Slashdot Mirror

"Check the percentage of pwned IIS servers and the uptime of Apache on Linux" - by Technician (215283) on Wednesday June 20, @01:12AM (#19574975)

I tell you what, I will use the # of vulnerabilities found in BOTH webservers, because I could find it easily enough!

Bookmark this page;
http://isc.sans.org/ The SANS Internet Storm Center keeps track of data swarms caused by worms, bots, and other out of control threats. When they occur, pay attention to what machines are exploited. It's not always workstations on cable modems.

http://news.yahoo.com/s/ap/20070620/ap_on_go_ca_st _pe/dhs_computer_security

Care to guess the OS exploited?

Nice try.
IIS (first URL) shows less bugs/vulnerabilities than Apache (2nd URL) does (and less critical ones) & in fact, 10 TIMES LESS!

They tested Apache version 2.0.x. The current versions are 2.2.x. I can declare Windows 98 full of unpatched problems.. and be right.

IIS secure? Apache secure?
They both have exploits. The number of exploits is one thing. The number of exploited machines is another.
http://www.google.com/search?hl=en&q=IIS+exploits& btnG=Search
http://www.google.com/search?hl=en&q=Apache+exploi ts

To make you feel good, here is a current Linux exploit;
http://www.scanit.be/uploads/php-file-upload.pdf
And Windows exploits
http://www.symantec.com/enterprise/security_respon se/weblog/2007/05/mpack_packed_full_of_badness.htm l
http://isc.sans.org/diary.html?storyid=2994
http://isc.sans.org/diary.html?storyid=2985
http://isc.sans.org/diary.html?storyid=2979
http://isc.sans.org/diary.html?storyid=2976

A Safari exploit;
http://isc.sans.org/diary.html?storyid=2982 (It's on Windows, not Apple)

To be fair some Linux worms and exploits;
http://www.packetstormsecurity.org/unix-exploits/l inux-exploits/

For workstations which visit the web, I avoid Windows. Just seeing the headlines is enough.
http://news.bbc.co.uk/2/hi/technology/6465833.stm

I know they were nice and didn't bother to mention the OS, but I think it's very likely the monoculture OS. If you have any data on the number of non Windows bots in the herds, let me know. I'm looking for any data on the breakdown of OS on exploited bots.

Current June 2007 exploit list... http://www.packetstormsecurity.org/0706-exploits/
From the list.. 06072007-CVE-2007-2237.zip
Description:
Microsoft Windows GDI+ ICO file remote denial of service exploit.

comicsense-sql.txt
Description:
Comicsense suffers from a SQL injection vulnerability in index.php.

CVE-2007-2815.txt
Description:
Exploit that takes advantage of the Microsoft IIS5 NTLM and basic authentication bypass vulnerability. I wonder if this is one of the patched MS ones?

Many of the exploits are php / SQL exploits. I don't think MSSQL is immune.

Feel free to resear

You swallowed and regurgitated the MS line perfectly: always blame the users. Users were not the reason IE exposed an UNPATCHED remote code execution bug for all EXCEPT 7 days of 2004 (http://bcheck.scanit.be/bcheck/page.php?name=STAT S2004). Users are prevented by law and the MS cops (BSA) from seeing or tinkering with MS code, yet you and MS blame them for the damage they suffer due to the lousy quality of MS code.

The users did not create the incestuous, inherently insecure entanglements among the "apps" and operating system in MS Windows. There is no warning on the box of MS Windows saying that the product is unsuitable for use by new users of computers. There is no warning on the box of MS Windows saying that only experts in network security have any chance of safely using the product in any computer that is not completely isolated from others.

How many more years and MS Windows versions will trolls, astroturfers and shills directly dispute the evidence and continue to claim both that MS Windows is suitable for uneducated users and that those users are to be blamed for not being security experts?

MS Windows is demonstrably unsuited to any networked environment. MS Windows is demonstrably unsuited for use by anyone who is not a highly trained network security expert.

Save your friends from the dangers of MS Windows: install GNU/Linux for them and don't give them the root password.

Well, Microsoft is no doubt concerned about ISPs who include branded browsers as part of their install kit restricting or blocking access to the 'net from IE (which is 98% insecure). A wholesale switch to either Moz or Opera isn't the answer (but abandoning IE can't hurt), but both could use somewhat increased market share. A 3-way race with no eventual winner is probably the best possible outcome.

http://bcheck.scanit.be/bcheck/page.php?name=STATS 2004
Your questions are addressed on pages 3 and 4.

http://bcheck.scanit.be/bcheck/page.php?name=STATS 2004
In 2004, there was only ONE WEEK during which there were no known remote code execution exploits for fully-patched MSIE. There were 30 days for Firefox if you don't count Mac OS (which would be fair if we're only interested in browsers for Windows users).

A fully patched Internet Explorer were known to be unsafe for 98 percent of the time during 2004, while Firefox -- were "unsafe" only 15 percent of last year according to ScanIT:

http://bcheck.scanit.be/bcheck/page.php?name=STATS 2004&page=3/

It's more secure: IE in 2004 and Mozilla in 2004.

It's more secure: IE in 2004 and Mozilla in 2004.

At your own risk, of course. Firefox 1.0PR passed with flying colors.