I am a software developer -- but not a security specialist. A (legitimate) compa
ID: 654835 • Letter: I
Question
I am a software developer -- but not a security specialist. A (legitimate) company that does security scans sent my company a notice that we are running an older version of SSH on our hosting server. The company that runs our hosting server says that they cannot release the version of SSH that they are using but assures us that it is secure.
1. Should I trust the hosting company or the scanning company or neither?
2. How difficult is it to determine the version of SSH remotely? How is it that the security company can say what version of SSH we are running but the hosting company cannot.
Looking for advice on how to proceed.
Explanation / Answer
It sounds off that a service provider will not give you details of the product/service you are purchasing. That is like a contractor not telling you what wood he is using to build a house. I would remind your service provider that "security by obscurity" will not help a remote attacker from figuring our or just launching attacks against all versions of SSH.
You should check to see if you have a "right to audit" in your service contract, as that might give you the right to know this information (always try to get such language in your service provider contracts)
Do you have command line/shell access? If you do, you could try to check the version yourself.
In terms of the pen testers getting the wrong version, its entirely possible. Depending on the checks they ran (probably automated through a vulnerability scanner), certain characteristics may not give a 100% match. It's also possible to configure/compile your applications to lie about their versions, change banners, or for some intermediate proxy or load balancer to change this information.
However, it sounds like a red flag from the service provider that they will not release this information. You may want to let them know how important security is to your organization and that lack of sufficient security assurances could lead to taking your business elsewhere.
Related Questions
Navigate
Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.