Home / Blogs

Security by Obscurity?

Robert Alberti, CISSP

A response by Bob Alberti, CISSP President of Sanction, Inc. to MSNBC's report by Brock N. Meeks titled "Fort N.O.C.'s” [Network Operating Center].

Ah yes, "Security by obscurity”:

"Many people believe that 'security through obscurity' is flawed because… secrets are hard to keep."

I'm glad the guys guarding the A Root Servers are up on the latest security trends. Of course, you could hide the A Root Servers at the heart of the Minotaur's maze, but they're still going to be "right over there" in cyberspace, at 198.41.0.29,

7 so1-3-0-2488M.ar1.DCA3.gblx.net (67.17.68.33) 52.274 ms
8 InterNAP-Ken-Schmid-Ashburn-3.ge-2-3-0.ar1.DCA3.gblx.net (208.50.25.194) 50.903 ms
9 border12.ge2-0-bbnet1.wdc.pnap.net (216.52.127.17) 50.888 ms
10 verisign-9.border12.wdc.pnap.net (216.52.118.78) 50.227 ms
11 65.205.32.154 (65.205.32.154) 51.598 ms
12 65.205.32.42 (65.205.32.42) 52.234 ms
13 198.41.0.29 (198.41.0.29) 70.563 ms

Reminds me of a local ISP, "Glasspath" (a casualty of the DotCom Crash), which bragged that it was safer from hackers because it was situated inside an old bank vault.

Once you run that fiber through the wall of the vault, you're letting in a lot of the world.

"'...If this site just vanished off the Internet, it would automatically [switch] over to one or two other locations,' Silva said.  These are the so-called 'warm back-ups' that VeriSign has on stand-by at all times.  The Internet never sees them, Silva says, but they can be up and running within 15 minutes and in that time Internet users wouldn’t even notice a hiccup in traffic."

And this process is tested… how? when? This testing is independently audited… when? by whom? These audit results are compared against what criteria? These criteria are set by what body?

Or are we playing fast and loose and depending on the word of a fellow who could be laid off tomorrow at the whim of a "volunteer" corporation?

I'm sure that Sean Gorman would have something to say about the security value of "security by obscurity"…

"Using mathematical formulas, he probes for critical links, trying to answer the question: "If I were Osama bin Laden, where would I want to attack?" In the background, he plays the Beastie Boys.

For this, Gorman has become part of an expanding field of researchers whose work is coming under scrutiny for national security reasons. His story illustrates new ripples in the old tension between an open society and a secure society."

So while we can rest easy that the VeriSign A Root Server is protected by "obscurity", the Internet itself remains vulnerable to network-based attacks and well-placed backhoes.  And the organization that's supposed to be "managing" the Internet?  Too busy playing politics, consolidating power, and forging Afghani ccTLD contracts…

By Robert Alberti, CISSP, Founder and President

Related topics: Cyberattack, Cybercrime, Cybersecurity, Top-Level Domains

 
   

Don't miss a thing – get the Weekly Wrap delivered to your inbox.

Comments

Re: Security by Obscurity? Stephane Bortzmeyer  –  Jan 29, 2004 9:09 AM PDT

Since I work as a contractor for the ".af" ccTLD (Afghanistan), I would like to learn more about the last (cute but undecipherable) sentence. Facts?

Re: Security by Obscurity? Robert Alberti, CISSP  –  Jan 29, 2004 10:29 AM PDT

A good point.  The editors left out the hotlink under the cute but indecipherable comment, which should have pointed to
http://www.theregister.co.uk/content/6/34883.html

The relevant paragraph:
"There a few redelegations that stand out. Afghanistan’s for example. The .af domain was handed over almost as soon as US forces had taken over the country to a company run by the US-created government. Incredibly, the former owner appeared from nowhere having been missing for months, signed a piece of paper saying he agreed to the transfer and promptly vanished from the face of the earth again."

Re: Security by Obscurity? bravotango  –  Sep 23, 2004 4:55 PM PDT

Im no techy so would appreciate some advice from anyone… I did a trace route, as my email forwarding no longer works from my NetSol email acct. to desktop Outlook Express (but I cand send out), and found that it ends at nbr. 18 > 65.205.32.50

Now, I dont understand your above article, but excuse my lack of in depth techy stuff, but are you saying that this is a vulnerable server ?

I also contact my broadbrand provider (NDO in UK) who inform me this is UUNET's server, so I emailed them, but await tehir reply...I also was able to talk to them, but they confirm none of their servers are down.

Last few questions, is this Network Soltions, UUNET, or my broadbands problem ? who should be responsible for this fixing ?

Thanks for any advice.

Re: Security by Obscurity? Martin Hannigan  –  Feb 01, 2006 2:21 PM PDT

Looks like this security through obscurity is
everywhere:

InterNAP-Ken-Schmid-San-Jose-3.ge-0-1-0.106.ar1.SJC2.gblx.net

INTERNAP controls the reverse resolution, not VeriSign.
That's upstream. There's no value in hiding in the DNS.
The IP Address is public. In fact, that resolution is
inside of the INTERNAP core. It would show up in many
companies traceroutes via that PNAP.

Could you restate your technical facts related to this?

To post comments, please login or create an account.

Related Blogs

Related News

Explore Topics

Dig Deeper

DNS Security

Sponsored by Afilias

IP Addressing

Sponsored by Avenue4 LLC

Mobile Internet

Sponsored by Afilias Mobile & Web Services

Cybersecurity

Sponsored by Verisign

Promoted Posts

Buying or Selling IPv4 Addresses?

ACCELR/8 is a transformative IPv4 market solution developed by industry veterans Marc Lindsey and Janine Goodman that enables organizations buying or selling blocks as small as /20s to keep pace with the evolving demands of the market by applying processes that have delivered value for many of the largest market participants. more»

Industry Updates – Sponsored Posts

Domain Registrations Reach 331.9 Million, 6.7 Million Growth Year over Year

.brands Spotlight: Banking and Finance Industries

Google Buys Business.Site Domain for 'Google My Business'

Radix Announces Global Web Design Contest, F3.space

Global Domain Name Registrations Reach 330.6 Million, 1.3 Million Growth in First Quarter of 2017

.TECH Gets Its Big Hollywood Break

Verisign Named to the Online Trust Alliance's 2017 Audit and Honor Roll

Attacks Decrease by 23 Precent in 1st Quarter While Peak Attack Sizes Increase: DDoS Trends Report

.PRESS Supports Press Freedom Day for 3rd Consecutive Year

Leading Internet Associations Strengthen Cooperation

5 Afilias Top Level Domains Now Licensed for Sale in China

Radix Announces Largest New gTLD Sale with Casino.Online

2016 Year in Review: The Trending Keywords in .COM and .NET Domain Registrations

Global Domain Name Registrations Reach 329.3 Million, 2.3 Million Growth in Last Quarter of 2016

A Look at How the New .SPACE TLD Has Performed Over the Past 2 Years

Verisign Releases Q4 2016 DDoS Trends Report: 167% Increase in Average Peak Attack from 2015 to 2016

Neustar to be Acquired by Private Investment Group Led by Golden Gate Capital

Startup League Reports from WebSummit, Lisbon

Verisign Q3 2016 DDoS Trends Report: User Datagram Protocol (UDP) Flood Attacks Continue to Dominate

2016 U.S. Election: An Internet Forecast