A security Leakage??

I was just trying to find out more about how to connect my phone on linux on my ISP website...then I started using google when I didn't see any results there...and I got this from the google's cache:

http://72.14.235.104/search?q=cache:...n&ct=clnk&cd=1

Later I tried to find out the OS on the offcial MAIN site. Nmap said that it might be Windows system but it was not sure about it!! So isn't it a leakage in the security of system coz it revals such an Important info about the system??? I know it is minimal amount of info but then it revals it to even normal people who know what a google-cache is!!

Thanks.

thats cache, that could be history. and more over I dont think that is a web server generated error or something.
it could be a windows 2000 box asked to echo "windows 2003"
although I dont believe airtel would do that.

And hey.... that website has been removed ... it no longer exists...I tried open it through many ways but it wont open. It is deleted!! So I dont care about that.

Quote:

---

that website has been removed

---

Well Jockey I too was trying on that but finally I agree with webDEViL, it its cache.........

hmmm... rock... I know its cache...and ONLY cache. What I wanted to tell is that...if someone does something like that in real life...what could be the consequenbces...I mean displaying the OS along with version in case of errors is a deadly mistake in configuration.

Quote:

---

I mean displaying the OS along with version in case of errors is a deadly mistake in configuration.

---

Why?

Well it might happen that an attacker will be able to find out vulnerability in the system in case the system is set to hide its idenetitiy at other points by changiung the daemon banners, error messages and the TTL value of course. In these cases, attackers usually get confused...but telling them the OS is of course a mistake....and that too when its WINDOWS.....eh!!??

Anyway to some extent itmight not be that much of important because the system of course gonna be protected at other points and well!!!!

Thanks

Well, I can see what you are saying, but I tend to look at this subject from the bad guys' viewpoint :D

If you look at most attacks these days, they are automatic or robotic. This is largely why "security through obscurity" seems to work to an extent. Its main drawback is that it is unpredictable and unreliable. If someone actually knows that there is a computer there they will be able to attack it. It is effective against trivial preliminary probing of a block of IP addresses, as these might well be legitimately not in use, so the bot moves on.

Having decided to attack a particular IP address, the next step is to find out if there are any vulnerable services running for which the bad guy has an exploit. In the automated attack environment of today, the simplest method would be to run them and see what happens?

If nothing happens, the bad guy will usually assume that the system has been secured in some way and will move on. He doesn't really care why the attack failed.

We get a lot of wildlife films on UK television so I tend to use the analogy of the herd of antelope being attacked by a predator. The fast and the strong survive, and the weak and slow get killed and eaten. Well, there are a lot of "slow and weak antelope" connected to the internet, and that tends to dictate predators' tactics?

Another point to consider, is the nature of the exploits and malware that have been discovered in the past few years. Most will run on any unpatched flavour of Windows from 9x upwards................ so the actual version is pretty irrelevant information to the attacker. What I am saying is that non-Windows systems and secured systems get attacked as much as vulnerable Windows ones, it is just that the attacks don't work on that platform or in that environment.

Also remember that attacks can be directed at applications as well as operating systems..............

Quote:

---

Originally posted here by nihil
Well, I can see what you are saying, but I tend to look at this subject from the bad guys' viewpoint :D

If you look at most attacks these days, they are automatic or robotic. This is largely why "security through obscurity" seems to work to an extent. Its main drawback is that it is unpredictable and unreliable. If someone actually knows that there is a computer there they will be able to attack it. It is effective against trivial preliminary probing of a block of IP addresses, as these might well be legitimately not in use, so the bot moves on.

Having decided to attack a particular IP address, the next step is to find out if there are any vulnerable services running for which the bad guy has an exploit. In the automated attack environment of today, the simplest method would be to run them and see what happens?

If nothing happens, the bad guy will usually assume that the system has been secured in some way and will move on. He doesn't really care why the attack failed.

We get a lot of wildlife films on UK television so I tend to use the analogy of the herd of antelope being attacked by a predator. The fast and the strong survive, and the weak and slow get killed and eaten. Well, there are a lot of "slow and weak antelope" connected to the internet, and that tends to dictate predators' tactics?

Another point to consider, is the nature of the exploits and malware that have been discovered in the past few years. Most will run on any unpatched flavour of Windows from 9x upwards................ so the actual version is pretty irrelevant information to the attacker. What I am saying is that non-Windows systems and secured systems get attacked as much as vulnerable Windows ones, it is just that the attacks don't work on that platform or in that environment.

Also remember that attacks can be directed at applications as well as operating systems..............

---

So I have to disagree with you here ;) (big surprise eh)...

Revealing data on a system is a mistake... You don't want me to remotely know what operating system your running.. You don't want me to remotely know what software you are running.. What version of BIND your DNS server is running or what version of postfix your mail server is running..

That's why people change their apache and iis banners, take ServerMask for Example. Sure it's security through obscurity... but it's enough to confuse automatic fingerprinting software.

Sure... some attacks will just run the attacks and they'll work.. but there are others that will fingerprint (even if they run nmap -sV at an entire /24) and this can be enough to discourage them...

There are times when programmers miswrite code and display too much info... It shouldn't happen... There's no reason that say DB2 for example should tell me the exact details of the installed database with any credentials... but it will...

So while it may not be beneficial to hide the information... there's zero benefit to openly displaying the information.

Peace,
HT

Hmmmm,

It is really a question of degrees, is it not?.................... after all, you can safely assume that 80% or more of computers on the net are running some flavour of Windows, and that this will be 98SE or later.

Quote:

---

You don't want me to remotely know what operating system your running

---

Windows 2000 Pro SP4, fully patched as of August 2006

Does that help you?................not really :D

What would potentially be of use would be what services and applications I am running?

However, I still maintain that the majority of attacks these days are of a robotic nature, at least at their inception. Consequently, information on my OS is irrelevant, as it is never gathered. The bot only wants to know if the exploit works......................it really does not care why ;)

I agree with you nihil....But let me remind you again...the server ( which seems to have removed,) was a site of the largest Mobile service Provider in INDIA. And anyone who will even think of getting root on that system will not attack with robots...yes, he might design one asfter he come to know all about how to get there. But the attacks on those type of system,s have to be MANUALLY. ANd I think there are still manual aqttacks existing ..... or am I worng?? So it is always bad to show your server details in any manner. And that too when it will be opened by a lot of people some of which might be CRACKERs???

Peace.

Quote:

---

Originally posted here by nihil
Hmmmm,

It is really a question of degrees, is it not?.................... after all, you can safely assume that 80% or more of computers on the net are running some flavour of Windows, and that this will be 98SE or later.



Windows 2000 Pro SP4, fully patched as of August 2006

Does that help you?................not really :D

What would potentially be of use would be what services and applications I am running?

However, I still maintain that the majority of attacks these days are of a robotic nature, at least at their inception. Consequently, information on my OS is irrelevant, as it is never gathered. The bot only wants to know if the exploit works......................it really does not care why ;)

---

The operating system and applications/services go hand in hand in my books... If everyone was as robotic as you state then Pen Testers would be out of a job... Why have someone pen test by hand when no one else is doing that... Highly unlikely... the skiddies out there are running automated scripts and yes they account for a decent number of attacks but there's more serious stuff out there... and those are the things that people should be worried about protecting themselves from.... and I'm not necessarily talking about people at home.. I'm talking about businesses... Is it good that I know that 8 months ago CIBC was using Windows NT on all of their ATMs? I wouldn't think so...

Peace,
HT

Hey, jockey~ please think about this:

The bigger they are, the more open they are?................ After all, your guys aren't going to be running Windows 95 are they?

If you checked out the "job opportunities" part of their website, you would find what they are using? or they would be boasting about it in their general information section?

Quote:

---

The operating system and applications/services go hand in hand in my books... If everyone was as robotic as you state then Pen Testers would be out of a job

---

Yes, this is about to happen....................... if you don't believe me, have a word with TH-13 who has commented to that effect already?

It is bot vs bot my friend :D

Quote:

---

Originally posted here by nihil
Hey, jockey~ please think about this:

The bigger they are, the more open they are?................ After all, your guys aren't going to be running Windows 95 are they?

If you checked out the "job opportunities" part of their website, you would find what they are using? or they would be boasting about it in their general information section?



Yes, this is about to happen....................... if you don't believe me, have a word with TH-13 who has commented to that effect already?

It is bot vs bot my friend :D

---

Pen testers will never be out of work... it's not bot vs bot... I can never solely be bot vs bot... Let's take the PCI certification

There are two requirements

1) Automated Scanning
2) Pen Test...

Why would you need to be scanned with a product by Tenable, Qualys, nCircle, Rapid7, etc and also get a Pen Test if pen testing was becoming obsolete?

If it was a world of bot vs bot we wouldn't have AV Vendors with security researches and signature writers, we wouldn't have reverse engineers, we wouldn't haev pen testers, we wouldn't have a number of people we currently have.. but if you feel it's entirely robotic with no need for people.. Feel free to tell that to H.D. Moore, Dave Aitel, Pedram Amini, eEye, iDefense and everyone else...

Yes there will be more automation in the future on the "white hat" side of the fence... but it will never be to the extent that you describe.. If it was entirely bot based that companies would also get rid of Quality Analysts and all Quality Control positions.. because they wouldn't need them... and that will also never happen..

There's a reason why bots and skiddies aren't nearly as dangerous in the security community as "black hats"... because their automated attacks are easily detectable... that's why it will never progress to pure bot vs bot.

Quote:

---

Why would you need to be scanned with a product by Tenable, Qualys, nCircle, Rapid7, etc and also get a Pen Test if pen testing was becoming obsolete?

---

Hah! define need :D

Obviously somebody has to design and write the "bots" just as people have to determine vulnerabilities and exploits.............. and people have to write the applications and operating systems that permit them.

Most organisations are in the happy position that they do not merit individual and specific attack. For them the botniks are the real and present danger. Let's face it, criminals are percentage players who are doing it for the money rather than the glory or reputation?

We are in an interesting position in IT history, in that we are using operating systems and applications that are based on designs from a previous era. If I were a young person today, and planning a career in IT, I would not expect that situation to remain for the next 40 years.

Hey, back in the old days we used to have chimney sweeps................. where would you find one of those today?

:cool:

Quote:

---

Originally posted here by nihil
Hah! define need :D

Obviously somebody has to design and write the "bots" just as people have to determine vulnerabilities and exploits.............. and people have to write the applications and operating systems that permit them.

Most organisations are in the happy position that they do not merit individual and specific attack. For them the botniks are the real and present danger. Let's face it, criminals are percentage players who are doing it for the money rather than the glory or reputation?

We are in an interesting position in IT history, in that we are using operating systems and applications that are based on designs from a previous era. If I were a young person today, and planning a career in IT, I would not expect that situation to remain for the next 40 years.

Hey, back in the old days we used to have chimney sweeps................. where would you find one of those today?

:cool:

---

You can't use a time frame of 40 years in IT but at the same time you can... IT isn't like other fields,,, the speed of progression is much faster but there are also fallback points..

As far as define need... it is REQUIRED in order to process credit card payments... that's what need is...

I'm actually talking to TH13 while I write this... we've decided that you need to sit down and rethink things a little... Determine the difference between Vulnerability Assessment and Penetration Testing.. figure out what they both are.. how they work and then come back and have this chat.

Peace,
HT

Pen testers won't be out of work.l.. unfortunately. Although most are hacks. (meaning they don't know jack).

But thanks to regulatory and more regulatory action in government, they are still safe. IDS? That could be another story.... I have been highly debating it's significance in the modern (meaning current) network. With intelligent firewalls, high speed packet shaping/recording, access filtering, Spam gateways, and a host of the modern crop of Internet Servers, it just seems well silly to have a dedicated IDS system.

Pen testing though - gotta have it for any number of certification processes in business. At least in North America. ;)

//EDIT oh and when the hammer falls... you better have a nice shiny (current) pen test of your configuration or the ass is on a platter. Who wants their ass on a platter served with chips?