3 ms·

Hmmm .. Security by obscurity? When I look at my server logs I see lots of attempts to crack into software, components or programming languages I do not use an

by route66 15y ago

Hmmm .. Security by obscurity? When I look at my server logs I see lots of attempts to crack into software, components or programming languages I do not use and which can't be found on the server. The common cheap hacking script doesn't even care if it's a windows box when it's dumbly requesting the isapi.dll. I wonder if the effect is the same as grinding the lock-makers label off my door locks.

nodata 15y ago
Removing version information makes it more difficult for an unskilled automated attack on a server, which is what most of the attacks are.
- route66 15y ago
  That's my point: For an attack I just send my php 4.1 patchlevel nnn specific script I just bought to 200.000 webservers on some it will work. This is indeed the majority of attempts I'm seeing. So it would break only attacks which do a switch on version specific information. My guess is that it would nor lower the number of attempts nor the success rate, a target will be found anyway, version information or not. I would guess that scripts which bail out humbly in absence of version information are not in the majority, but I could be wrong.
- cheald 15y ago
  Obscuring the version number just means that Joe Blackhat has to run through 10 exploits to try to get a hit, rather than just 1. The time difference is likely insignificant. All this does is produce a false sense of security which may lull system administrations into putting off critical upgrades.
  - nodata 15y ago
    Joe Blackhat isn't running the exploits - Sam Scriptkiddie is. > All this does is produce a false sense of security which may lull system administrations into putting off critical upgrades. Then the sys admin needs replacing. Creating more work for those that automate system attacks is a good thing.
SaltwaterC 15y ago
Most of the "security" is in fact obscurity: here's something I know, you don't, while in order to find out what I know is unfeasible for you to compute all the possible combinations. Same goes for the "randomness" theory.

by route66 15y ago

nodata 15y ago

Removing version information makes it more difficult for an unskilled automated attack on a server, which is what most of the attacks are.

route66 15y ago
That's my point: For an attack I just send my php 4.1 patchlevel nnn specific script I just bought to 200.000 webservers on some it will work. This is indeed the majority of attempts I'm seeing. So it would break only attacks which do a switch on version specific information. My guess is that it would nor lower the number of attempts nor the success rate, a target will be found anyway, version information or not. I would guess that scripts which bail out humbly in absence of version information are not in the majority, but I could be wrong.
cheald 15y ago
Obscuring the version number just means that Joe Blackhat has to run through 10 exploits to try to get a hit, rather than just 1. The time difference is likely insignificant. All this does is produce a false sense of security which may lull system administrations into putting off critical upgrades.
- nodata 15y ago
  Joe Blackhat isn't running the exploits - Sam Scriptkiddie is. > All this does is produce a false sense of security which may lull system administrations into putting off critical upgrades. Then the sys admin needs replacing. Creating more work for those that automate system attacks is a good thing.

SaltwaterC 15y ago

Most of the "security" is in fact obscurity: here's something I know, you don't, while in order to find out what I know is unfeasible for you to compute all the possible combinations. Same goes for the "randomness" theory.