Combining Port Knocking With OS Fingerprinting

michaelrash writes "Port knocking implementations are on the rise. I have just released fwknop; (the Firewall Knock Operator) at DEF CON 12. Fwknop implements both shared and encrypted knock sequences, but with a twist; it combines knock sequences with passive operating system fingerprints derived from p0f. This makes it possible to allow, say, only Linux systems to connect to your SSH daemon. Fwknop is based entirely around iptables log messages and so does not require a separate packet capture library. Also, at the Black Hat Briefings, David Worth has released a cryptographic port knock implementation based around one-time pads."

Comments

How much more is needed?

[Anonymous Coward]

With a large port knock routine say 20 ports or more, can't you be sure it's YOUR box that's comming in? More defense and limitations are good, sure, but why filter by OS? Is it in case someone gets by the knock?

Re:How much more is needed?

[Xepo]

Correct. The OS fingerprint isn't really even that hard to fake. Read the nmap man page if you're curious, it explains a bit more about it. It basically just has to do with how quickly, and in what way the ip layer responds to different things. (I've not looked at the link in the article so I dunno if it explains OS fingerprinting at all, or if it just says that the new port knocking implementation implements it)

Re:How much more is needed?

[michaelrash]

Yes. It is just another hoop we can make an attacker jump through. If someone sniffs the knock sequence, they can always replay it but it will only be honored if they replayed the sequence correctly (fwknop implements timing delays in knock sequences) _and_ they generate the sequence from the required OS. Of course, using something like Packet Purgatory OS neuances can be spoofed, but at least the bar is just a little higher.

The more complicated you make it,

[Anonymous Coward]

the bigger is the chance of screwing up. The point of port knocking is to have a simple and therefore less bug prone layer around real authentication systems like ssh, so that when a bug in ssh is found, portscanners don't find your vulnerable service. Complicated port knocking systems defeat the purpose of port knocking.

Re:The more complicated you make it,

[Anonymous Coward]

Good.

Now look at the complexity and functionality of SSH, and its share of security problems over the past years.

Then look at port knockers, their simplicity and minimal reliance on bloated libraries. Note they only use a single, simplistic - but cryptographically proven - authentication scheme based on things such as basic symmetric ciphers or one-way shortcut functions, with implementations that could hardly go wrong.

The whole point is, SSH and many other complex services have proven to be not reliable and secure enough to be left open wide without losing sleep over it. Protecting them with a simple and secure solution consisting only of dozens or hundreds lines of code makes sense.

Re:It's kinda cool

[Anonymous Coward]

it appears port knocking is a neat programming project and it seems fun to create a poc.

it seems like a fad, and of course the authors of such programs will defend its usefulness.

my opinion is that this technique is not new, and hackers have been using very similiar things for decades.

and since he mentioned defcon, oh boy has that hacking con gone down hill. Bugs are just not as easy to find now days so the bar has been raised for h4x0rs.

Port knocking, firewalls, DMZs,...

[Rosco P. Coltrane]

are techniques I've seen appearing for the last 10 years that are designed to compartment sections of the net. They make me sad, because that's definitely not what the net was intended to be, i.e. a global interconected network of machines to freely communicate. Instead, the net is slowly being segregated, and you'll soon have to show some sort of proof of identity to do anything other than HTTP. If you don't believe me, just consider how hard it is to do something as mundane as a DCC CHAT on IRC today, as opposed to, say, in 1994.

I realize the need for these things, basically forced upon us by the combination of commercial interests, shitty insecure OS, script kiddies and greedy crackers (not hackers), but all the same, I can't help realize that the internet of today is a far cry from what it was intended to be in terms of freedom of communication...

Re:Port knocking, firewalls, DMZs,...

[grasshoppa]

Never under-estimate the power of stupid people in large groups.

I can't help realize that the internet of today is a far cry from what it was intended to be in terms of freedom of communication

Um...wasn't the internet born at the department of defense? Awfully nice of them, to make this huge network for freedom of communication.

Oh, wait, that's not what it was intended for. It was intended to be a network of communication, built to survive outages of several large nodes, in case of a nuclear attack. It's only been as more and more people began romaticising it, that we've come up with this free communications thing.

While I'm not apposed to it, I am realistic about it. Would you leave your car, complete with keys, parked in a stadium parking lot, with an open door, and a sign stuck on the steering wheel saying, "Please don't take"? That's essentially what you do with your computer when you go online without any sort of protection ( short of the sign, mind you ).

Re:Port knocking, firewalls, DMZs,...

[Sancho]

What if the choices are between not running a server and running a portknocking server?

I have a private server I use for e-mail, irc, and as a convenient, central location to store files. I have no interest in making this server public--it's only on the Internet because to set up a dedicated line to it would be prohibitively expensive. I don't even want people to know the server is there, and if they do find out it's there, I want security to be as tight as possible. Port knocking, in a way, helps to meet my goals. If I was required to let anyone onto my server, I would take it down, which would be the loss of a private asset.

But that doesn't mean you're not right, in a way. The problem with the world today is that it runs on money. Very little is free. Even some HTTP is pay-per, and that's just the way it is until someone finds a way to pay the bills without milking the customer.

Re:Port knocking, firewalls, DMZs,...

[enigma48]

I'm not a history buff but I can't recall anything I've read about ARPAnet being created with the intention of complete access to all connected machines.

I think the majority of people - geeks included, but not to the exclusion of everyone else - think the internet, on the whole, is performing fairly reasonably. Just like in reality, when you have a small group of people working together, issues of trust are much easier to deal with compared to working with hundreds of millions of people.

Blaming "commercial interests, shitty insecure OS, ..." are symptoms of having a ton of people connected. Assuming the internet would be perfect if those bad people didn't exist, there'd be a new group people didn't like: spammers, NET SENDers, etc. Once they are gone, we'd be left with people that use software we don't like, or people from a country we don't like.

Soon enough, the Internet would be compartmentalized exactly the way you fear - into groups of like-minded people instead.

The Internet isn't supposed to be utopia. It was about making resources easier to access and it does that job amazingly well, given the imperfect people using it.

Security Through Obscurity

[gst]

Not more - not less. All that portknocking does is shifting the security to a layer where it doesn't belong.

And even if you don't want others to see that there are services running on your host there are better solutions. e.g. sending a special string to some UDP port.

If someone can sniff your traffic and he knows about portknocking it's trivial for him to detect it. If someone can't sniff your traffic there's no advantage in using portknocking.

Re:Security Through Obscurity

[RC515]

Port knocking has one specific and reasonable purpose: It hides open ports from port scanners. Yes, it's security by obscurity, but as it's supposed to be another layer, it can increase security if, and only if it's simple enough that there is a near-zero chance of introducing new exploitable bugs into the system. Passive monitoring is not necessarily unexploitable. There are bugs in packet capture tools. There will be exploitable bugs in complicated port knocking daemons. Keep port knocking simple and it can be a valuable security enhancement. Make it complicated and it becomes another thing that can break.

Port knocking buys you the time between a new ssh exploit and the fix. It significantly reduces the chance of being found by portscanners and therefore of being hacked. You still have to fix ssh though.

Re:Security Through Obscurity

[Xepo]

The specific example the parent to your comment cited was sending a string to a UDP port. I believe he understands the advantages of port knocking, which you explained unnecessarily. UDP is connectionless, and as far as I can tell, there's not much difference between sending a standard string to UDP to tell the OS to open up the port to you, and port knocking for the same purpose. However, the differences in implementation are vast. UDP is already implemented, whereas these port knocking solutions are still in development. UDP is probably going to be a lot easier to implement without interfacing with the system firewall, hence a lot simpler, and not introducing bugs into your firewall system. About the only advantage port knocking might have over a UDP string is exactly that -- It lays on top of your firewall instead of underneath it, but I'm not quite sure that that would have any advantages whatsoever.

Re:Security Through Obscurity

[Anonymous Coward]

Huh ? Did you read the article ? Hiding your pincode for your credit card is security through obscurity, not more - not less. See how stupid this is ?

Security through obscurity is valid in some case, when the obscurity is deep enough that guessing in the dark is time expensive and must be repeated for each intrusion, and simple enough for the user. For example a security based on hiding logic only needs 1 successfull attempt to be broken (guess the logic and the security is broken until changed, which is not simple), and using a weak password is not time expensive to crack, so both are not valid use of StO.
In the case of port knocking, since it's based on a port sequence, it's analogue to a password, which means that it depends on the user choice of a good sequence (i.e. not trivial).

If you're concerned about the safety of the communication channel, The same problem arises also with traditionnal passwords. Then using One Time Pads (as suggested by the article) solves this problem.

Watching the logs..

[Anonymous Coward]

I always considered watching logs to be a very ugly and inelegant way of doing port knocking. Netfilter is stateful, why not make use of it?

Use the recent match module and something like the following for requiring ports 1000, 2000 and 3000 to be knocked in order and within 30 seconds before allowing ssh from a particular host:

iptables -A INPUT -p tcp --dport 1000 -m recent --remove --name PART2
iptables -A INPUT -p tcp --dport 1000 -m recent --remove --name PART3
iptables -A INPUT -p tcp --dport 2000 -m recent --remove --name PART3
iptables -A INPUT -p tcp --dport 1000 -m recent --set --name PART1
iptables -A INPUT -p tcp --dport 2000 -m recent --set --name PART2
iptables -A INPUT -p tcp --dport 3000 -m recent --set --name PART3
iptables -A INPUT -p tcp --dport 22 -m recent --rcheck --seconds 30 --name PART1 --name PART2 --name PART3 -j ACCEPT

Now you don't have to clutter the system with logs and a daemon that may run into trouble.

Re:It's kinda cool

[Lord Kano]

Not only is it security through obscurity

Only in the same sense that passwords are security through obscurity.

Right combination of keystrokes, right combination of ports to knock, these sound very similar to me.

LK

Re:It's kinda cool

[Sancho]

It's not.. I almost suspect you of trolling.

The primary purpose of port knocking is to hide the fact that you have open ports to begin with. You don't want to have those ports unprotected once the right knock sequence is in place. You want both password/challenge AND port knocking so no active scanner detects your open ports.

Re:It's kinda cool

[eric76]

There is absolutely nothing wrong with using something a bit obscure to help fend off attacks.

The only time that "security through obscurity" is wrong is if that is your entire approach to security.

Even if you have the latest and greatest copy of the most secure software written to perform some service, there is always a possibility that there is something exploitable that is yet unknown.

Port knocking is an excellent way to greatly reduce the probability that someone will be able to use a newly discovered exploit from using it against your server before an update is available to fix the exploit.

Of course, if someone is in the right place and can monitor the network traffic from another computer somewhere along the path, they can discover the port knocking sequence. For that reason, you still need your normal security and you still need to keep the patches up to date.

But the result will still be a vastly improved possibility of avoiding an attack when a vulnerability is found.

They Will Never Know

[Pan T. Hose]

I use portsentry for protection against scans. The result is that all my ISP scanners are now in hosts.deny and consequenlty I can run any server I want and they will never know and can't complain about it...

They will never know.

Unless... they see their logs.

Your ISP may not be able to directly open your ports but they have to receive, handle and send every single inbound and outbound IP packet of yours, each of them containing source and destination port numbers.

If they don't know the easiest way to see whether you run any servers by just observing port numbers in your traffic, then, if I were you, I wouldn't want such imbeciles for my ISP.