Security By Obscurity Not So Bad After All?

Outsmart Malicious Hackers

I’m sure you’ve been taught, as have I – that security through or by obscurity is bad (changing port numbers, removing service banners and so on). I’ve personally always used it, as an additional line of defence on my systems.

As a hacker I know, the more information a system gives me straight off the bat – the easier it’s going to be for me to hack it. Well the latest news is that this tactic may not be so bad after all.

Security by obscurity may not be so bad after all, according to a provocative new research paper that questions long-held security maxims.

The Kerckhoffs’ Principle holds that withholding information on how a system works is no security defence. A second accepted principle is that a defender has to defend against all possible attack vectors, whereas the attacker only needs to find one overlooked flaw to be successful, the so-called fortification principle.

However a new research paper from Prof Dusko Pavlovic of Royal Holloway, University of London, applies game theory to the conflict between hackers and security defenders in suggesting system security can be improved by making it difficult for attackers to figure out how their mark works. For example, adding a layer of obfuscation to a software application can make it harder to reverse engineer.

I agree with this, I wouldn’t exactly say this is ground-breaking though – I’ve always believed this. It’s not that I’d use obscurity as a singular defence, but I don’t see how it makes a system any less secure – the fact is from my perspective it definitely makes it harder to attack.

I mean the way in which Pavlovic is looking at it is rather more complex (in terms of a game), but it’s the same idea – if the attacker has less information, he’s going to have a harder time. Surely this all goes way back to Sun Tzu art of war..

Pavlovic compares security to a game in which each side has incomplete information. Far from being powerless against attacks, a defender ought to be able to gain an advantage (or at least level the playing field) by examining an attacker’s behaviour and algorithms while disguising defensive moves. At the same time defenders can benefit by giving away as few clues about their defensive posture as possible, an approach that the security by obscurity principle might suggest is futile.

Public key encryption works on the basis that making the algorithm used to derive a code secret is useless and codes, to be secure, need to be complex enough so that they can’t be unpicked using a brute force attack. As computer power increases we therefore need to increase the length of an encryption key in order outstrip the computational power an attacker might have at his disposal. This still hold true for cryptography, as Pavlovic acknowledges, but may not be case in other scenarios.

Pavlovic argues that an attacker’s logic or programming capabilities, as well as the computing resources at their disposal, might also be limited, suggesting that potential shortcomings in this area can be turned to the advantage of system defenders.

Of course obscurity should never be used in cryptography, that would just be idiotic – but when it comes to defending networks, servers and systems – I’m fine with it as an additional precaution.

I think this might spawn some interesting discussion either way, what do you guys think?

You can read the paper here: Gaming security by obscurity [PDF]

Source: The Register

Posted in: Countermeasures, Hacking News

Latest Posts:

OWASP ZSC - Obfuscated Code Generator Tool OWASP ZSC – Obfuscated Code Generator Tool
OWASP ZSC is an open source obfuscated code generator tool in Python which lets you generate customized shellcodes and convert scripts to an obfuscated script.
A Look Back At 2017 – Tools & News Highlights A Look Back At 2017 – Tools & News Highlights
So here we are in 2018, taking a look back at 2017, quite a year it was. Here is a quick rundown of some of the best hacking/security tools released in 2017, the biggest news stories and the 10 most viewed posts on Darknet as a bonus.
Spectre & Meltdown Checker - Vulnerability Mitigation Tool For Linux Spectre & Meltdown Checker – Vulnerability Mitigation Tool For Linux
Spectre & Meltdown Checker is a simple shell script to tell if your Linux installation is vulnerable against the 3 "speculative execution" CVEs that were made public early 2018.
Hijacker - Reaver For Android Wifi Hacker App Hijacker – Reaver For Android Wifi Hacker App
Hijacker is a native GUI which provides Reaver for Android along with Aircrack-ng, Airodump-ng and MDK3 making it a powerful Wifi hacker app.
Sublist3r - Fast Python Subdomain Enumeration Tool Sublist3r – Fast Python Subdomain Enumeration Tool
Sublist3r is a Python-based tool designed to enumerate subdomains of websites using OSINT. It helps penetration testers and bug hunters collect and gather subdomains for the domain they are targeting.
coWPAtty Download - Audit Pre-shared WPA Keys coWPAtty Download – Audit Pre-shared WPA Keys
coWPAtty is a C-based tool for running a brute-force dictionary attack against WPA-PSK and audit pre-shared WPA keys.

4 Responses to Security By Obscurity Not So Bad After All?

  1. Wojtek October 5, 2011 at 5:00 pm #

    I have never understood why people who claim to be “experts” in security stubbornly dismiss security by obscurity.
    If they are “experts” and not “clowns”, it is obvious (except maybe for them) that it will not be the only layer of defense.

    I just wish they were tied to a chair and forced to review and annotate a syslog file where there are 365 zillions of attempted hacks to ssh with passwords like “john” or “root” – while the said ssh service only accepts keys.
    Just moving the service to an exotic port would help them to escape this life sentence (ie sitting in front of the log file, whoops, 9877656 more ssh lines just popped up).

    Asking the question on an “expert’s” view on security by obscurity usually helps me to shorten useless meetings.

  2. etcwarrionr October 5, 2011 at 7:15 pm #

    It is misguided to read Sun Tzu and focus first on the know your enemy guidance. Before you study your enemy, you must study yourself.

    When security is already strong and well understood, an additional layer of obscurity can be beneficial. This use of obscurity is strategic. Most organizations do not use obscurity in this way, rather they use it tactically.

    For example, an organization discovers a high risk vulnerability that is very expensive to fix. Rather than pay for the expensive mitigation, they attempt to reduce its risk by applying a layer of obscurity to make the vulnerability less likely to be found and exploited. If this is the only vulnerability and the obscurity layer works then management wins. But it probably won’t be the only vulnerability and management will probably use this tactic repeatedly. If it becomes a habit management might even begin to use it for high risk vulnerabilities that are relatively inexpensive to fix. See the problem there?

    It gets worse. Obscurity applied in this manner can turn low and medium risks into high risks. If management learns about a vulnerability and chooses to accept it after applying a layer of obscurity, the users of the vulnerable component are not able to make effective risk-based decisions. That vulnerable component might be reused for highly sensitive processes and data when less vulnerable alternatives may have been available.

    In any case, the Security/Obscurity wisdom is doctrine, not tactics, not strategy. The defense-in-depth wisdom is doctrine too. Doctrine should guide and influence your strategic planning not substitute for it.

    If obscurity prevents your enemy from learning your weaknesses, then use it. But many uses of obscurity make it more difficult to know yourself and the worst of them can result in self-delusion.

  3. Brujo October 6, 2011 at 11:21 pm #

    how say the article, the security by obscurity is “an additional line of defence”

  4. Jim November 2, 2011 at 7:38 pm #

    etcwarrionr’s answer is really interesting. I have never seen it this way. Using obscurity as a fix is clearly insane. Not that I am surprised, but I didn’t people would do that.

    Other than that I am also a pro obscurity. When security is well done, it is a nice additional layer.