I’m sure you’ve been taught, as have I – that security through or by obscurity is bad (changing port numbers, removing service banners and so on). I’ve personally always used it, as an additional line of defence on my systems.
As a hacker I know, the more information a system gives me straight off the bat – the easier it’s going to be for me to hack it. Well the latest news is that this tactic may not be so bad after all.
Security by obscurity may not be so bad after all, according to a provocative new research paper that questions long-held security maxims.
The Kerckhoffs’ Principle holds that withholding information on how a system works is no security defence. A second accepted principle is that a defender has to defend against all possible attack vectors, whereas the attacker only needs to find one overlooked flaw to be successful, the so-called fortification principle.
However a new research paper from Prof Dusko Pavlovic of Royal Holloway, University of London, applies game theory to the conflict between hackers and security defenders in suggesting system security can be improved by making it difficult for attackers to figure out how their mark works. For example, adding a layer of obfuscation to a software application can make it harder to reverse engineer.
I agree with this, I wouldn’t exactly say this is ground-breaking though – I’ve always believed this. It’s not that I’d use obscurity as a singular defence, but I don’t see how it makes a system any less secure – the fact is from my perspective it definitely makes it harder to attack.
I mean the way in which Pavlovic is looking at it is rather more complex (in terms of a game), but it’s the same idea – if the attacker has less information, he’s going to have a harder time. Surely this all goes way back to Sun Tzu art of war..
Pavlovic compares security to a game in which each side has incomplete information. Far from being powerless against attacks, a defender ought to be able to gain an advantage (or at least level the playing field) by examining an attacker’s behaviour and algorithms while disguising defensive moves. At the same time defenders can benefit by giving away as few clues about their defensive posture as possible, an approach that the security by obscurity principle might suggest is futile.
Public key encryption works on the basis that making the algorithm used to derive a code secret is useless and codes, to be secure, need to be complex enough so that they can’t be unpicked using a brute force attack. As computer power increases we therefore need to increase the length of an encryption key in order outstrip the computational power an attacker might have at his disposal. This still hold true for cryptography, as Pavlovic acknowledges, but may not be case in other scenarios.
Pavlovic argues that an attacker’s logic or programming capabilities, as well as the computing resources at their disposal, might also be limited, suggesting that potential shortcomings in this area can be turned to the advantage of system defenders.
Of course obscurity should never be used in cryptography, that would just be idiotic – but when it comes to defending networks, servers and systems – I’m fine with it as an additional precaution.
I think this might spawn some interesting discussion either way, what do you guys think?
You can read the paper here: Gaming security by obscurity [PDF]
Source: The Register
Wojtek says
I have never understood why people who claim to be “experts” in security stubbornly dismiss security by obscurity.
If they are “experts” and not “clowns”, it is obvious (except maybe for them) that it will not be the only layer of defense.
I just wish they were tied to a chair and forced to review and annotate a syslog file where there are 365 zillions of attempted hacks to ssh with passwords like “john” or “root” – while the said ssh service only accepts keys.
Just moving the service to an exotic port would help them to escape this life sentence (ie sitting in front of the log file, whoops, 9877656 more ssh lines just popped up).
Asking the question on an “expert’s” view on security by obscurity usually helps me to shorten useless meetings.
etcwarrionr says
It is misguided to read Sun Tzu and focus first on the know your enemy guidance. Before you study your enemy, you must study yourself.
When security is already strong and well understood, an additional layer of obscurity can be beneficial. This use of obscurity is strategic. Most organizations do not use obscurity in this way, rather they use it tactically.
For example, an organization discovers a high risk vulnerability that is very expensive to fix. Rather than pay for the expensive mitigation, they attempt to reduce its risk by applying a layer of obscurity to make the vulnerability less likely to be found and exploited. If this is the only vulnerability and the obscurity layer works then management wins. But it probably won’t be the only vulnerability and management will probably use this tactic repeatedly. If it becomes a habit management might even begin to use it for high risk vulnerabilities that are relatively inexpensive to fix. See the problem there?
It gets worse. Obscurity applied in this manner can turn low and medium risks into high risks. If management learns about a vulnerability and chooses to accept it after applying a layer of obscurity, the users of the vulnerable component are not able to make effective risk-based decisions. That vulnerable component might be reused for highly sensitive processes and data when less vulnerable alternatives may have been available.
In any case, the Security/Obscurity wisdom is doctrine, not tactics, not strategy. The defense-in-depth wisdom is doctrine too. Doctrine should guide and influence your strategic planning not substitute for it.
If obscurity prevents your enemy from learning your weaknesses, then use it. But many uses of obscurity make it more difficult to know yourself and the worst of them can result in self-delusion.
Brujo says
how say the article, the security by obscurity is “an additional line of defence”
Jim says
etcwarrionr’s answer is really interesting. I have never seen it this way. Using obscurity as a fix is clearly insane. Not that I am surprised, but I didn’t people would do that.
Other than that I am also a pro obscurity. When security is well done, it is a nice additional layer.