IT Employment

Ask something
Discussion Locked

Security By Obscurity.

0 helpful
19 replies

by admin 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

How many of us here use this tactic? I am just curious. There are some things I just don't want to share because the reason they work is that so few people know about them.

Security by Obscurity can contain:

Custom Software
Obscure Software
Non-Standard ways of Routing etc.
Non-Standard Protocols
Non-Standard Topology
Obscure Hardware
etc.

I have found that using a mix of highly standardized products and obscure or seldom used products to help quite a bit. Sometimes it helps to "appear as one is not" or provide an easy path away from what you don't want got at :)

I was just curious if anyone else (without having to give away trade secrets) ever used this approach.

~

19 replies

by guruofdos

1) Arcane
2) Obscure
3) Unorthodox
4) Undocumented
5) Unique
6) Unconventional

I like to fly in the face of fashion!

by scarecrow71

out of date!
For obscure read off the wall!
For Unorthodox read out of touch with reality!
For undocumented read I can't remember how I did it!
For Unique read nobody else is stupid enough to try it!
For Unconventional read illegal!

You don't work for Microsoft do you?

Just kidding!!

by guruofdos

For Arcane read....using well proven methods not taught these days but have been proven over years by 'experienced' IT managers.

For obscure read....the sort of methods that aren't discussed on hacking web sites by crackers and spoofers.

For Unorthodox read....methods not taught on Microsoft Cert Courses but developed over time to meet our needs.

For undocumented read...if it's written down and someone finds it...it is no longer secure!

For Unique read...nobody else is clever enough to think these things out for themselves!

For Unconventional read...we don't use the same methods that others do and consequently don't get the same security issues.

Let me guess....YOU 'work' for a direct mailing company?......Only kidding!

by stephen kawamoto

In 1999 we had a breakin at a community ISP for the environmental community.

The thief stole a 386 computer and a 286 notebook, but left my P-133 computer alone because I had the cover off to facilitate upgrades easily.

This is known as security through making your computer look like junk that needs to be put together in 15 minutes -- nothing a thief hates more is to put together what he wants to steal.

I know that some computer corproations are making obscurity a security measure by making computers that are in one tiny box that can be hidden away in a crawlspace or under the desk.

This is a step in the right direction. Computers shouldn't have to be a desktop or a tower, but ubiquitous and hidden away from michief and larceny.

The removable storage should be accessible through USB 2.0 or Firewire.

All that a potential thief should see is a monitor, a keyboard, a mouse, a USB floppy drive and a Firewire cd-rom drive or hard disk.

by ghstinshll

All a thief EVER sees in a true terminal environment is a monitor, KB, and mouse... get the hint? We'll all be shifting that way one day, folks!

by generalist

This sounds amazingly like the dumb terminal and keyboard of the green screen days. The CPU is in a secure place and only the user interface hardware is where it can be reached.

For that matter, why not build the screen, KB and mouse into the deck.

by admin

I used to hang out with a guy whose car was probably sitting on 10-15 grand in parts and machining. Even so, it was primer grey, black and rust with a horribly tattered interior and ugly yet lightweight wheels. He always left it with the windows down. It never got stolen.

:)

by tomsal

;)

Sounds exactly like one of my brothers' cars.

Was this guy about 5 feet tall but had the built upper body that would look big even on a 6 ft 6 tall guy? lol.

by lordinfidel

But you know how I operate.

I prefer cloak and dagger. I make my OS's so obsuficated to determine what they are, That the would be hacker would not waste their time on me.

One of my classic things would be to take a apache webserver. Have itreturn http headers like it was coming from a MAC Web Server. Then return tcp messages like it was coming from a NT4 box. Then confuse the hacker even more by generating Non-Descrip error messages.

I would not rely on obscure products for my security. Since they can inadvertantly poke holes in your security.

The best example I have of this is authentix for IIS. Instead of using NT permissions to secure your site, you would use Authentix.

However, Authentix contains a exploit where you can add a . in the path, and bypass the authentix security. Not so secure now don't you think?

Then there is ColdFusion. You can't restrict the root drives to only domain admins and system. You have to allow users also. Another reason not to use 3rd party products.

I always try to stay as close as possible to the native OS. It allows me to track more closely exploits that can be levied against me.

Alot of times 3rd party products will require you to open things that you don't want to open.

Case in point, something I love, Radmin. In order for radmin to work in a 2K domain setting, you can not restrict NTLMv2 requests only. By setting that in the registry, Radmin can not authenticate you as a domain user. You would need to use a local machine account. Which when you think about it may not be such a bad thing.

by admin

" prefer cloak and dagger. I make my OS's so obsuficated to determine what they are, That the would be hacker would not waste their time on me."

Obsuficated.... heheeh

I was thinking more along the lines of customizing software.... or even customizing non-standard software, which you are obviously up to..... :)

relying on this alone, obscure product, doesn't make sense, but it's not hard to argue that much stuff is targeted at cisco and ms. still I get where you are going and want torespond to the next thread... if you are feeling charitable... :)

by lordinfidel

I take this even further.

Even with the small networks that I build on the side. I hold them to the same network security standards that I employ on my corporate networks.

Even though these small networks are protected by NAT/firewall, and they don't run web services.

I still employ ingress/egress filtering. The machines are not running services that are not needed.

I require them to vpn into their netwk using IPSec.

The few servers that they have are locked down.

One of the things I have done is devoloped my own personal checklist of things to do to certain OS's. That way when I build a system, I know the basic security measures that I need to take to secure that machine.

by admin

"One of the things I have done is devoloped my own personal checklist of things to do to certain OS's. That way when I build a system, I know the basic security measures that I need to take to secure that machine."

This is the heart of what I wasgetting to! Are you willing to share your entire checklist for each OS?

In one way, this would be very helpful to me, but with all the people sharing this board, if they copy it and target it or use it on their servers as a roadmap, doesn't it become somewhat of a security risk automatically? If not, by all means please post it! I am sure I can learn a lot from it and apply some of it to my work.

I guess I was just thinking one day about a question someone posted. I knew a way to help around a thing here, and yet realized that I did not want everyone to know this or I would have to myself find a different way to keep it working! Then I thought..... hey, that may be one of the impediments to new guys trying to get into this field,that many of us, whether it's conscious or not, may have some things that we just don't want to share because it's going to make our jobs harder if everyone knows!

I tried once to get a locksmith to show me how to read the scratches on a blank asit goes in and out of a lock to get the pin reliefs filed out..... the answer was: "Leave!" heheehhe I figured it out eventually anyway... but.... I still wonder if you would post your personal checklist or keep it "obfusicated" like your network info. :)

by ghstinshll

I guess that's why so many of us keep our "docs" in our own directrories at home, on CD, or some other obscure location as well.

by lordinfidel

My "checklists" are essentially just that.

But they do not provide explanations.
And they are really cultivated from various books and sites.

It's usually like I'm installing some product, let's say FreeS/Wan, and in my notes i'll add in whatpermissions the directories and files should be set to.

Most of it is intuitive and I don't even bother writing down. Like removing all consoles from securetty so root can not log in directly.

or on winblows, renaming the true admin account and locking it out.

Or employing urlscan on IIS.
Or use IPPersonality on linux (changing the way the stack reports back)

Or unchecking most everything during the install process of the OS.

Most of this stuff I just do without thinking about it.

One day I will write it and post it on my personal site.

by ghstinshll

care to give some "excerpts" from those lists? That's a hell of an idea! I need to be better about lists... I lost a user's PST fiel the other day for the first tie in 3 years or so... I was so embarrassed. I'm so good about documentation, not on helists part...

by lordinfidel

It's by no means complete.... It was just some notes I took one time.

1. remove services

rpm -e sendmail
/usr/sbin/setup
chkconfig --level 2345 apmd off
chkconfig --level 2345 pcmcia off
chkconfig --level 2345 portmap off
chkconfig --level 2345 snmpd off
chkconfig --level 2345 snmptrapd off

/usr/sbin/setup
uncheck anything that is left

2. Configure SSHD
/etc/ssh/sshd_config
Uncomment:
port 22
Listen Address 0.0.0.0
Permit Root login: NO
strictmodes yes
rhostsauth no
ignorerhosts yes
permit empty pass no

chown -R root:root /etc/ssh
chmod 755 /etc/ssh
chmod 600 /etc/ssh/ssh_host_key
chmod 644 /etc/ssh/ssh_host_key.pub
chmod 644 /etc/ssh/sshd_config

3. wheel group
vi /etc/group add wheel:x:501:uname

/bin/chgrp wheel /bin/su
/bin/chmod 4750 /bin/su

4. remove all consoles from /etc/securetty

by scarecrow71

Oh well, I guess I was asking for that!

BTW I do 'work' in direct mailing as you put it, and they call me Scarecrow because I'm oustanding in my field!!!

This discussion is closed to new replies.