2 ms·
> None of those "obscurity" measures do anything meaningful to improve your security That's just not true. Consider a practical analogy: the access ID badges t
by mjb 15y ago
> None of those "obscurity" measures do anything meaningful to improve your security
That's just not true. Consider a practical analogy: the access ID badges that many companies issue to their employees. Most of the time, these badges do not include information identifying the company other than a simple postal address. This isn't a strong security mechanism by a long shot, but does serve to make it more difficult to use a lost card. Often, more difficult is all it takes to make a casual attacker lose interest in the target.
Hiding version information is a lot like that. Which is more useful to an attacker: "ApacheTomcat 6.0.25" or "BigCompanyServer"? Sure, a sophisticated and dedicated attacker could identify the software you are running (often down to a version number), but that takes time. The time that takes is time taken away from the rest of the attack, and possibly enough of a timesink to deter some attackers.
I don't think anybody sensible is claiming that "hide your server version" is as important as "don't run a known-buggy version", but there is no doubt that both of these things have value.
- tptacek 15y agoIn 1995 when you were breaking into a server, you maybe telnetted to port 25 and checked out whether they were running Sendmail 8.6.9 or Sendmail 6.6.12, so you could decide whether you were going to try a character quoting bug or a buffer overflow. Nowaways, you just run your ruby script and wait for the connectback shell. You might not even care if they're running a server on port 80. Either the exploit works or it doesn't; who cares why it doesn't? Hiding version numbers does nothing at all to meaningfully improve your security. Exploits don't care about version banners. They don't not try the attack if they see the wrong version.