In general, Information Disclosure is a good security tactic. The less
you tell the hacker, the better. However, please do not confuse
"Information Disclosure" and "Obscurity through Obscurity" because
while the former is a good security tactic, the latter is a completely
bogus form of security.

In this case, the information you want to prevent disclosing is
through obscurity and hence not worthwhile.

And even if you want to prevent the disclosure -- IIS version can be
easily determined by the OS because there is only one version per OS
(other than XP Pro 32/64bit). And an OS over the network has many
possible/benign-looking fingerprinting mechanisms that it is not worth
trying to hide/obscure your network identity. The fact your TCP stack
responds to the remote server is enough to fingerprint the system.
There are software systems out there that attempt to masquerade the
TCP stack, but that tampering can also be detected.

In general, you get far greater bang-for-the-buck by focusing on the
actual security configuration of the system, instead of trying to
obscure the identity, because obscuring the identity does not buy you
any security.

Furthermore, computers make it easy to try every possible exploit in
an optimized bang-for-the-buck fashion such that even if you obscure
the identity, the hacker STILL tries the attacks to see which
succeeds.

In other words, suppose the hacker has a collection of hacks against
Apache, IIS, and Sun WebServer. You have an IIS server and somehow
masquerade it as a Sun server. Do you think the hacker is just going
to try the Sun WebServer hacks and stop, thus rendering your server
"secure"? Or do you think the hacker knows that people does obscuring
and will try all his bag of hacks and see what hits. You bet the
average hacker will do the latter because it is so cheap and easy to
do... so what does your security through obscurity buy you? Absolutely
nothing other than wasted time and effort.

//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//

On Jul 27, 10:02 am, Massimo <Mass...@discussions.microsoft.com>
wrote: