack and analyze a system. Take the PS5 for example. It has execute-only memory. Even if you find a bug, how do you exploit it if you can't read the executable text of your ROP/JOP target?

Starlevel004 7mo ago

Security through obscurity is an excellent first-line defense, as long as you have other real defenses at the next layer.

m-schuetz 7mo ago

Security through obscurity is like a bike lock. It can be cracked with the right tools and effort, but massively improves security compared to leaving it out unlocked.

Geof25 7mo ago

You can consider obscurity as concealment. You can't be attacked if you are not seen. And to be seen attacker needs much more resources to see you.

jayd16 7mo ago

You would think but in my experience, if you ask to just open something up they'll start talking about "defense in depth" and it suddenly matters a lot.