Page 1 of 1

Security through obscurity

Posted: Sat Sep 29, 2018 6:05 pm UTC
by 0x0ece
Question to instigate a new security comic: how comes that everybody in software rejects security through obscurity, but not in hardware?

Re: Security through obscurity

Posted: Sun Sep 30, 2018 2:00 am UTC
by Thesh
What makes you say that they don't? The math behind cryptography doesn't care if it's hardware or software.

Re: Security through obscurity

Posted: Sun Sep 30, 2018 6:14 pm UTC
by hotaru
Thesh wrote:What makes you say that they don't? The math behind cryptography doesn't care if it's hardware or software.

a lot of hardware relies on obscurity instead of cryptography (unsigned firmware updates, relying on not labeling pins to keep people out of powerful debugging interfaces, etc.). the math behind cryptography doesn't do anything for you if you don't use it.

Re: Security through obscurity

Posted: Sun Sep 30, 2018 7:06 pm UTC
by Thesh
The same is true of software. Developers in general do not really study security, and it's common for them to rely on their software being closed source for security.

Re: Security through obscurity

Posted: Wed Oct 24, 2018 6:04 pm UTC
by wumpus
0x0ece wrote:Question to instigate a new security comic: how comes that everybody in software rejects security through obscurity, but not in hardware?


I'm not sure what the issue is. Are you suggesting that something like a router might be shipped with a hardcoded admin password? And since the software in question is "burned in ROM" (or at least shipped in flash) it counts as hardware?

Or are you suggesting that there exist JTAG ports that might be available on chip, and they allow for all sorts of evilness? That seems to come under the "attacker has physical access". In general physical access means you can own the machine, no question. It is hard enough to imagine trying to keep out somebody who can adjust I/O ports, reset switches, etc. But trying to keep out somebody with a soldering iron and an oscilloscope is essentially impossible.

Re: Security through obscurity

Posted: Wed Oct 24, 2018 6:20 pm UTC
by Sizik
wumpus wrote:But trying to keep out somebody with a soldering iron and an oscilloscope is essentially impossible.


You can probably beat that by putting everything inside the processor itself (can't trace what you can't see without destroying the thing itself), but even that has its limits.

Re: Security through obscurity

Posted: Wed Oct 24, 2018 7:19 pm UTC
by hotaru
wumpus wrote:But trying to keep out somebody with a soldering iron and an oscilloscope is essentially impossible.

keeping out someone with a soldering iron and an oscilloscope is essentially impossible, but that doesn't mean you should just connect the chip's JTAG interface to an external port and assume no one will use it just because you didn't document what that port does. someone opening up a device to attach something to the board is a lot easier to detect and stop than someone just plugging something into a port on the outside of the device.