Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have been reading this security checklist about web service design:

http://msdn.microsoft.com/en-us/library/ff648304.aspx

One of the suggestions is that you should disable the following in production environments:

1) Tracing

2) Debugging

Now I know that both tracing and debugging are used to study the flow of the program in order to find bugs so that these can be fixed.

I know that these two should be disabled because they would greatly hamper the performance of the server.

However, if these are not disabled, do they present security risks? For example, is tracing information still displayed on the client's computer or is it displayed only on the server's computer? What about debugging information?

share|improve this question
add comment

2 Answers

up vote 3 down vote accepted

Yes, production servers should present little information outside their designed purpose to the outside world. Display of any kind of debug or trace information (intentional or accidental) could clue hackers/attackers into where to pinpoint an attack, a particular form box that maybe vulnerable and at the very least make finding a weakness in your site less difficult, and in the worst case open up a front door to any hacker familiar with the system/software should a noteworthy bit of information show up in the debug listing.

Production code is always recommended to run with debug and trace code turned off.

On the flip side it will make finding internal bugs more difficult if you are not doing internal checking and logging of errors, this is why you type check, argument count, length check, etc etc prior to running your code on untrusted data (from the outside world).

Failure to check your data is how hackers have bagged so many buffer overflow bugs and easily entered into many sites remotely. Should your checks detect something out of the ordinary then an internal log (not accessible to the outside world) should be generated and a email sent off to the administrator to indicate that the log needs checked but no indication of a problem should be made to the outside world, this is to avoid alerting a hacker of a potential goldmine, instead continue the process like everything is normal even if you don't actually process the data, the hacker will write it off as nothing interesting.

share|improve this answer
    
Thank you so much for your detailed response. I appreciate it immensely. –  Matthew Sep 16 '13 at 12:59
    
One more question. If tracing is enabled on a production server, is the tracing information at the bottom of the web page only visible to the administrator only? Or is it visible to anyone visiting the website? –  Matthew Sep 16 '13 at 13:02
1  
No, if tracing information is available at the bottom of the webpage without any special login then it is usually on all pages although this could vary from one framework to another, and again I can't stress how important it is to have debugging and tracing off for any production server. Even if you think or know that information isn't being displayed to the outside world, hackers are quite ingenious and given enough time and enough monkeys mashing random keys eventually it will be found and will be used to ease in accomplishing their malicious intent. –  Joshua Briefman Sep 18 '13 at 13:42
    
Again, thank you so much for your detailed response sir. I appreciate it immensely. –  Matthew Sep 18 '13 at 14:49
add comment

beside joshuas explanations there are also performance - reasons to have debugging off on prod-systems, because all the debugging infos have to be written and stored, an turning debugging on increases pressure on your storage/filesystem.

talking of webservers, if you write ~ 1 GB usual access.log each day you'll easily write 3-10 GB when turning on debug-log for your webservers.

share|improve this answer
    
Thank you so much for your response :) I appreciate it immensely. –  Matthew Sep 16 '13 at 13:00
2  
Agreed, I've seen disk space problems occur when people leave debug/verbose logging on and forget about it ;-) (e.g.: OMG someone is hacking our server! All of our diskspace is being filled, what's happening! What can I do! | Tech: ...It seems your log file is huge, and I'm seeing alot of mundane messages...did you turn on verbose or debug logging? ) –  Joshua Briefman Sep 18 '13 at 13:46
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.