I’ve read an article which describes how to simulate the close ports as open in Linux by eBPF. That is, an outside port scanner, malicious actor, will get tricked to observe that some ports, or all of them, are open, whereas in reality they’ll be closed.

How could this be useful for the owner of a server? Wouldn’t it be better to pretend otherwise: open port -> closed?

  • sapporo@sopuli.xyzOP
    link
    fedilink
    English
    arrow-up
    1
    ·
    2 months ago

    but an attacker isn’t obliged to take on all the open ports, he could work with some of them - the ones that may seem the most interesting to him

    • dnick@sh.itjust.works
      link
      fedilink
      arrow-up
      2
      ·
      2 months ago

      That’s probably a majority of the point. Falsely report that some interesting ports are open and he’ll spend time on them and potentially trigger alerts or blocks.

      Fake open ports aren’t something a normal user would bother with or understand, but with all the tools available in the nefarious side, it makes sense to have options that make their job harder if you’re willing to use them.

    • nous@programming.dev
      link
      fedilink
      English
      arrow-up
      1
      ·
      2 months ago

      Yes, which limits the amount of ports they can search and thus can be used to hide things on less popular ports. It is not going to stop an attacker. Just makes their job a bit harder or less complete.