I’ve read an article which describes how to simulate the close ports as open in Linux by eBPF. That is, an outside port scanner, malicious actor, will get tricked to observe that some ports, or all of them, are open, whereas in reality they’ll be closed.
How could this be useful for the owner of a server? Wouldn’t it be better to pretend otherwise: open port -> closed?
From an attacker perspective you would do a quick scan to find open ports, then focus on those ports with more expensive/slower scans to find out what is running on those ports. If everything reports open then what ports do you focus on first? So not so much that actually open ports are less interesting, but that actually open ports are harder to find among all the ports.
Do you youself understand what you’re talking about?
then focus on those ports with more expensive/slower scans to find out what is running on those ports.
What do you mean by “focus on those ports”? What are “more expensive/slower scans”?
If everything reports open
not every port gets reported to be open but only some of them
what ports do you focus on first?
me? or an attacker? he could work with any ports he wishes
Do you youself understand what you’re talking about?
I am by no means an expert in this area. But I have some understanding of how things work.
What do you mean by “focus on those ports”? What are “more expensive/slower scans”?
There are many different levels of scans you can do on ports - the first and simplest is just trying to connect to see if the port is open. But that only tells you if the port is open. You then need to try and figure out what service is running on the port which is done by trying to communicating with it and seeing what it replys with. E.g. sending a http request to see if a http server is listing, or trying to start a tls connection for https). Once you know what service is running you can make additional queries to try and figureout what version it is running which can tell you what vulnerabilities it is exposed to. Each of these might need a different connection, and you might need to cycle through many different queries to get a response from the server - all of that is far more expensive than just checking to see if the port is open.
So you generally want to preform a quick scan of open ports, then follow up on a deeper scan of those ports to gather more information about what is running on the port. Nmap, the tool generally used for this, has these different modes you can tell it to scan in and is able to do simple TCP connection scans, or more detail scans for detecting the service an OS (and their versions) as well.
not every port gets reported to be open but only some of them
That was a hypothetical, not having read whatever article you are talking about. But I would assume that a eBPF tool that fakes open ports would do so to pretend a large number of ports are open at least. Though that is just speculation on my part.
me? or an attacker? he could work with any ports he wishes
That is from an attackers perspective.
