Slashdot Mirror

← Back to Stories (view on slashdot.org)

Combining Port Knocking With OS Fingerprinting

Posted by timothy on from the belt-and-suspenders-and-tape-and-elastic dept.

michaelrash writes "Port knocking implementations are on the rise. I have just released fwknop; (the Firewall Knock Operator) at DEF CON 12. Fwknop implements both shared and encrypted knock sequences, but with a twist; it combines knock sequences with passive operating system fingerprints derived from p0f. This makes it possible to allow, say, only Linux systems to connect to your SSH daemon. Fwknop is based entirely around iptables log messages and so does not require a separate packet capture library. Also, at the Black Hat Briefings, David Worth has released a cryptographic port knock implementation based around one-time pads."

23 of 154 comments (clear)

  1. It's kinda cool by Lord+Kano · · Score: 5, Interesting

    but is anyone out there using port knocking for serious security?

    LK

    --
    "Hi. This is my friend, Jack Shit, and you don't know him." - Lord Kano
    1. Re:It's kinda cool by Lord+Kano · · Score: 5, Insightful

      Not only is it security through obscurity

      Only in the same sense that passwords are security through obscurity.

      Right combination of keystrokes, right combination of ports to knock, these sound very similar to me.

      LK

      --
      "Hi. This is my friend, Jack Shit, and you don't know him." - Lord Kano
    2. Re:It's kinda cool by Sancho · · Score: 5, Insightful

      It's not.. I almost suspect you of trolling.

      The primary purpose of port knocking is to hide the fact that you have open ports to begin with. You don't want to have those ports unprotected once the right knock sequence is in place. You want both password/challenge AND port knocking so no active scanner detects your open ports.

    3. Re:It's kinda cool by HermanAB · · Score: 4, Interesting

      I use portsentry for protection against scans. The result is that all my ISP scanners are now in hosts.deny and consequenlty I can run any server I want and they will never know and can't complain about it...

      --
      Oh well, what the hell...
    4. Re:It's kinda cool by eric76 · · Score: 4, Insightful

      There is absolutely nothing wrong with using something a bit obscure to help fend off attacks.

      The only time that "security through obscurity" is wrong is if that is your entire approach to security.

      Even if you have the latest and greatest copy of the most secure software written to perform some service, there is always a possibility that there is something exploitable that is yet unknown.

      Port knocking is an excellent way to greatly reduce the probability that someone will be able to use a newly discovered exploit from using it against your server before an update is available to fix the exploit.

      Of course, if someone is in the right place and can monitor the network traffic from another computer somewhere along the path, they can discover the port knocking sequence. For that reason, you still need your normal security and you still need to keep the patches up to date.

      But the result will still be a vastly improved possibility of avoiding an attack when a vulnerability is found.

  2. OS fingerprinting, whew! by Anonymous Coward · · Score: 4, Funny

    thank goodness, if there's one thing a hacker can't get his hands on, it's a copy of Linux!

    yuk yuk yuk

  3. Layers by danielrm26 · · Score: 4, Interesting

    1. TCPWrappers (has to be be right IP and/or daemon)
    2. Portknocking (has to have the right sequence)
    3. Passive Fingerprinting (only Linux and BSD systems can connect)
    4. Keys Only (you must have the correct DSA private key)

    Usually unnecessary, yet very interesting - much like Slashdot itself....

    --
    dmiessler.com -- grep understanding knowledge
  4. The more complicated you make it, by Anonymous Coward · · Score: 5, Insightful

    the bigger is the chance of screwing up. The point of port knocking is to have a simple and therefore less bug prone layer around real authentication systems like ssh, so that when a bug in ssh is found, portscanners don't find your vulnerable service. Complicated port knocking systems defeat the purpose of port knocking.

  5. In other news... by AvantLegion · · Score: 4, Funny
    Microsoft IIS has implemented a similar scheme to only allow HTTP sessions to Microsoft OS running clients.

  6. Port knocking and some added ingredients by ThufirHawat · · Score: 5, Interesting

    While port knocking is by now an established technique, I do not think OS fingerprinting adds anything useful, because the ease of static replay attacks is left unchanged by OS fingerprinting.
    Though not that easy, OS spoofing is not remarkably labour intensive, and setting up a "OS generator" who will replay the static attack with every known OS is a distinct possibility.
    In other words, though a nice intellectual possibility, it is perhaps of rather limited application.
    Now, mixing instead knocking and a cryptographic application seems to me instead more promising.

    --
    Thufir Hawat
    Part-time Mentat
  7. Port knocking, firewalls, DMZs,... by Rosco+P.+Coltrane · · Score: 4, Insightful

    are techniques I've seen appearing for the last 10 years that are designed to compartment sections of the net. They make me sad, because that's definitely not what the net was intended to be, i.e. a global interconected network of machines to freely communicate. Instead, the net is slowly being segregated, and you'll soon have to show some sort of proof of identity to do anything other than HTTP. If you don't believe me, just consider how hard it is to do something as mundane as a DCC CHAT on IRC today, as opposed to, say, in 1994.

    I realize the need for these things, basically forced upon us by the combination of commercial interests, shitty insecure OS, script kiddies and greedy crackers (not hackers), but all the same, I can't help realize that the internet of today is a far cry from what it was intended to be in terms of freedom of communication...

    --
    "A door is what a dog is perpetually on the wrong side of" - Ogden Nash
    1. Re:Port knocking, firewalls, DMZs,... by danielrm26 · · Score: 4, Interesting

      I agree with your points, but surely you must see that this commentary of yours applies to pretty much every invention known to man that is both powerful and started out being free and open.

      Look at air travel - there you have spend a ton of time just getting on a plane because of very few bad people. The Wright brothers didn't want this, I'm sure, but it doesn't mean the invention is being perverted in any way; it only says that our world is hostile and that we must protect ourselves from ourselves. Anything useful and completely open these days is ripe for exploitation.

      --
      dmiessler.com -- grep understanding knowledge
    2. Re:Port knocking, firewalls, DMZs,... by grasshoppa · · Score: 4, Insightful

      Never under-estimate the power of stupid people in large groups.

      I can't help realize that the internet of today is a far cry from what it was intended to be in terms of freedom of communication

      Um...wasn't the internet born at the department of defense? Awfully nice of them, to make this huge network for freedom of communication.

      Oh, wait, that's not what it was intended for. It was intended to be a network of communication, built to survive outages of several large nodes, in case of a nuclear attack. It's only been as more and more people began romaticising it, that we've come up with this free communications thing.

      While I'm not apposed to it, I am realistic about it. Would you leave your car, complete with keys, parked in a stadium parking lot, with an open door, and a sign stuck on the steering wheel saying, "Please don't take"? That's essentially what you do with your computer when you go online without any sort of protection ( short of the sign, mind you ).

      --
      Mod me down with all of your hatred and your journey towards the dark side will be complete!
    3. Re:Port knocking, firewalls, DMZs,... by enigma48 · · Score: 4, Insightful

      I'm not a history buff but I can't recall anything I've read about ARPAnet being created with the intention of complete access to all connected machines.

      I think the majority of people - geeks included, but not to the exclusion of everyone else - think the internet, on the whole, is performing fairly reasonably. Just like in reality, when you have a small group of people working together, issues of trust are much easier to deal with compared to working with hundreds of millions of people.

      Blaming "commercial interests, shitty insecure OS, ..." are symptoms of having a ton of people connected. Assuming the internet would be perfect if those bad people didn't exist, there'd be a new group people didn't like: spammers, NET SENDers, etc. Once they are gone, we'd be left with people that use software we don't like, or people from a country we don't like.

      Soon enough, the Internet would be compartmentalized exactly the way you fear - into groups of like-minded people instead.

      The Internet isn't supposed to be utopia. It was about making resources easier to access and it does that job amazingly well, given the imperfect people using it.

  8. Re:How much more is needed? by vranash · · Score: 5, Interesting

    Because the next step is to generate 'fake' OS fingerprints for the client computer, thus insuring not only must someone reply with the right sequence, but also send back the nuances of a specific OS to do so... kinda like recieving a callback to which you must reply in the proper accent before you'll be allowed in :)

    The above is completely conjecture, but it sure does sound cool ;p

    -- vranash

  9. Security Through Obscurity by gst · · Score: 4, Insightful

    Not more - not less. All that portknocking does is shifting the security to a layer where it doesn't belong.

    And even if you don't want others to see that there are services running on your host there are better solutions. e.g. sending a special string to some UDP port.

    If someone can sniff your traffic and he knows about portknocking it's trivial for him to detect it. If someone can't sniff your traffic there's no advantage in using portknocking.

    1. Re:Security Through Obscurity by RC515 · · Score: 4, Insightful

      Port knocking has one specific and reasonable purpose: It hides open ports from port scanners. Yes, it's security by obscurity, but as it's supposed to be another layer, it can increase security if, and only if it's simple enough that there is a near-zero chance of introducing new exploitable bugs into the system. Passive monitoring is not necessarily unexploitable. There are bugs in packet capture tools. There will be exploitable bugs in complicated port knocking daemons. Keep port knocking simple and it can be a valuable security enhancement. Make it complicated and it becomes another thing that can break.

      Port knocking buys you the time between a new ssh exploit and the fix. It significantly reduces the chance of being found by portscanners and therefore of being hacked. You still have to fix ssh though.

    2. Re:Security Through Obscurity by OzRoy · · Score: 4, Interesting

      People who make blanket statements like "Security through obscurity is bad" really annoy me. What a load of crap.

      Secuirty through obscurity is bad when it's the only form of security. However, what is bad about using it to enhance existing security? What is bad about making things that little bit more difficult for a hacker?

      No where in this has the author said you should replace your existing security models with this. All it's done is add another layer to help disguise your existing security making it that much harder to crack. No one has "shifted" the security anywhere.

    3. Re:Security Through Obscurity by wolfb · · Score: 4, Interesting

      I agree that UDP could be used similarly to port knocking. Both methods will serve equally well when the attacker is unaware of the method you choose to use. (true security through obsecurity). I also agree that both methods are equally vulnerable if the attacker can sniff your network traffic, and they can get in by replaying the requests.

      However, lets assume that the security daemons are *not* vulnerable to replay type attacks becuase we use one time pads, or computed keys or something. In this case, sniffing will tell the attacker what method is in use, but it won't allow them to get in by simply repeating a successful login sequence. Are the methods still equivalent?

      I would think that port knocking would still be safer of the two. The port knocking monitor is still sitting behind the firewall, isolated from the network traffic. It would be more difficult to induce a failure in the monitor. Even if the monitor failed, the security would revert to the firewall -- which means you don't get in.

      On the other hand, your UDP daemon would have to be written just as carefully as the services you are trying to protect. A buffer overflow, or any similar flaws in your daemon could allow someone to break in through your daemon. And such a flaw could be exploited blindly too -- all the attacker would have to suspect is that you are using a flawed daemon.

      Am I wrong?

    4. Re:Security Through Obscurity by groomed · · Score: 4, Interesting

      Not more - not less. All that portknocking does is shifting the security to a layer where it doesn't belong.

      Yes, but that's exactly the point. Portknocking is a steganographic application: it doesn't protect the message, but hides the existence of the message. It does so precisely because it interferes at a layer where it doesn't belong.

      And even if you don't want others to see that there are services running on your host there are better solutions. e.g. sending a special string to some UDP port.

      No, because having a server listen on a UDP port clearly signals the expectation of meaningful communication. The equivalent of portknocking would be a server that listens on a UDP port, but rather than looking at the string it receives, looks at (say) the delay between each byte received. Obviously network delays and other uncontrollable factors make this impractical.

      If someone can sniff your traffic and he knows about portknocking it's trivial for him to detect it. If someone can't sniff your traffic there's no advantage in using portknocking.

      It's not that simple. Even if somebody can sniff traffic in principle, he can't sniff everybody's traffic all the time. He has to evaluate which targets are likely to yield anything of value. Since a system protected by portknocking does not give him any clues of what he can expect to find, why would he sniff your traffic?

  10. NOT a one-time pad by Dwonis · · Score: 4, Informative

    This is a one-time password system, which uses hashes, just like S/Key does. This is NOT a one-time pad system.

  11. Re:How much more is needed? by Xepo · · Score: 4, Interesting

    Well, as another poster pointed out, if someone sniffs what ports you're connecting to, then it would be simple to replay that knock. That's the reason you need a security level underneath it, and shouldn't rely on port knocking unless it's a changing sequence (like the one-time pad idea also mentioned in the post).

    I'm not quite sure how the OS detection is supposed to help. Maybe you could customize things for different OSes? As long as port knocking schemes are implemented on two OSes, you could let the port knocker determine which OS you're connecting from, and connect to a specific service depending upon it. I don't really see any other use for the OS-dependent port knocking, but it's something that's cool, and not been done before, so I guess it's news-worthy.

  12. OpenBSD by pmf · · Score: 4, Informative

    OS detection combined with firewall rules is already implemented in OpenBSD.