this post was submitted on 24 Aug 2024
16 points (80.8% liked)
Programming
17354 readers
349 users here now
Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!
Cross posting is strongly encouraged in the instance. If you feel your post or another person's post makes sense in another community cross post into it.
Hope you enjoy the instance!
Rules
Rules
- Follow the programming.dev instance rules
- Keep content related to programming in some way
- If you're posting long videos try to add in some form of tldr for those who don't want to watch videos
Wormhole
Follow the wormhole through a path of communities !webdev@programming.dev
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Do you youself understand what you're talking about?
What do you mean by "focus on those ports"? What are "more expensive/slower scans"?
not every port gets reported to be open but only some of them
me? or an attacker? he could work with any ports he wishes
I am by no means an expert in this area. But I have some understanding of how things work.
There are many different levels of scans you can do on ports - the first and simplest is just trying to connect to see if the port is open. But that only tells you if the port is open. You then need to try and figure out what service is running on the port which is done by trying to communicating with it and seeing what it replys with. E.g. sending a http request to see if a http server is listing, or trying to start a tls connection for https). Once you know what service is running you can make additional queries to try and figureout what version it is running which can tell you what vulnerabilities it is exposed to. Each of these might need a different connection, and you might need to cycle through many different queries to get a response from the server - all of that is far more expensive than just checking to see if the port is open.
So you generally want to preform a quick scan of open ports, then follow up on a deeper scan of those ports to gather more information about what is running on the port. Nmap, the tool generally used for this, has these different modes you can tell it to scan in and is able to do simple TCP connection scans, or more detail scans for detecting the service an OS (and their versions) as well.
That was a hypothetical, not having read whatever article you are talking about. But I would assume that a eBPF tool that fakes open ports would do so to pretend a large number of ports are open at least. Though that is just speculation on my part.
That is from an attackers perspective.
Ok, back to this then:
I don't see an issue here. An attacker would be overwhemed with choise and excitement so that he wouldn't be able to decide which port to choose first, get stuck for a several months unable to decide? He'd toss a coin then.
Its costs him time - which is the point. They would have to do more detailed checks on every port which costs them time. Attackers are typically scanning loads of ports over large ranges of IPs, any small slow down on each can drastically slow down their overall progress making the attack less feasible and more expensive to undertake.
but an attacker isn't obliged to take on all the open ports, he could work with some of them - the ones that may seem the most interesting to him
That's probably a majority of the point. Falsely report that some interesting ports are open and he'll spend time on them and potentially trigger alerts or blocks.
Fake open ports aren't something a normal user would bother with or understand, but with all the tools available in the nefarious side, it makes sense to have options that make their job harder if you're willing to use them.
Yes, which limits the amount of ports they can search and thus can be used to hide things on less popular ports. It is not going to stop an attacker. Just makes their job a bit harder or less complete.