I came across this tool recently https://github.com/drk1wi/portspoof

How efficient will it be to use it to confuse hackers doing port scanning? If it's actually going to be pretty efficient, why hasn't it caught up so far? That is, 189 stars for 5 years is bad.

  • 8
    Sounds like security through obscurity which is conceived a bad thing. Mostly it will hinder legitimate use. – Marcel Feb 20 '18 at 6:42
  • 21
    This has the potential of encouraging an attacker to try harder... Seeing a host with mostly blocked ports they may just look for an easier target, but something like this may seem weird or insecure, so they may spend more time trying to attack you. – Itai Feb 20 '18 at 7:00
  • 8
    @jerry: It would be great if you could provide some more context regarding this tool, in case the link goes dead in the future. – Tom K. Feb 20 '18 at 10:47
  • 9
    @schroeder Other tools might get developed. Also: it would be great if I could get the whole idea of this question without reading through a complete tool documentation. – Tom K. Feb 20 '18 at 12:34
  • 13
    @jerry If you have the free time to come here and ask strangers to look at your question, surely you can take the time to make sure that it remains relevant for a while. He's asking for a few sentences explaining the idea, not a thesis paper. – Chris Hayes Feb 20 '18 at 19:47

Multiple problems here.

  1. Dynamic port responses - if I scan you from two different IPs and compare the two responses, do I get a valid port list? If so, it is a very weak defence.

  2. You're burning CPU to respond to the reconnaissance phase of an attack. This can be used against you. Depending on how this is set up, I can kill your server by forcing your spoofer to consume all the CPU on the machine.

  3. Are you sure portspoof doesn't have any extra bonus vulnerabilities that your app DOESN'T have?

  4. Can I slowloris likely non-real ports and see what else stops responding to filter out spam?

  5. If you're running this, and I get a foothold and open a remote command port - will you notice, or will you get lost in your own spam?

  • 8
    Especially since it's written in C++ . C++ is a hard language to write safely in . – Qndel Feb 20 '18 at 22:09
  • I wouldn't say C++ is hard to write safely in (that's C), but because it still has all the C features it's hard to verify that a program written in it is safe. – immibis Feb 21 '18 at 4:28
  • 3
    A lot of these can be mitigated by proper software design or containerization and isolation, but the real killer is #6: It has not been updated in months and looks abandoned. If someone finds a vuln, even assuming it gets reported, who is going to fix it? – Kevin Feb 21 '18 at 5:20

I assume the effectiveness will be very limited.

First of all, exploiting port scanning tools will rarely be useful because most pentesters will use VMs and other confined environments when conducting any attacks.

Second, it is very unclear how useful it is to obfuscate which ports are really open. If you still have services running these obviously have to respond properly. There are only 65536 ports so trying them all is not a big deal. In any case, you will usually have to announce on which ports services run because you want people to find them! Why else are you running them?

And third, answering all queries on all ports might actually generate quite a bit of useless work. You might want to spend those clockcycles elsewhere.

So, these are the first reasons that come to my mind. I have not used this tool but maybe other people think similarly and that is why it has not seen widespread adoption.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.