20

My take on reducing the risk of being hacked on products and installation have often been to create false footprints.

From my own experience, the servers I've spent most time (and hate) on hacking have been those that have claimed to be something they are not.

For example faking services on certain ports that imitate a Windows 2008 server, while in fact the server is a completely different type.

Given of course that one takes all normal approaches to system security, first the traditional with code reviews, system hardening etc - then offensive security testing with penetration testers.

What are the downsides?

I specifically appreciate links to articles and sources on the topic.

Am I fooling myself that this has any effect? I know personally that I am triggered by the first sign of a specific system and would waste time. Most likely increasing (A) the chance of me giving up and trying another approach (or another server/service/target) and (B) the chance of discovery and back-tracking from the attacked target.

Improve this question
10
  • 3
    Note that you increase the risk of some script kiddie being annoyed by you and unleashing its full power on your serves... ^^
    – PlasmaHH
    May 9, 2016 at 8:40
  • 4
    Considering how many script kiddies try all kinds of web software vulnerabilities on servers where that software isn't even installed, do you think something like this would reduce the number of attacks that your actual systems are vulnerable to?
    – user
    May 9, 2016 at 9:11
  • 1
    @MichaelKjörling Yes I think so. It is my assumption that many attackers use the same approximate toolbox that I have and have a decent similar approach as the first wave of attempts. Footprint -> Scan -> Identify -> Run standard vulnerabilities/exploits on Identified services etc that match. Creating custom attacks and fuzzing to create your own payloads is an ugly time-consuming activity that only rarely give results (unless I guess if you are really, really good at it).
    – Simply G.
    May 9, 2016 at 10:33
  • 1
    @SimplyG.: It is not so much a matter of how many think it is, it is about the right people thinking it is. I have for a while been writing service fingerprinting software, and the more complex a service is, the more likely you will be able to find a tiny difference, which then can be automated.
    – PlasmaHH
    May 9, 2016 at 11:02
  • 2
    Obscurity == Intended Misdirection
    – user64273
    May 9, 2016 at 17:45

2 Answers 2

Reset to default
25

It's a lot of work. Not only that, but it's a lot of work that your (legitimate) users will never see or benefit from. Most people would be willing to trade off the nebulous risk of deterring a small subset of hackers (realize that APT hackers, in particular, wouldn't be dissuaded and might even find an extra way into your system if you do something wrong setting up your fake services) in exchange for developing real features that will attract real (paying) customers.

If you've convinced yourself that you're a real target, sure, set up some honeypots (at least then you can invest in measuring how many attempts are being made on your "misdirection servers"). Security is already expensive, and you're talking about adding extra cost, so make sure it's worth it.

Improve this answer
1
  • 2
    Just one more point, adding that much extra complexity would instead weakens the overall system by increasing the chance for exploits and bugs, good answer.
    – CoffeDeveloper
    May 10, 2016 at 8:47
24

Note: I like honeypots a lot but to answer your question some negative aspects include:

You are not reducing your workload.

You are increasing the amount of signals you have to process.

You are increasing your operating costs.

You are taking time away from other security activities which may otherwise help protect actual data & services.

You may be increasing risks to yourself and others by giving the bad actors another machine to launch attacks from, even if they are not aimed at yourself.

You are increasing the work asymmetry against yourself and in the favor of the attacker in an effort to "hopefully" increase the attackers work at a future point in time. This may or may not ever pay off.

Again those are just some potential answers to your question. I think there is an appropriate time for a mature security program to do this but all of the other more important tasks would need to be in place first. Too often I see people focus on what is sexy rather than what is needed so that would be my biggest concern when prioritizing this. These can be very useful if implemented wisely -and- you can make it so that it's cost-effective.

Improve this answer
3
  • Thank you, I must add that I am not talking about a traditional honeypot. This is making the standard system/installation appear like its something else, not setting up a separate system that looks interesting to lure potential attackers?
    – Simply G.
    May 9, 2016 at 6:41
  • 5
    Oh, and one more thing: You might also waste the pentester's time if you don't tell them about the fake setup - which might only cost you money and does not help you discover real vulnerabilities.
    – Lukas
    May 9, 2016 at 7:41
  • 3
    You also attract traffic from the ppl you fool.
    – waltinator
    May 9, 2016 at 17:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .