iis security: All,

[ For background with the security concern surrounding the Content-Location
tag in the HTTP header in multiple flavors of IIS, read:
http://support.microsoft.com/?id=218180. ]

As the article above indicates, there are ways to alter this tag in IIS 4.0
and 5.0 but until recently, there was no way to cure this on IIS 6.0 -- then
I found this article: http://support.microsoft.com/?id=834141. The problem
is, you have to contact Microsoft product support ($99 - $245) to get the
hotfix code.

I am unsure why I should have to pay hundred(s) of dollars to get a fix that
makes my install of IIS more secure. Does someone from MS care to comment?

In addition, before anyone replies with a discourse to the effect of " ...
you know, such fixes are not really the best ways to secure your web
servers, you should consider X, Y, Z <insert snippet from some SANS white
paper they just read> ..." I am well aware of the differences between
security by obscurity and true host hardening. My goal in this case is part
of a research project aimed at fooling automated tools into thinking that
....

An IIS 5.0 web server is really a Netscape Enterprise server ...
An IIS 6.0 web server is really an Apache web server ...
Apache web server is really an IIS 4.0 web server ...

you get the idea. This is more than changing HTTP headers, but small things
like this help depending on the quality of the scanning tool you are trying
to fool.

Also, if someone already has this hotfix and is willing to share, let me
know! ;-)

Jake Lane
jacoblanemcp@nospam.yahoo.com

[quoted text, click to view]

I'm still not sure I see the benefit of doing this. As you may know, doing
this does nothing to protect you against worms and script kiddies who often
don't scan a system before attacking it. It also does little to prevent an
attack from a skilled attacker, unless you 1) don't use any .asp or other
microsoft-proprietary technologies on your IIS server, 2) use a proxying
firewall of some sort to change the characteristics of the TCP and IP
headers in the packets your server generates, etc.

I assume you've read the articles for some other things you'd want to do to
achieve what you're attempting:

http://community.whitehatsec.com/articles/02/10/09/1813224.shtml
http://www.nextgenss.com/papers/iisrconfig.pdf

It is FREE !
http://msmvps.com/bernard/archive/2004/06/11/7976.aspx

Hotfix is ALWAYS FREE :)

just ring them.

--
Regards,
Bernard Cheah
http://www.tryiis.com/
http://support.microsoft.com/
http://www.msmvps.com/bernard/



[quoted text, click to view]

[quoted text, click to view]

How did you come up with that conclusion? The KB itself mentions that
"charges that are ordinarily incurred for support calls may be canceled if a
Microsoft Support Professional determines that a specific update will
resolve your problem."

Translation: If you know your issue is fixed by the QFE (either PSS
determines this, or you figure it out yourself), you call PSS to get the
QFE, and it is free.

--
//David
IIS
This posting is provided "AS IS" with no warranties, and confers no rights.
//
[quoted text, click to view]
All,

[ For background with the security concern surrounding the Content-Location
tag in the HTTP header in multiple flavors of IIS, read:
http://support.microsoft.com/?id=218180. ]

As the article above indicates, there are ways to alter this tag in IIS 4.0
and 5.0 but until recently, there was no way to cure this on IIS 6.0 -- then
I found this article: http://support.microsoft.com/?id=834141. The problem
is, you have to contact Microsoft product support ($99 - $245) to get the
hotfix code.

I am unsure why I should have to pay hundred(s) of dollars to get a fix that
makes my install of IIS more secure. Does someone from MS care to comment?

In addition, before anyone replies with a discourse to the effect of " ...
you know, such fixes are not really the best ways to secure your web
servers, you should consider X, Y, Z <insert snippet from some SANS white
paper they just read> ..." I am well aware of the differences between
security by obscurity and true host hardening. My goal in this case is part
of a research project aimed at fooling automated tools into thinking that
....

An IIS 5.0 web server is really a Netscape Enterprise server ...
An IIS 6.0 web server is really an Apache web server ...
Apache web server is really an IIS 4.0 web server ...

you get the idea. This is more than changing HTTP headers, but small things
like this help depending on the quality of the scanning tool you are trying
to fool.

Also, if someone already has this hotfix and is willing to share, let me
know! ;-)

Jake Lane
jacoblanemcp@nospam.yahoo.com

Hotfixes are free - call Microsoft PSS and say you need a hotfix, and give
them the KB article number. Your credit card will not be charged.

However, you gain nothing in the way of security here IMHO. Security through
obscurity only works /if/ the obscurity causes the attacker to give up and
move to an easier target. However, there are such a limited number of
attacks against well known webservers (Apache, IIS etc), that it costs very
little to try every possible attack for every possible webserver, and see
which ones cause the server to have issues. Most automated webserver attack
tools do this OOB.

Cheers
Ken

[quoted text, click to view]