3 ms·
Some people just want third-party assurance for CYA purposes. I’ve had to go through “security reviews” for apps submitted to third party platforms. One of them
by icedchai 4y ago
Some people just want third-party assurance for CYA purposes. I’ve had to go through “security reviews” for apps submitted to third party platforms. One of them told me upgrade our web server because we had a vulnerability. That vuln was in some module that wasn’t even enabled. I explained this, and they still demanded we upgrade. So I just turned off the version identifier. Their scan passed. (I did upgrade nginx later anyway.)
- manfre 4y agoMany security compliance scans/audits, especially at larger companies are about checking boxes and not practical security. I've done the same version hiding to get past nuisance reports.
- KabukiOrigin 4y agoVersions SHOULD be hidden from public queries. A proper assessment should identify versions anyway, by other means. If you hide them from your assessors to pass a scan, have Cyber insurance and later have an incident, coverage may be invalidated due to fraud (hiding data from assessor) or incompetence on the part of the assessor you hired. Assessment teams have varying quality. Get the best results for your org you can out of them.
- icedchai 4y agoIncompetence is frequent and expected. I did an assessment once where we were an add on to a third party platform. The assessor (from the third party platform) reports we are using a vulnerable javascript library! I said we're not even using that library, so he must've mixed us up with someone else. Tons of back-and-forth emails. He eventually sends us a couple of screen shots from browser dev tools. It turns out the guy was talking about a library on their own platform. It took even more back and forth emailing, until we escalated and the problem was resolved.
- auspex 4y agoIf the vulnerability is present it’s still a vulnerability. Just because the module isn’t enabled doesn’t mean it can’t still be taken advantage of in a remote code execution scenario. Not using a library !== not vulnerable.
- icedchai 4y agoI forget the specifics, but there was no way to exercise the module remotely. I think it was actually Apache, not nginx, and the module was not even loaded. It was one of those bullshit "medium priority" line items.
- rtev 4y agoWhat happens when another dev takes over and loads the module? This sounds similar to using a vulnerable library without invoking the vulnerable function - it still could unwittingly be used in the future.
- dizhn 4y agoYou are probably misremembering the story. If the module was really not enabled it wouldn't come up in a security scan or be present in the banner.
- vladvasiliu 4y agoIf it's the kind of report I've seen, it could've been along the lines of Package version X.Y.Z comes with M module which has V vulnerability. Upgrade to X.Y.Z+1, which patched it. They don't actually look at the enabled modules.