I’ve read an article which describes how to simulate the close ports as open in Linux by eBPF. That is, an outside port scanner, malicious actor, will get tricked to observe that some ports, or all of them, are open, whereas in reality they’ll be closed.

How could this be useful for the owner of a server? Wouldn’t it be better to pretend otherwise: open port -> closed?

    • nous@programming.dev
      link
      fedilink
      English
      arrow-up
      1
      ·
      3 months ago

      Would it even need to pretend it is open? If it can fake a port being open then it can tell when a close port is being pinged. So can outright block connections from those IPs without ever pretending it is open?

      • originalucifer@moist.catsweat.com
        link
        fedilink
        arrow-up
        1
        ·
        3 months ago

        sure, if you want to be that black and white about it… but with this you maybe could glean more information about the attempt and have more granular logic.

        • nous@programming.dev
          link
          fedilink
          English
          arrow-up
          1
          ·
          3 months ago

          What extra information could you gather? Note I assume we are talking about a fake open port here, not an active service listening on a port that can communicate with the attacker. That could be done without eBPF though - so what advantage would eBPF have here?

            • nous@programming.dev
              link
              fedilink
              English
              arrow-up
              1
              ·
              3 months ago

              Port knocking does not require open ports though? It works by trying to connect to closed ports in a specific sequence does it not?

          • dnick@sh.itjust.works
            link
            fedilink
            arrow-up
            0
            ·
            3 months ago

            At a guess, you might tell the difference between some benign scan and an attempt to actually take advantage of the port, perhaps to use as a trigger to automatically ban an ip address? or a way to divert malicious resources to an easy looking target so they are less available in other areas?

            The difference between someone scanning for open ports and someone attacking a port they find open seems significant enough to at least track and watch for patterns… Whether that’s useful for the majority of users or not is rarely why a feature is implemented.