I sometimes read about "hiding the framework/technologies used in a web application for security reasons"...

But why? Is it a real issue to publicly expose which tools I'm using to create a project?

Large public web application like LinkedIn, Facebook and many others don't hide tecnologies used for their platforms, so why should I?

Is there any other reason to do this?

  • 3
    ...because Facebook etc. have countless dedicated 24/7 security staff, internal security tests and audits and many more countermeasures that you don't? – Kilian Foth Sep 1 '17 at 9:49
  • Hiding the framework means? What does difference makes for security purpose whether you use spring or struts or .net. – Ankit Sep 1 '17 at 9:56
  • @Ankit Is what I'm trying to understand... I think, no difference – davioooh Sep 1 '17 at 9:59
  • Hiding a framework or library behind your own abstraction helps to decouple the rest of your code from the frameworks/libraries you've chosen, which can make your code easier to test and more maintainable. There's nothing particularly about security - if your application is insecure then the degree of decoupling between your code and the framework is unlikely to make any difference. – Ben Cottrell Sep 1 '17 at 10:04
  • Since nobody has mentioned it by name yet, it does beg mention that this is just another variant of "security by obscurity", which experts widely agree doesn't genuinely improve security (but can slow down attackers -- possibly with some costs, though). – Kat Sep 5 '17 at 20:31

Hiding your framework does not guarantee security. But it makes successful attacks less easy.

Even assuming that all your software is up to date, if you broadcast the fact that you are using Technology vX.Y.Z and a security problem with that version is found, attackers have a window of opportunity between the disclosure of that vulnerability and installation of updates.

For a professional, security-conscious organization, there won't be any unnecessary services exposed to start with, and they will be able to patch vulnerabilities in their software very quickly. The biggest part of this is knowing that there is a problem, i.e. subscribing to the appropriate mailing lists of the software you are using, and keeping up to date with CVEs.

Minimizing unnecessary information about your software versions also reduces your risk. But it doesn't actually prevent anything. Be aware that attacks may be carried out in an automated fashion, and that IP ranges of hosting providers and cloud services are an especially promising target. Note that there are search engines like Shodan that can search for specific technologies and versions if these services disclose themselves via metadata.

  • 2
    For further readings, take a look at Attack surface definition. – Laiv Sep 1 '17 at 13:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.