Answered by:
Fingerprint SQL

Question
-
Where you Fingerprint the SQL Server Name and Version from external source, it reveals the Version No. Can this be removed? We are working on SQL 2005.
Thanks in Advance
Tuesday, January 17, 2012 9:25 AM
Answers
-
Are you referring to fingerprinting tools that probe machines to discover SQL Server versions and other info? If so, the short answer is no and it's true for pretty much any other software. You can hide SQL Server (set in configuration manager) and that will thwart most basic tools but there are still other ways to find what's installed and running on a given machine.
Those tools take advantage of features intended for legitimate users to perform both useful (e.g. discovery) work and sometimes for abuse (e.g. probing for live instances to attack). For example, ping can be abused via pingflood attacks but the root of the problem is in non-legitimate users getting through.
In your situation, fingerprinting for SQL Server should be all but useless when done by someone outside of your corporate network as you really should not be exposing your database server directly to the internet. If the threat is from an internal source, you might have more urgent problems to deal with than fingerprinting software.
+> Btw, what fingerprinting tool are you using?
No great genius has ever existed without some touch of madness. - Aristotle- Edited by SQLMojoe Wednesday, January 25, 2012 11:05 PM add question
- Marked as answer by Stephanie Lv Monday, January 30, 2012 6:41 AM
Wednesday, January 25, 2012 8:30 PM
All replies
-
-
are you talking about Microsoft SQL Server Fingerprint tool ?
and please clear your requirement about what you want to achive?
Monday, January 23, 2012 11:27 AM -
Are you referring to fingerprinting tools that probe machines to discover SQL Server versions and other info? If so, the short answer is no and it's true for pretty much any other software. You can hide SQL Server (set in configuration manager) and that will thwart most basic tools but there are still other ways to find what's installed and running on a given machine.
Those tools take advantage of features intended for legitimate users to perform both useful (e.g. discovery) work and sometimes for abuse (e.g. probing for live instances to attack). For example, ping can be abused via pingflood attacks but the root of the problem is in non-legitimate users getting through.
In your situation, fingerprinting for SQL Server should be all but useless when done by someone outside of your corporate network as you really should not be exposing your database server directly to the internet. If the threat is from an internal source, you might have more urgent problems to deal with than fingerprinting software.
+> Btw, what fingerprinting tool are you using?
No great genius has ever existed without some touch of madness. - Aristotle- Edited by SQLMojoe Wednesday, January 25, 2012 11:05 PM add question
- Marked as answer by Stephanie Lv Monday, January 30, 2012 6:41 AM
Wednesday, January 25, 2012 8:30 PM