Hiding version - valuable or just security by obscurity?

Question

Many automatic security scanners have built in rules that alert on the presence of software version, and in many security lists version exposure to arbitrary person accessing the system is mentioned as one of the security problems.

So my question is - is it a real problem and is hiding the version adds anything real to the security?

The arguments for it say that hiding version makes harder to use targeted exploits, however most attackers now have automated exploit kits which take no time to run hundreds of exploit attempts against the target, so the difference is next to zero for an informed attacker. And one that is not informed will not know how to use the version information. Hiding versions also makes it harder to self-scan for left-behind vulnerable installations.

I also see that this practice is widely ignored - for example, the very OWASP page that describes this as security technique openly displays versions of the server software (OS, Apache, PHP) and the Wiki software. But even if you try to hide it, most web applications - especially complex ones - are easily versioned by fingerprinting of various content they generate.

So is it worth hiding version for a web application? Or for any application/OS/platform at all?

Answer 1

The problem with security by obscurity is when you depend on obscurity to get security. If that's your only or main form of defense, you have a problem.

With that said, obscurity can add security to a system already using better strategies for security. There is no reason to expose that information, so you should not. It's useful information for an attacker, so you should certainly hide it whenever possible. The problem is when you start thinking along the lines of "well I hide this information, so no attacker can find out and use it to attack my system, so I'm safe."

Your system should be secure regardless of whether that information stays secret or not, but you shouldn't do the attackers any favors by releasing it.

Answer 2

Security by obscurity is good for defense in depth; it is not good as sole/primary mode of defense or when the obscurity interferes with normal operations.

If a 0-day vulnerability comes out for your application and you advertise your application/version number everywhere (e.g., in google searches, in HTTP response header 'Server: nginx 0.7.1'), you make it trivial for attackers aware of the new vulnerability to find your site and attempt to exploit it, before you have had time to apply a security patch. If you don't give this information (or other error messages), they will have to either guess your application's identity/version by features (and obscure feature checks in principle could tip off programs like fail2ban to an on-going attack) or try every known exploit for every possible application/version combination. This is much more cumbersome for the attacker.

Yes, its best to keep your application software up to date with all security patches; but in the real world this often lags. Don't give out unnecessary debugging information once an application goes live (though while debugging its probably helpful to leave the information available to you).

Answer 3

When a useful vulnerability comes out in a popular web application an attacker is going to use Google Hacking (or sometimes called a Google dork) to obtain a list of everyone running that software. Although this Google hack could contain the version number, some as simple as "Powered By Wordpress" is usually enough. Why check the version number, when you could just fire off the exploit and see if it succeeds.

So obscuring the version number isn't as important as obscuring the application its self.

Answer 4

This is (not very much) security by obscurity.

Script kiddies / worms won't bothered checking banners before launching attacks. IME, it's also reatively simple to identify different vendors, and releases of server software which do not return banner information (by mapping out responses to less common features and error conditions). About the only threat model is does provide any protection from is where the attacker is using a third-party search engine to identify targets - however most search engines don't index banner info - and there's often a lot of information just in the URLs

Answer 5

Let's look at 2 scenarios. In both of them version is vulnerable to an exploit (0-day or not-patched).

Attacker knows version. Attacker goes to your site and after simple check (looking at HTTP header, googling, looking at error messages...) finds out that you run this version. Then he finds exploit for it and runs only this one exploit. As the result your system is compromised. Only one exploit has been runned and therefore chance that IDS will detect attack isn't large. It will also be harder to find attacker by looking at logs as there was not so much malicious activity to be detected.

Attacker doesn't know version. Attacker goes to site and can't find out version. So he can't run only one exoloit. He should run plenty of them. This activity is likely to be detected and logged and his IP will likely to be blocked by IDS. Your system won't be compromised because you forced attacker to run plenty of exploits instead of only one.