Timeline for Does it improve security to use obscure port numbers?
Current License: CC BY-SA 4.0
13 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 23, 2018 at 21:18 | comment | added | Tom | @jpmc26 - we talk past each other. I've already addressed everything you said and keep saying. The point you make now I addressed in my original posting. I really have nothing to add. | |
| Jul 23, 2018 at 21:07 | comment | added | jpmc26 | "If you thwart 99% of attackers, it means you get hacked once every 10 years instead of 10 times every year. If you think that is not a difference, we have nothing to discuss." This falsely assumes that we're comparing obscure ports to no protection at all. That isn't at all what I've suggested. What I've said is that the obscure port does nothing if you have the correct protections and there's no reason to avoid using them. If you get hacked once every 10 years, you're failing. | |
| Jul 23, 2018 at 9:27 | comment | added | Willtech | For sure script-kiddies run port scanners looking for the favourite port of their favourite in. Having a different port means 99.9% of script-kiddies and self-distributing 0-days find nothing and the 0.1% target attack is not staved off even a little. | |
| Jul 19, 2018 at 20:56 | comment | added | Tom | If you thwart 99% of attackers, it means you get hacked once every 10 years instead of 10 times every year. If you think that is not a difference, we have nothing to discuss. | |
| Jul 19, 2018 at 20:43 | comment | added | jpmc26 | @Tom They need to resist every attacker in the threat model(s) you're considering. Obviously, the threat model does not consist of only attackers who do not check other ports; this is demonstrated by the OP since they say only 99% of attackers would be thwarted by this mechanism. Attackers are very clever. Assuming they won't discover information that's "hidden" in plain site is just stupid, as history shows us. | |
| Jul 19, 2018 at 12:48 | comment | added | Tom | I know how a firewall works. I was assuming the questioner is not a complete idiot and has SSH open because he needs it to be accessible. Your 2nd part shows a typical security misconception - that your defenses need to resist every attacker. That is wrong. If I need to explain why, please open a new question, that goes beyond the character limit of comments. | |
| Jul 19, 2018 at 12:07 | comment | added | jpmc26 | @Tom Zero day on SSH doesn't matter if the attacker can't even connect to SSH. With a firewall, a vulnerability (such as zero day) on the firewall itself is required to even attack SSH. The only scenarios where these obscurity methods matter are ones where the proper security measures are not in place, and in these scenarios, a slight increase in the attacker's effort defeats them. Taking the chance that not a single attacker will spend it is stupid. Use security measures that make obscurity irrelevant if you actually want to defend against threats, or you're not secure at all. | |
| Jul 19, 2018 at 10:28 | comment | added | Tom | @jpmc26 how would a 0-day in the firewall matter in this question? I was clearly speaking about a 0-day in sshd and I described the scenario clearly. We both agree that using a non-standard port gives at best a small increase in security, but there are scenarios in which it does make a difference. | |
| Jul 19, 2018 at 8:23 | comment | added | jpmc26 | @Tom You may want to reread the comment because I answered that. Your answer suggests that a nonstandard port helps protect against zero day vulnerabilities. If you're worried about those in your firewall, then you can use multiple firewalls to achieve better defense in depth than a nonstandard port does in case one of them fails. With this set up, the nonstandard port buys you nothing, and this setup protects against more scenarios than a nonstandard port (like someone who bothers to scan all ports). Obscurity is subpar at best. Are you sure I'm the one who doesn't understand security? | |
| Jul 19, 2018 at 4:10 | comment | added | Tom | @jpmc26 you don't understand security and believe it is a binary property. It isn't. I'm also curious why I need to block a closed port off with two firewalls and why that gives me additional security. | |
| Jul 18, 2018 at 18:47 | comment | added | jpmc26 | Your first sentence is wrong. It can only "improve" security if the correct protection (e.g., a firewall blocking port 22 from internet traffic, or multiple firewalls from different vendors if you want defense in depth, e.g. a firewall on the device that allows public internet access into the network and then a machine level firewall) is not in place. If it is not in place, then the defender will still lose to slightly more sophisticated attacks that bother to check other ports. Losing to 1% of attackers is still losing. | |
| Jul 17, 2018 at 15:54 | comment | added | Luc | "there could be a 0-day tomorrow and [attackers] will just hit as many machines as possible on the standard port" Good point that I haven't seen mentioned in other answers! | |
| Jul 17, 2018 at 12:21 | history | answered | Tom | CC BY-SA 4.0 |