Slashdot Mirror

← Back to Stories (view on slashdot.org)

The Twenty Most Critical Internet Security Holes

Posted by ryuzaki0 on from the casey-kasem-is-out-to-lunch dept.

Ant writes: "A little over a year ago, the SANS Institute and the National Infrastructure Protection Center (NIPC) released a document summarizing the Ten Most Critical Internet Security Vulnerabilities. Thousands of organizations used that list to prioritize their efforts so they could close the most dangerous holes first. This new list, released on October 1, 2001, updates and expands the Top Ten list. With this new release, we have increased the list to the Top Twenty vulnerabilities, and we have segmented it into three categories: General Vulnerabilities, Windows Vulnerabilities, and Unix Vulnerabilities."

4 of 250 comments (clear)

  1. How Linux Fares by sting3r · · Score: 5, Insightful
    Many of these vulnerabilities have been addressed in the past 1-2 years by the major Linux vendors. Redhat and Debian, in particular, have been quite good at reducing the avenues of attack. For instance, the changes I've observed include:

    • Redhat used to open up the xfs port to internet traffic, but now uses a local UNIX socket. No access -> no exploit.
    • After many problems with lpd, most Linux distros now restrict the internet hosts that can connect to port 515 to localhost only.
    • I don't know of a single Linux distro that ships with default passwords for any user. (Even Solaris and the other oldskool unices stopped this practice within the past few years.)
    • With the rp_filter option, Linux (by default) drops packets that are spoofed to look like they come from a different network. For instance, traffic from the internet with your internal network's addresses in the header is automatically discarded. (FreeBSD should really do the same but they're being stubborn about it.)
    • GNU Apache and most of the distros out there remove all of the sample cgis (like nph) that used to be a security threat. Indeed, my Debian box has only the Apache manual (static html) installed; and that's damn hard to exploit. :)
    • Samba has never been vulnerable to the NETBIOS unprotected share vulnerabilities. It takes a considerable amount of effort to enable sharing anything via Samba to the general public - if you don't intend for that to happen, it's not going to happen.
    • Samba has no Null Session support. Samba does not send out lists of users (the equivalent of /etc/passwd under shadowing) like NT does. It is very difficult to break into a Linux box through SMB networking.
    • In general, setuid root programs have become setgid (something else) programs through the years. xterm and xlock immediately come to mind; on other platforms (even OpenBSD) they are still setuid root. This further hardens the GNU/Linux system. ps and netstat do not need privilege because of the privilege-bracketing nature of /proc.

    Linux boxes are much more secure than any of the competitors. Solaris is getting better; UnixWare is pretty hopeless (see BUGTRAQ). NT is ... well, draw your own conclusions about NT. I feel much safer with a Linux server than with any other OS and the security just keeps getting better.

    -sting3r

  2. The really interesting part of that list... by devphil · · Score: 5, Insightful


    ...is that, for the Unix vulnerabilities, most of them have long since been replaced by better, more secure alternatives. Where I work, nobody has used the word "telnet" or "rexec" for years. Nobody here runs sendmail, or sadmind, or SNMP stuff. It's basically a list of "don't ever use this ancient crap" tools.

    But for the Windows vulnerabilities, they're all related to current, recent, flagship, "this is what you should be using" products. No alternatives within the Windows world.

    --
    You cannot apply a technological solution to a sociological problem. (Edwards' Law)
  3. G4 - Large number of open ports by ink · · Score: 5, Insightful
    It's very very dangerous to keep on complaining about having a "large" number of open ports. Many system administrators will take this to mean "firewall all these ports at the border".

    "Why is that dangerous?" I hear you ask? As we drive more and more traffic to a small number of ports (read: everything on port 80) because of draconian firewall and proxy servers, and even driving all traffic to one protocol (read: http) a large number of services will still be running, but will now be undetectable without traffic analysis, which is mostly voodoo technology right now. The bugs and security holes are still there, but now they are hidden from us because we've conditioned everyone that non-80 is firewalled (see SOAP and Microsoft's dotNET -- in order to avoid firewalling, they are basically going to do RPC over port 80 using HTTP!)

    I agree that unused services need to be shut down, but at the source of the problem and not at the firewall. We need to encourage new protocols to make use of new ports so that we can manage thus stuff -- the more we drive traffic away, the harder our job will be. Please, if you are in charge of a firewall, take time to think about what you are doing to everyone else when you institute strict policies that only make you safer in the very short term. Not only are you hurting yourself, but you're giving your users and network a false sense of security.

    Besides, the attacks de jour of late have all propogated over SMTP and HTTP, haven't they?

    --
    The wheel is turning, but the hamster is dead.
  4. Dammit, How many times do I have to say this? by trcooper · · Score: 5, Insightful


    Linux boxes are much more secure than any of the competitors. Solaris is getting better; UnixWare is pretty hopeless (see BUGTRAQ). NT is ... well, draw your own conclusions about NT. I feel much safer with a Linux server than with any other OS and the security just keeps getting better.


    Bullshit. You're lying to yourself. One OS is not automatically more secure than another. Notice the first problem they noted: Default installations of operating systems and applications. They meant all operating systems, they didn't say 'RedHat and Debian are pretty good, you'll probably be okay with them, or at least more okay than someone using Windows.' Not only is this the most important point of the article, all other vulnerabilities stem from it. They all exist because of complacency with the current state of security of a system.

    Security is not determined by OS. Period.

    A systems security depends on the administrator's vigilance in keeping up to date on patches. Sure, windows has had a lot of exploits lately, but how many of these exploits were not patchable? Hmm. Conversly, Linux and other Unix systems have been not as widely or at least as publically attacked lately. Is this because they have less holes? Redhat 7.1, about 6 months old has 23 security alerts listed. 7.0 and 6.2 both have over 60. So, there's likely likely more out there in 7.1. Many of these are critical and involve remote root exploits. Feel safe? I hope not.

    (Li||U)nix can be attacked with the same efficiency of what we've seen happen to Windows systems in the past few months. Administrators aren't simply better because they admin unix boxes, that's proven in the article that 50% of the copies of BIND that were running in mid 1999 were vulnerable. It would make sense that a similar percentage of other security risks exist as well.

    I'm not bashing Unix, and I'm certainly not saying that Windows is a more secure OS. Its a moot point. What I'm saying is that people who blame the OS for their mistakes are wrong. They're using windows as a scapegoat, and ignoring the real problem behind this.

    Unix will be hit by one of these sometime or another, and it will be just as publicized because it will likely use the same distrubution methods as before, email.

    Go back, read the article again, paying close attention to the generic problems they mention. These are the basic things that any admin has to look at, every day. A machine is never secure. You can be sure of that.