#SECURITY THROUGH OBSCURITY EXAMPLE SOFTWARE#
#SECURITY THROUGH OBSCURITY EXAMPLE PASSWORD#
#SECURITY THROUGH OBSCURITY EXAMPLE PROFESSIONAL#

Well, what about the case where we put our web server on port 253? If we put our web server on port 253, our attacker generally has got to scan a whole lot of ports on the target web server to find it. Our attacker knows this and is quite happy, because he has little chance of being observed while doing his information probe. In the case where we put our web server on the common port, port 80, our attacker's information probe 'what version of IIS (Internet Information Services) are you running' looks (from our firewall/router logs) like every other web request coming into the machine. Let's think about what we'd see if we were monitoring the web server's network connection. Obscurity: Force an Attacker to be less stealthy See, so long as you understand that the server location and port number can't serve as a method of authentication, you haven't harmed your security in the slightest. All we've done is made the server slightly harder to find. Your good access control, in the form of strong authentication, is still present. Does it hurt your site security at all? No, it really doesn't. Now we've got decent access control.Īt this point, is there any harm to hiding the name of the machine and the port number the server is running on? Really, stop and think about this. Let's suppose that you have fairly reasonable protection for your information. Perhaps you even go the extra mile and authenticate people with client-side certificates. You even make sure to put the site on an SSL server.

#SECURITY THROUGH OBSCURITY EXAMPLE PASSWORD#

Now, suppose you put a good password or some method of strong authentication on your company secrets website. This is what we mean by 'security implemented solely through obscurity is bad Since an attacker can often obtain or guess the information that we're obscuring, especially if it is as simple as the listening port of our web server process, we not implementing decent security. They'll even launch 'social engineering' attacks, where they trick your users into giving them the information they need, usually by impersonating someone who should normally have access to that information. They'll possibly run all manners of active scanners or passive sniffers. Someone will find most anything by querying your peer machines, your routers and the target machines themselves. Obscurity just doesn’t work as a method of access control. The Error of Using Obscurity for Access Control As Deep Throat points out on X-Files: 'There's always someone watching.' But never be lulled by it - with modest effort and time, secrets can be discovered. At best, security through obscurity can provide temporary protection. These kinds of holes are discovered all the time.

#SECURITY THROUGH OBSCURITY EXAMPLE SOFTWARE#

A software or hardware vendor might realize that a hole exists in their offering but ship it anyway, thinking that no one will find it.

You may think that you're hiding critical data by burying it several directories deep, but you'd be wrong given the powerful search facilities built into UNIX. Another example here shows that you may think that you're running an obscure UNIX-based web server that no one would dream of breaking into, but your obscurity is no protection in an era when thousands of malicious hackers have access to powerful network scanning tools which may discover your system and its vulnerabilities. Those will obtain access to information that you wanted to keep them away from. While some attackers will never expend the effort to find that web server, many others can and will. See, the problem is that you’ve used the obscurity of the data’s location as your sole method of access control. You’re assuming that no one will know about that web server except that anyone with some network discovery tools (like Cheops, firewalk, snmpwalk and nmap) can find just about every web server on your network. Instead of relying on passwords or another acceptable method of access control, you’re relying on something different. Let’s say that you put your company’s secrets on an internal web server, with no password-protection on the pages.

#SECURITY THROUGH OBSCURITY EXAMPLE PROFESSIONAL#

In this article I’ll talk about how obscurity can aid security -hopefully, I can clear up some misconceptions.įirst, what does the security professional mean by bad “security through obscurity?” We really mean “security implemented solely through obscurity.” This describes the state where your entire method of security resides in hoping that the attacker doesn’t know something about the setup of your network, computer or program. As security professionals, many of us try to teach a few simple lessons to help system administrators become more security-conscious.

Security through obscurity example