NYCPHP Meetup

[Andrew Yochum]

On Wed, Jul 14, 2004 at 03:22:27PM -0400, Paul Reinheimer wrote:
> Every attack wether web or otherwise I have heard about starts with
> learning as much as you can about the target's systems, then seeking
> to exploit some either known or unknown security holes in the software
> that system is running.
> 
> Knowing that, why reveal anything? Make the potential attacker work
> for every peice of information they want. Set the apache server string
> to claim it is some recent release of IIS, tell all the services not
> to advertise they are running, save your .php files as .exe and tell
> apache just to interpret apropriatly. etc. Obviously if you choose to
> run some off the shelf application (ie phpBB) you will let the cat out
> of the bag, but seperating it to a subdomain may only add to the
> confusion.
> 
> Does anyone see any real advantage to this approach?

Many call this "security through obscurity."  IMO, it only will stall an
attacker by confusing them for a bit.  Its easy to use forensics to determine
what technologies / platforms are being used.

There is a decent discussion of this here:
    http://en.wikipedia.org/wiki/Security_through_obscurity
... and I'm sure many other places if you google around.

Andrew