Re: a record?

[Robert Bonomi <bonomi () mail r-bonomi com>]

> From: "Patrick W. Gilmore" <patrick () ianai net>
> Subject: Re: a record?
> Date: Sun, 20 Nov 2005 10:45:21 -0500
>
> On Nov 20, 2005, at 6:17 AM, Elmar K. Bins wrote:
>
> > > Unfortunately, we now have decades of experience in cybersecurity  
> > > that
> > > this isn't true.  It appears to work for a while, but on the Internet
> > > bears are always hungry and learn.  There are people actively  
> > > scanning
> > > for any open ports running any protocol, without a SPECIFIC  
> > > interest in
> > > your computer.
> >
> > Funnily, I see many many more scanning attempts for the same port (or
> > handful of ports) across entire networks than the other way around.
> >
> > And as stated before: If somebody scans 63023, he has interest in your
> > site and is worth the effort of doing something about it. That's the
> > whole point in changing the port.
> >
> > Changing the port is not making the system more secure, it only  
> > filters
> > out passers-by.
>
> I'm going to repeat what Sean said, because you clearly didn't read  
> what he said:
>
> "There are people actively scanning for any open ports running any  
> protocol, without a SPECIFIC interest in your computer."
>
> Allow me to re-state again in slightly different language so you  
> understand this time:
>
> Changing your port may (will?) lower the number of automated scans  
> you see hitting your daemon, but it will _NOT_ eliminate them. 

You know, you and he are "having an agreement", in large part.  He 
*expressly*disclaimed* any increase in security.  that his approach 
*only* eliminated the casual 'passers-by'.

>                                                                 IOW:  
> Just because someone is probing for an SSH daemon on 65K ports  
> against your box does _NOT_ mean he has a specific interest in your box.

A sweep across all ports on each box, for a specific protocol,  is
orders of magnitude slower than scanning only the (be it a single one
or a handful) 'well known' ports for that service.

A scan-all-ports search can only check 16 machines in the time a single-port
scan can check _over_a_milliion_ machines.

The scan-all-ports searcher is clearly more interested in finding an exploit
on "one of a relatively small number of boxes" than he is in 'finding an
exploitable box, "somewhere"'.

He is concentrating his attack efforts on a _comparatively_small_ range
of addresses, rather than on a broad-based 'opportunistic' search.

And he has a 'reason' for doing that.  It may well *NOT* be "because of
who the boxes belong to", nor "what 'interesting' data can be found on
them" -- it may simmply be that they're on a 'fat pipe' connection.  or
'who knows what.'

> If you honestly believe that just 'cause someone tried "ssh -p 63xxx  
> $YOUR.BOX" it means he is specifically targeting your box, well, that  
> is your prerogative.  You are almost certain to be wrong at least  
> part of the time, though.

The guy who does that _is_ "more worrisome" than the 'casual door knocker'
on 'port 22'.

Whether or not he's after me _in_particular_, I don't really care.  He is
mounting a 'more determined' attack against my resources, than the average
clown.  

*AS*SUCH*, the 'wise man' takes faster, and more aggressive, defensive 
actions when this type shows his face.   He is considerably more determined,
and quite probably somewhat more skilfull, than the 'typical' doorknob
rattler.  This is true, whether or not he's deliberately going after _me_.
<grin>


Lastly, by setting things up such that you don't have to examine all the
port 22 doorknob rattling to see if there's any thing 'more determined'
going on -- that 'noise reduction' makes the serious attempts *much* more
visible.

"Security by obscurity" is _not_ a complete solution, in-and-of itself, no 
question.  However, it _can_ be a big 'first step' to help in weeding out 
the 'casual' stuff from the more determined attempts.