What real life examples of security by obscurity have you seen/worked with?

Question

Bonus points for explaining how you improved it.

Answer 1

Seen: phpMyAdmin moved into the directory _phpmyadmin

Improvement: Disallowed access from outside the company's network.

Answer 2

Seen: Websites use a complex url to access ajax components rather than actually password protect them such as:

domain.com/3r809d8f09feefhjkdjfhjdf/delete.php?a=03809803983djfhkjsdfsadf

the string has remained constant, the query is random and is designed to stop attackers.

Improvement: Restrict the page to being accessed only from certain IP addresses. Add an authentication string to the query that is a salted hash of the access time.

Answer 3

People writing their password on pieces of paper and putting it under their keyboard.

I solved it by logging into their computer with their account and sending out an embarrassing email to the group.

Answer 4

Some people like to make their javascript difficult to read (and therefore hack) by using obfuscation. Google is among the users of this technique. At the simplest level, they change the variable and method names to a single inscrutable letter. The first variable is named "a", the second is named "b" and so on. It does succeed in making the javascript exceedingly difficult to read and follow. And it adds some protection to the intellectual property contained in the javascript code, which must be downloaded to the user's browser to be usable, therfore making it accessible to all.

In addition to making it difficult to read the code, this shortening of variable names reduces the size of the javascript code that has to be downloaded to the user's browser. Theoretically, this can reduce network traffic.

Here's an article about Google's obfuscation, and here's a list of available tools.

Answer 5

On a website I did some contract work on I noticed that they were storing double-hashed passwords. From memory, they were storing something like

$encrypted_password = md5( sha1( plaintext_password ) );

When I asked what the purpose of this was, I found out that the guy who wrote the account creation/login script had been reading about dictionary attacks. He figured that no one would ever think to create a dictionary where they hash inputs with md5 and sha1.

I improved the system by adding a random salt column to their user table. I left the double-hashing in though. It doesn't do anything to hurt the security of the system, and to be honest, I thought it was pretty clever for someone who didn't really know much about security to think of this.

Answer 6

Similar to @stech's solution.

Some of the admin pages in our application on the web, check for a local IP subnet range, else display access denied. Improvement is accessed is restricted to users who are inside the network or VPNed to it.

Answer 7

Back in the old DBase/Clipper days I worked for a guy who developed an application for a friend of his. This friend wanted to have some "secretly" accessible program or data (I don't recall) that required a password only known to him.

The solution, I was told, was that Clipper opened a DOS prompt in the secret directory, with black text on black background colors (some ANSI control characters accomplished this).

The user had to type in the password, but this being input line of the DOS command prompt, the "password" was really the name of a batch file that was then executed.

Answer 8

Real life security by obscurity?

The key to the front door is stashed under a rock nearby, or under the welcome mat, or on top of a high railing.

These are all instances of security through obscurity, as in, it is right out in the open for anyone to grab, but most people wont be able to find it without huge amounts of searching. However, a dedicated attacker can walk right in.

Answer 9

I once saw a photography website where you could strip some characters off from the photo thumbnail pictures url to get the full version.

Answer 10

Many professional photographer websites use Javascript to prevent people from right-clicking on images to "save as ...". Most of those sites also don't do any watermarking.

I used to surf with referer headers disabled... it's quite surprising how many websites will blow up or flat-out reject you if they don't know where you came from.

One website had a poll and used cookies to prevent you from voting multiple times. You could simply erase that cookie and keep voting. And you could script it all using wget, too.

Answer 11

The example I see of this all the time is something being done in source code that the developer assumes no one will ever see. You see this a lot with crypto-keys in particular, embedded right in the source code. A lot of times it is not even a question of decompiling the code, they could outright just use the library.

The solution is always to teach the developer to assume that someone has the source code and can use it against you.

Answer 12

Going to great lengths to hide software names and version numbers .

Ie. changing Tomcat server name and version to some quotes and random numbers (like 666), changing the name and version numbers of regular javascript libraries like scriptaculous and prototype and so on.

In a current project we're using Google Web toolkit (GWT) and this sneaky little thing compiles Java to javascript (which you have little to no control over) and includes the string "GWT" and version number. Totally unacceptable of course so we'll need to make a script that will run after GWT compile to remove all these references(!).

Answer 13

In a more "real life" example, I don't know if it's intentional or not, but I like the way none of the doorbells in my block have any names on them, and that their numbers seem to have no correlation to the apartement numbers whatsoever. Ie. ring on #25 for apartement 605, #13 for apartement 404 and so on. :)

Answer 14

/admin without password.

Yes I've seen it, it's very real.

Answer 15

One vendor we deal with requires us to post the username and password in the querystring in ROT-13 "encrypted" format. No joke.

Answer 16

Security through obscurity is a valid tactic. Plenty of people have turned off replying with version information as a best practice for ftp and apache. Honeypots can be considered an obscured practice, since the attacker doesn't know the layout of the network and gets sucked into them. One high security site I know of assigns their username by a five digit alphanumeric phrase (such as '0a3bg') instead of using logical usernames. Anything that makes breaking into a system more difficult, or take longer, is a valid measure.

Security exclusively through obscurity is bad.