Port Knocking, a charming security through obscurity protection
This post is a short
analysis of the idea behind port knocking, the reasons why it provides a
layer of security to systems and its limits when it comes to usability.
Introduction
Introduction
A subset of network services
is meant to be accessible only by few authorized users (mainly system
administrators). Services like SSH, web administrative panels, (S)FTP are often
the most targeted because, if exploited, may allow an attacker to gain a
foothold in the system. Even information disclosure of running processes,
username enumerations and similar actions can allow an attacker to collect
enough information to plan more targeted and harmful attacks.
At this point port
knocking comes in as a niche solution to conceal this type of network services
from massive Internet scanner (e.g. Shodan).
It also comes handy
for protecting critical network services in the scenario that another host of the
intranet have already been compromised and leveraged as pivots.
Port knocking as a positive security through obscurity solution
Even if port knocking shields network services with a 'security through obscurity' mechanism, it does not introduce new security issues in addition to the ones that may already threaten the software under its protection. For example, an attacker that bypasses this mechanism has still to exploit the embedded authentication layer that the targeted service provides.
An overview of common
implementations
Most of port knocking
implementations consist in hiding the ports associated with a process behind a
firewall until a predetermined sequence of network events takes place. For
example, when the correct sequence of knocked ports is registered in the log
files, the firewall turns the target port to state 'open' and the shielded
service is now reachable.
Such solutions often
rely on root privileges and are mostly designed to work for iptables (no
cross-platform compatibility).
Common security issues in port knocking implementations
The above
implementations suffer from replay attacks. Id Est, an attacker that sniffs the
knocking sequence can reproduce the same order of packets to unblock the target
service. Another common problem is that once the designated port is in state
'open', unexpected connection to this port might be established by unauthorized
IPs.
An overview of modern
implementations
To address the above
problems, some port knocking solutions started to use additional features such
as cryptography and IP whitelisting.
Moreover, clever
implementations close the port as soon as a TCP connection is established. In
this way the service exposure is furthermore reduced.
For more details
please have a look at http://portknocking.org/, where a very good list of
implementations has been collected over the years.
knockandgo
I have developed 'knockandgo', my own implementation of port knocking.
During the design phase of the overall architecture and behaviour of the software, I took some decisions, recapped below:
- Cross-platform (for both clients and server instances) compatibility
- Lightweight, easy to setup and use
- Configurable timeouts
- Does not rely on monitoring logs data
- Does not require root/administrator privileges to accomplish its task
- IP spoofing mitigation acquired through both IP whitelisting and the native presence of 'non-guessable' initial sequence numbers in TCP packets
- Reply attack mitigation by the presence of a timestamp in knock requests
- Integrity check to mitigate tampering attempts
- Hard to fingerprint thanks to the encrypted traffic and a UDP random port to listen on
To satisfy conditions
1), 4), 5) and 9), I decided that the better way to accomplish this is to
integrate the concept of port knocking with the one of port forwarding. In
fact, when most software just unblocks the target port, knockandgo dynamically instantiates
TCP local forwarding processes that listen on random ports and connect the
authorized user with the target service.
knockandgo source
code and usage examples are available at the following repository.
Conclusion
Port knocking provides
a simple and valuable mechanism.
However, due to its setup and usability overhead, its adoption is best suited for network administrators or security professionals that want to access remotely some network services but, at the same time, are in need of hiding their presence.
However, due to its setup and usability overhead, its adoption is best suited for network administrators or security professionals that want to access remotely some network services but, at the same time, are in need of hiding their presence.
Obviously, servers
cannot rely only on this approach and firewall solutions play the big part in
securing the network perimeter.
References
Comments
Post a Comment