I’ve read an article which describes how to simulate the close ports as open in Linux by eBPF. That is, an outside port scanner, malicious actor, will get tricked to observe that some ports, or all of them, are open, whereas in reality they’ll be closed.
How could this be useful for the owner of a server? Wouldn’t it be better to pretend otherwise: open port -> closed?
You must log in or register to comment.
Can you please kindly link to that article, if it’s publicly available?
No!
Alternatively, just open all the ports?
My ports are always open for you, my son. And doors, and windows.
You can’t pretend an open port is closed, because an open port is really just a service that’s listening. You can’t pretend-close it and still have that service work. The only thing you can do is firewalling off the entire service, but presumably, any competent distro will firewall off all services by default and any service listening publicly is doing so for a good reason.
I guess it comes down to whether they feel like it’s worth obfuscating port scan data. If you deploy that across all of your network then you make things just a little bit more annoying for attackers. It’s a tiny bit of obfuscation that doesn’t really matter, but I guess plenty of security teams need every win they can get, as management is always demanding that you do more even after you’ve done everything that’s actually useful.
You can’t pretend-close it and still have that service work.
indeed, a service on a port would no longer properly work. However, pretending that an open port is closed is possible the same way when pretending that’s open
Maybe what you’re referring to is along the lines of a port being open but the software on the other side of it not sending acknowledging responses?
Possibly to confuse os detection. Not sure if it would be sufficient though.
Maybe a port that is actually open doesn’t look as interesting
how so?
From an attacker perspective you would do a quick scan to find open ports, then focus on those ports with more expensive/slower scans to find out what is running on those ports. If everything reports open then what ports do you focus on first? So not so much that actually open ports are less interesting, but that actually open ports are harder to find among all the ports.
Do you youself understand what you’re talking about?
then focus on those ports with more expensive/slower scans to find out what is running on those ports.
What do you mean by “focus on those ports”? What are “more expensive/slower scans”?
If everything reports open
not every port gets reported to be open but only some of them
what ports do you focus on first?
me? or an attacker? he could work with any ports he wishes
Do you youself understand what you’re talking about?
I am by no means an expert in this area. But I have some understanding of how things work.
What do you mean by “focus on those ports”? What are “more expensive/slower scans”?
There are many different levels of scans you can do on ports - the first and simplest is just trying to connect to see if the port is open. But that only tells you if the port is open. You then need to try and figure out what service is running on the port which is done by trying to communicating with it and seeing what it replys with. E.g. sending a http request to see if a http server is listing, or trying to start a tls connection for https). Once you know what service is running you can make additional queries to try and figureout what version it is running which can tell you what vulnerabilities it is exposed to. Each of these might need a different connection, and you might need to cycle through many different queries to get a response from the server - all of that is far more expensive than just checking to see if the port is open.
So you generally want to preform a quick scan of open ports, then follow up on a deeper scan of those ports to gather more information about what is running on the port. Nmap, the tool generally used for this, has these different modes you can tell it to scan in and is able to do simple TCP connection scans, or more detail scans for detecting the service an OS (and their versions) as well.
not every port gets reported to be open but only some of them
That was a hypothetical, not having read whatever article you are talking about. But I would assume that a eBPF tool that fakes open ports would do so to pretend a large number of ports are open at least. Though that is just speculation on my part.
me? or an attacker? he could work with any ports he wishes
That is from an attackers perspective.
Ok, back to this then:
If everything reports open then what ports do you focus on first?
I don’t see an issue here. An attacker would be overwhemed with choise and excitement so that he wouldn’t be able to decide which port to choose first, get stuck for a several months unable to decide? He’d toss a coin then.
Its costs him time - which is the point. They would have to do more detailed checks on every port which costs them time. Attackers are typically scanning loads of ports over large ranges of IPs, any small slow down on each can drastically slow down their overall progress making the attack less feasible and more expensive to undertake.
but an attacker isn’t obliged to take on all the open ports, he could work with some of them - the ones that may seem the most interesting to him
