I am a software developer -- but not a security specialist. A (legitimate) company that does security scans sent my company a notice that we are running an older version of SSH on our hosting server. The company that runs our hosting server says that they cannot release the version of SSH that they are using but assures us that it is secure.

  1. Should I trust the hosting company or the scanning company or neither?
  2. How difficult is it to determine the version of SSH remotely? How is it that the security company can say what version of SSH we are running but the hosting company cannot.

Looking for advice on how to proceed.

  • There is only one good answer to the question, "hosting company, what version of SSH are you running?" and that is "the latest version" - anything else, and you have a problem on your hands. – schroeder Mar 16 '15 at 5:26

It sounds off that a service provider will not give you details of the product/service you are purchasing. That is like a contractor not telling you what wood he is using to build a house. I would remind your service provider that "security by obscurity" will not help a remote attacker from figuring our or just launching attacks against all versions of SSH.

You should check to see if you have a "right to audit" in your service contract, as that might give you the right to know this information (always try to get such language in your service provider contracts)

Do you have command line/shell access? If you do, you could try to check the version yourself.

In terms of the pen testers getting the wrong version, its entirely possible. Depending on the checks they ran (probably automated through a vulnerability scanner), certain characteristics may not give a 100% match. It's also possible to configure/compile your applications to lie about their versions, change banners, or for some intermediate proxy or load balancer to change this information.

However, it sounds like a red flag from the service provider that they will not release this information. You may want to let them know how important security is to your organization and that lack of sufficient security assurances could lead to taking your business elsewhere.

  • Like the saying goes, trust but verify – wireghoul Mar 15 '15 at 23:41

As one who does testing myself, it is possible to get the version of SSH via the banner it returns, or by testing specific vulnerabilities. It's not fool-proof, but the tester will show you why they think that it is a specific version, and you can submit that to your hosting company for a response.

There is another concern. It sounds like a test was done without the knowledge or consent of the hosting company (otherwise, they would not hesitate to talk about the versions of services that they are running). If so, then you might have an issue with your hosting company. All-in-all, it's the tester and the hosting company that need to be talking.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.