Slashdot Mirror
More Attacks on Linux than Windows
the special sauce writes "This vnunet.com article discusses the trend of attacks this year as compared to last. Over all, according to mi2g, attacks are on the rise. However, though attacks on Linux systems are up, attacks on Windows based systems have actually dropped dramatically when compared to last year. If the trend continues, by the end of the year, attacks on Linux systems may surpass attacks on Windows systems."
Sounds like Microsoft FUD to me...
Which are more successful? The attacks on Windows machines, or the attacks on Linux machines?
Maybe the attacks on Windows are falling off, because there's enough back doors already. Between Microsoft and Kazaa, I'd say things are good-to-go, from a back-door point of view.
Napster-to-go says "Fill and refill your compatible MP3 player", which is a lie. It's not MP3. It's WMA with DRM.
Yeah, but the difference between attack counts between Linux and Windows are how many of those attacks are successful...
- Jester
Are scriptkidiots lookig for real chalenges? (=
Is this including all the viruses, script kiddies, etc. etc. that tend to fill up logs?
If it's only sentient attacks, then it makes sense. Windows isn't a challenge, Linux is.
Otherwise, I beg to difer. There are countless sites out there dedicated to shameless display of nimda/code red, and script-kiddie attacks in their logs.
-Sara
the attacks on amiga boxen where at record lows
Is that Linux has grown in popularity over the past year, taking even more market share away from windows... ...do you think the script kiddies have any idea what OS the server they're "attacking" is running?!
And, as someone already pointed out...who had more successful attacks...Windows, I'm sure...
We're Number One! We're Number One! We're Num... oh. Never mind.
The real question to ask is, "how many of these attacks are successful as compare to attacks on Windows?"
Fight Spammers!
Of how the phrase "and if this trend continues" can pretty much turn otherwise useful statistics into a big mess.
You know, watching a puppy grow, you could say, "And if this trend continues, this will soon be a super-dog the size of Godzilla, and will devour Tokyo."
Funny, that never seems to happen.
The research found that Linux systems in the firing line typically deployed open source third-party applications, certain versions of which contained well known vulnerabilities which are not being patched fast enough and are continuously exploited by hackers.
A lot of people have complained about patches not being included in the kernel fast enough but it seems app patches are slowing down as well. What's going on? Maybe this is affected by school schedules.
How to fill your hard drive with music, movies and pictures while you sleep.
It only make sense that most attacks are Linux type systems. Linux is more becoming the staple of the home router/firewall. When you have a community of users (linux and windows), most people would honestly say that would have a Linux or *nix type system up in the front line than a Windows box. With the number of homenetworking becoming more complex, it would only see the number of Linux attacks in crease because a good number of computer users are hiding their Windows boxes behind Linux firewalls. :-)
:-) Way to go GNU/Linux.
If anything, it just goes to show you that Microsoft is just hiding behind a clout of Linux warriors doing all the dirty work
for Linux that will install an EULA daemon to keep an eye on those pesty root kits like vmlinuz, passwd, shadow, and glibc.
The main reason is imho the apache hole which has an ready avaliable exploit for OpenBSD systems and OpenSSH root exploit which has a ready made exploit too . Both exploits are mailled to vuln-dev mailing list of securityfocus.com by GOBBLES security group. So kids have two interesting programs in their hands so what do you think they do ?
Never learn by your mistakes, if you do you may never dare to try again
My firewall blocks at least 30 LAND attacks every day. Are they counting these as attacks on my firewall, or, since they're Windows vulerabilities, are they counted as attacks on Windows?
"Upon attaching the waterblock to my penis, I began to notice that I know nothing about computers." -- JRockway
Windows boxen pose no challenge anymore... skript kiddies want to skite, we all know there mentalities. Defacing a Windows http server is so yesterday's-news nowadays that it doesn't give a hax0r any 31331-cred anymore. Tough boxes like Linux, *BSD, especially OpenBSD are what give script kiddies maj0r hax0r kudos now.
TWW
"Encyclopedia" is to "Wikipedia" what "Library" is to "Some people at a bus stop"
Security hole discovered in Linux handheld
the script kiddies are growing up and looking for more of a challenge? they know there are a ton of holes in Windows based systems. maybe getting into a linux system makes them feel more l33t. just a thought.
For the record, these are security attacks, not verbal/slanderous from PR types or the media, right?
Looking through my Snort and Apache logs, I see about 5-10 CodeRed attacks *daily*. This is something that was fixed over a year ago, and it still fills my logs. About that 'chunked' Apache vulnerability? Twice. I have seen it 2 whole times within the weeks its been out. Lets not forget about this CodeRed bug, because it surely is an attack (a full "root" attack) and I have *never* been attacked with anything else so often. I doubt any study that doesn't take this into account.
On Windows... My machine is dead... Must have been another Windows crash... I'll reinstall (again)
On Linux...Hmm.... someone has been trying to attack ...(etc)
From my point of view.. "so?" Theres tons of Linux vendors. If we dont fall in love with one and get all biased, then we can just assume that the better ones will float to the top over time. (That regarding that people would actually stop buying an OS cause its insecure). People get all religious over this stuff, and to some end it is kind of fun, trying to advocate this little OS towards your friends and such... but in the end, isn't it really a matter of us having the advantage of all the time in the world? What magic event is going to occur that will stop linux dead in its tracks? I guess "chill out" is a bad retortion to an article I didnt read, but, oh well :)
slashdot: where everyone yells sarcastic metaphors to themselves to understand the issue
I bet if they added in infected servers looking for other servers...the numbers would be quite different.
Yeah, right.. tell that to my httpd error_log and its thousands of recent lines of logged attempts to infect my Power Macintosh with the Code Red or Nimbda worms.
Where's the analysis of where these numbers came from? Maybe attacks on linux are going up because linux's market share is increasing. (I mean, probably not, but if you don't analyze the numbers you don't *know*.) What's our sample space here? I couldn't even clearly figure out from the article what blocks of time they were looking at. Was the ENTIRE study based on those 200 or so government servers they mention?
If you compare the block of three months during which the Code Red and Nimbda crises were taking place to the last block of three months, where we had new exploits in both apache and openssh, of COURSE you're going to see windows attacks going down and linux attacks going up-- and that doesn't show anything except that in your first sample space of time you had a MAJOR worm crisis going on in the windows area due to a widespread unpatched hole, meaning windows attacks just soared for a month or so, but in your second time sampling this crisis had died down and been fixed a bit, so overall attacks will be much lower. Meanwhile in the last little block of time you'll see a flurry of linux attacks you didn't see last year because at this moment we have a couple of newly discovered linux holes, and the crackers are rushing to exploit them before everyone is patched.
I'm not saying the above is what this study did, but something funny seems to be going on-- they seem to be implying from the article that they compared the first half of this year to all of last year, but i couldn't work it out. What the hell does "dropped by 20% from last year" mean?
I am unconvinced there is any merit to this study at all.
Its short-sighted thinking like this that gets attacks on the rise. Remeber the OpenSSH input vulnerability? Well guess what, it trashed OpenBSD's default install 'root hole' record. Think FreeBSD is more secure? I would like to know what your smoking.
In case you don't know, no matter how 'secure' an OS is, it will be cracked if the admin doesn't pay attention to it.
and what counts as an "attack"?
I know that I put up an http server on my dialup (as I've tried before today) and have it come under attack from someone in Korea (the bane of my ISP for several years now) every half hour. This attack doesn't enter into their figures, goes unrecorded, yet they quote numbers down to the 1s column?
to find that Micro$oft marketing is behind this.
668: Neighbour of the Beast
Someone doing a portscan at a linux box with ipchains/ipfw does nothing more that add a text line to a logfile. This in my mind is not an attack. Firstly the attacker is using a master key that is 99% windows oriented, how many SubSeven attacks (27374) actually give back an "i'm listening" response when the target is linux? Does that scan qualify as an attack? I suppose the storage for that 90char log is my burden in the attack. With HD's in the 1$/GB region I can handle a few "attacks". I keep thinking of the Pink Panther and Cato attacking Clouseau. A bumbling fiasco each time it happened. I think there are thousands of Cato's out there waiting to "attack" my machine but I see and expect the same slapstick style attack that yields absolutely no fruit whist they move on to unpatched IIS 3.0 machines where there really is something for them to attack.
It's like someone in a dingy shooting an air rifle at a battleship. Does nothing but amuse/annoy the crew of the ship.
I don't really care about the number of attacks (unless it escalates to DOS), it's the number of successful attacks that is important.
And since Linux is much more heterogenous than Windows, a "linux" attack directed at me is less likely to succeed since it is less likely I have the exact hole that is being exploited.
Firstly, I question the source on these studies. We are given no real details, only "the number of attacks is up from ~5000 all of last year to ~7000 half of this year". This is completely meaningless, as we don't know what kind of attacks, or anything about the sampling method.
Here's some critical questions of this study:
1. How was this data taken? What was the sampling method? What was considered an attack?
2. Of those attacks on Linux, how many were successful? What's important isn't the number of attacks attempted -- that is irrelevant -- but ratio of the number of attacks that succeeded over the number that were attempted: in other words, the probability that an attack will be successful. I bet on Linux, that number is way below 50% and on Windows -- '95, '98, 'ME, 2000, and XP -- its way above 50%.
3. Of the attacks that were successful, how many of them were because of Linux itself, and how many because of some poor application? Same question to Windows. This is a minor point. The OS should have control and prevent security lapses, despite how crappily third parties code.
4. What kind of attacks were these? Attacks is a very general word; there may be many successful minor attacks (i.e., crashing a system), but that's not as bad as a few successful major ones (i.e., wiping the entire hard drive of a system, stealing a credit card number, etc etc). In other words, how far into the OS did the attacks go. For Linux, a relevant question is "did the attack just breach a user's account, or did it penetrate to the root?"
5. There's a lot of different "brands" or "flavors" of Linux. This matters. You'd expect Corel Linux to have much weaker security than the NSA's release of Linux, or than (for example) RT Linux. Different releases of Linux ship with different security by default, and different extra security features.
6. What is being done about the problems?
Relating to 6, we can rest somewhat assured in terms of security for Linux, as its Free Software and/or Open Sourced Software. Well-known bugs will be fixed by someone, and if they aren't, an annoyed individual could always take the initiative.
What separates Linux from MS isn't just that its more secure, its also that bugs, security flaws, stability flaws, performance pitfalls, etc, are usually fixed much more rapidly than they are in MS.
Also, no one has mentioned the attacks on other stable OSS/FS software, such as OpenBSD. Somehow, I doubt there's been much success in attacking OpenBSD.
social sciences can never use experience to verify their statemen
I'm not going to go so far as to say this article is FUD, but I've got some questions about the way they (as well as the mi2g article it's based upon) present their information.
;)
1. Does an attack mean there's a successful exploit? Or is it just an attack?
2. Is the rise due to the fact that Linux is constantly becoming a more popular server OS, and there are more and more instances of Linux out there to attack?
3. Early on they talk about attacks against Linux, and later they talk about government sites "succumbing to attacks". Do these mean the same thing?
(C'mon, step right up and get yer +1 Informatives by answering these questions
--------
Bleah! Heh heh heh... BLEAH BLEAH!!! Ha ha ha ha...
These statistics make sense. More and more people are adopting Linux now. There are two main drivers for this trend: People hear that Linux is better and organizations don't want to pay Microsoft's draconian licence fees.
The real question is whether these attacks are successful. Unfortunately, while the number of Linux servers is going up, so is the number of people who own or administer these systems and who aren't security-aware.
I think it's in the best interest of our community to assist the newbies when they have questions about setting up their systems, particularly when it comes to security. I've seen too many newbies laughed at in the IRC #security channels or the newsgroups. We should welcome them and try to help them; otherwise, The Forces of Evil will start using the statistics of all the h4x0red and 0wned systems (due to ignorance on the part of the users) as FUD.
There is no doubt that Linux is now a mainstream alternative. Remember, though, that the hard part is not to arrive, but to maintain a leadership position. That's the difference between the Rolling Stones and the one-hit wonders. In order to maintain our leadership, we should work together toward making the community aware of the pitfalls, and the distro vendors should probably come up with a policy of "all services closed" and forcing the users to open them, not the other way around. Other people will probably add better ideas to these suggestions.
The real measure is not whether the attacks are on the rise; it's the number of successful attacks that we should be concerned with.
Cheers!
Ehttp://eugeneciurana.com | http://ciurana.eu
Why was he modded down? Another case of moderation gone awry...
How many Windows attacks go unreported and unnoticed? All this can show really is that Linux attacks are increasingly easier to notice and report, while Windows attacks either are actually lower or (more likely) go unnoticed and perhaps even persist over a long time.
I design user interfaces for a free network management application,
...the linux boxes haven't had a virulent worm or two, or three, going around and making all the installations with holes sputter all over the network so they get noticed.
Nuh uh, nuh uh, not true!
What counts as an attack? So worms don't count, or the number would be in the millins. Reported attacks? Those shouldn't count much because there is "little incentive for a company to report computer attacks.
Here's another story by the supposed source, but again, they don't at all define what they mean by "attack".
The Harken Tale: Harken Energy purchased Bushboy's worthless oil company Spectrum7 for $2 million (bailing Bushboy out of big debts) in the late 80s and put Bushboy on their board and paid him a $120,000/year "consulting fee." Harken then lent Bushboy $180,000 so he could buy Harken stock. Bushboy was on their Board and was a member of their 3 man "Audit group" which was privy to the companies financial woes in 1990. After being briefed about Harken's cash flow problems in April, 1990, Bushboy sells his stock in June, 1990, when some mystery investor pays him $848,000 based on a "cold call" made by some stock broker (this is what the Bushboy people really say). In August, 1990 the poor financial condition of Harken becomes known and the stock drops like a rock to 1/4 its value when Bushboy sold it. Bushboy fails to report the sale of the stock by the 10th day of the month following the sale as required by law. He doesn't file the necessary SEC documents until 36 weeks later! The SEC head was appointed by Bushdaddy who is now president. Although the head of the SEC, Mr. Doty, was Bushboy's personal attorney, he doesn't recuse himself from any judgement of Bushboy and although the SEC refuses to exonerate Bushboy's criminal conduct it chooses not to investigate or prosecute (surprise!). The whole Bushboy/Harken deal stinks to high heaven and makes Whitewater seem like the jaywalking that it was in comparison, but Bushboy and the GOPers will block any attempt to investigate and hire a Special Prosecutor as they were so quick to do in Whitewater. Harken will be Whitewashed, as is everything else in Bushboy's sleazy past.
our webserver gets attacked all the time... those attacks are trying to exploit an iis bug, but i would consider them attacks non the less. so if more linux machines are getting attacked, then that might suggest there are more linux machines to be attacked. it doesnt really mean more successful attacks.
-- john
Windows has been successfully attacked over twice as often than Linux since 4/2000. Looking at today's list, 17 Win, 12 Linux, 15 other.
sulli
RTFJ.
I'd be curious to know what the attack statistics are like for Macs. I remember hearing about how there are hardly any Mac viruses in the wild because nobody bothers to design them for such a small user community. I would expect something similar for network attacks. But Mac sales are on the rise, so I wonder if the trend is reversing. Anyone know?
My deviantArt site
Snort and logsurfer snippets from our firewall logs go off all the time. Though I would say that we have seen more attacks targeting linux services (we're a linux shop, btw) than we've seen in the past, the majority of our attacks do seem to be against windows-based services.
From an overall security point-of-view, the last three to six months have not been great ones from a linux vulnerability point-of-view: zlib, BIND, ssh, apache, Tomcat (not that some of these problems haven't affected Windows boxen also). It's kept us hopping patching our servers. We've been lucky, so far - no successful intrusions (that we're aware of, of course!).
In general, it seems much easier to social engineer one's way into a Windows network via email attachments than directly attack it.
He was modded down because his post is misinformation. "X is more secure than Y" without proof isn't informative. He clearly is trying to troll.
More hack attacks, and especially data destroying, secret revealing security breaches could be great news for cash strapped open source and other Linux companies. While you can't charge for the software, you can make a pretty penny cleaning up the mess from the software.
But the trend of Linux boxes that get 0wn3d comapred to the Windows boxes that get 0wn3d probably show a difrent story.
Check out Alldas.org ffor some numbers.
If I were going to go after mchines I would much rather go after linux boxes.
Although they are harder to compromise they are more versitile when you do.
You know you will have a compiler, an easy to use over the network environment.
They are just more usfull to you.
Its unfortunate for the article that no quantifiable evidence is offered. For all we know the numbers were pulled from somebody's imagination.
Anyone can foresee that the end is coming. Already Linux has lost the coolness factor and all the greedy land grab by the many commercial splinter distributions has turned off many developers, who are now discovering that BSD is already everything that Linux has wasted years trying to re-implement or steal.
With the # of people that have jumped on the linux bandwagon in the last 3 years, a lot of them are running linux, just to say they are running linux. Most of these people are not administating their box's correctly. Nor do most of them even understand what it is they are supposed to do to administrate it properly. As long as the popularity of linux continues to grow, and basic moron users still exist - I would expect the attacks on linux to climb as well.
Successful attacks is one, but what about re-infection/compromise?
For instance compare some of the Win2k boxes to a RedHat 7.2 box I had compromised.
The Win2k box (not mine, un?/fortunately) had been caught by nimda or some other vulnerability and after being formatted was *again* bit by nimda/code red when trying to get the updates.
(a cd or local machine with the patches never crossed the dude's mind until the second time around).
My box was compromised by a user running a trojaned IRC bot (eggdrop? was the trojan).
I know, I know, that was my fault for slacking off/being caught up in other things, but the next go around was wipe, install the data, kill services that are not needed (chkconfig, nice tool) and edit the hosts allow/deny to hell and back.
I was *P.O'ed*. FTP/SSH/HTTP is the only thing running currently with large ranges of IP's blocked if I see even *one* probe I don't like.
(no complaints, yet).
The large difference was the "state" of the admin.
The win2k dude thought it was the "cost of doing business", mine was "those fscking tools + idiot user I'll do everything I can to keep it from happening again.
Sigh vs GRRRRRR, is what I call it.
That reminds me, it has been a day or so since I grepped the logs...
Gotta go.
Have you read the moderator guidelines? Well, have you, PUNK? (and I want a Karma: Gnarly option)
that should read:
"from the more-power-to-the-FUD-deflector-array! dept"
...brings this to a reality. Many system administrators out there had a 2 month course and the companies, eager to save money, call them for the work.
I'd say most linux administrator today are idiots who think they're 31337 'cause they've installed and got a default-installation Conectiva linux "server" up and running.
First of, I think one of the best features Linux has can hurt it in this area. Personally if I was a hacker. I'd rather root a Linux just because it's easier to administer remotely.
Secondly, hackers pretty much all run BSD or Linux. Script kiddies are going to hack what they know and sadly that is Linux.
-Jason Yates
There are going to be a higher amount of people who report Linux attacks and security holes, because something is generally done about them - due to the high amount of Open Source programmers out there to fix them.
Meanwhile, if your Windows box gets hacked, who ya going to call? Bill Gates? "Well, you do know that getting hacked is now a special feature!"
Now, it would be more interesting if somebody did some research in to the fixing times - how long it takes for Microsoft to bring out a fix for security holes, as compared to that of OSS project programmers.
That'll be very interesting, and provide some good ammunition against the typical MS-FUD that gets pushed out so frequently.
catch (HumourFailureException e) { e.user.send("You, sir, are a humourless idiot."); }
Windows users have learned to use "windows update"
think about it.. if you need to install a security update.. you just hit a button.. There is no real "easy" way to update your software on a linux box or someone who isn't in the know. Or if you dont RTFM..which some users don't.. most new linux users I've seen are happy enough just to get a network connection up and use netscape.
A hacked linux machine is more usefull than a hacked windows machine.
Do these numbers include all the e-mail worms spreading through Outlook and Windows?
If not they should raise the number of attacks on Windows systems
by a few million.
The real question is whether these attacks are successful.
First of all, a lot of comments in this thread comes from people who seem to assume that is some kind of viscious attack on their favorite OS instead of an announcement of a simple fact: there are more attacks on Linux now than before. Nobody said anything about this suggesting that Linux is less secure than it used to be.
The Forces of Evil will start using the statistics of all the h4x0red and 0wned systems (due to ignorance on the part of the users) as FUD.
It's true, so how, exactly, could it be FUD? Oh, you mean that MS would start saying things like: "look how many hax0red boxes you have, this must mean that Linux is rotten when it comes to security!" But isn't this exactly what the Linux community has been doing for years? Why do we always hear "Windows/Outlook/both suck because a gazillion boxes were infected by the ILoveYou virus" instead of "Windows users suck when it comes to security related issues, as a gazillion of them opened unknown attachments and got infected?"
Doublespeak, I say. And I'm no troll.
"If you think education is expensive, try ignorance" - Derek Bok
I remember the day that Code Red hit, when the Internet started running slow and my webserver got repeatedly hit by Code Red attacks from all over the place. If and when I see the same effect from a Linux worm, I'll know we've hit the same point.
You're not allowed to post pro-Microsoft studies on Slashdot!
Ahhhh so we are counting how many times a script kiddie hits enter. You know this article doesnt shock me at all. Wow big suprise that the OS with the most servers is getting hit more and more. I dont see how this could shock anyone. What I am curious about is how many of these attacks were major attacks or organized attacks. That would be interesting reading.
think about this, intellectually
1, kaaza, outlook, win32(insert fav virii here)
backdoors installed and operating correctly
2, linux with only ssh loaded with a funky
root password that prolly cant be hacked
3, your brain is working now, go ahead and make
the decision
This is another article by James Middleton, who is not a trustworthy source on this issue.
I went there just long enough to see his byline (being careful not to download images, hence no ad revenues), then came back here.
I've never seen Middleton write anything about Open Source that wasn't complete bullshit. This guy is either totally bought and paid for by Micorsoft, or is seriously stupd.
"that's not encryption - it's a new perl script that I'm working on..." - from some Matrix parody
maybe the hackers are looking for a challenge? tring to be diffrenet or just bored of goin after IIS and 2k/NT4 boxes...
maybe its cause the good stuff to hack is on linux boxes.
who cares as long as the community can keep with patches and holes patched. which the linux world seems to be much better at than the MS world.
It's true, so how, exactly, could it be FUD?
Saying "There are more attacks on linux systems" becomes FUD when you imply that this is bad. More attacks doesn mean more successful breakins. Truth can be FUD in the right context.
i hate articles like these, you know, the articles that give a sensational headline and then the body has 0!, no!, none!, not a bit of proper supporting evidence.
There are number of reasons why Linux boxes could be attacked more this year than windows boxes, each of which completely changes the tone of the article, but unfortunately do not make for good journalism. And that's what it's all about these days, fuck the story, just tell it in an interesting way. The public doesn't care what it's eating, just as long as it comes wrapped in a BigMac warpper. I don't know about you, but i'm sick of being treated like this. Please Slashdot, no more articles like this.
oh and the real reason why more linux boxes will be attacked this year is becasue there are more Linux boxes this year than previously and Linux box owners report attacks more offen than the window user that probably doesn't even know he is a victim of attacks.
At last! Linux finally has arrived! It's getting the attention it has always deserved.
Out of all the "hack attempts" in the last 2 days my works network has had about 95% IIS hack attempts with the rest ssh/rpc probes or anonymous ftp attempts (which could be to exploit either OS or just someone looking for pub ftp sites).
This info courtesy of snort.
While usually we do have slightly more ssh/rpc attempts than this the amount of IIS exploits is never less than 75% of all the breakin attempts we have. I'd attribute most of these attacks to worms.
Hardly scientific I know (unfortunately the snort box was reinstalled 2 days ago so I can't give many figures except from memory) but in my opinion the article is wack.
Remember, folks, all buffer overruns have been fixed in Microsoft code. Why, Bill Gates said it himself.
Nearly everywhere (including Slashdot), I see people bitching about "Linux zealots who blindly attack Microsoft".
But now, it turns out to be the opposite: the majority (Microsoft fanboys) are actually attacking Linux! People blindly believe the "Linux users are all zealots"-FUD, so the Linux-hatred is growing rapily. It's only a matter of time before it's bigger than Windows-hatred.
How ironic...
People bitching about Linux users complaining, while actually the opposite is true.
This is one of the problems and one of the benefits that linux is open source. The bad thing is that hackers can see the weaknesses in the code and exploit them. The good thing is that users can help fix the faulty code, and patch the error, unlike in windows, where microsoft usually is the one to "patch" the vulnerabilty.
The source of the data is supposed to be the "mi2g SIPS database", about which they say:
(Do you need me to toss in some editorializing about how this is evidentally a company that specializes in publishing alarmist press releases to encourage people to buy their products? Oh, and take a look at key clients... yup, includes Microsoft).
Agreed. All I ever see in my logs (FreeBSD machines all of them) are script kiddie trolls looking for Microsoft machines, and of course the usual Code Red stuff. FWIW Code Red attempts are up by 30% on the machines I look after.
And only 1 out of 10 email messages to the IP block owners admin or ISP abuse department ever gets acknowledged.
This isn't the first time mi2g have claimed that attacks on open source systems are on the increase, there's a 15 May article on VNUNET itself. It's also not the first time they've made big statements of this kind, a quick Googling will reveal that. What I want to know is which security groups are corroborating these statements? I've only really seen them from mi2g.
Have you ever looked through a Snort log, for example, after a box has been running for a few days? In many cases, I don't think you could tell if it was a sentient attack or not (Code Red, on a kiddiot typing away in IE?) I'm guessing that they filtered out false alarms, and just compared logged incidents to the OS running on the server. Or, it could be that some of these are defacements that were reported. That would probably make it easier to tell.
I second this.
I don't bother to look at the authors, but VNUnet is a massive source of IT doom and gloom. They twist the facts such as to pose the news in a completely negative light, regardless of whether that makes the whole story and worthless and inaccurate.
Oh no! The World will end tomorrow as a result of a flaw found in Apache [doesn't mention that it's difficult (impossible?) to exploit under Linux/Solaris, the two main web server OS's, of course]. May God have mercy upon our souls!
Mattel, SLAPP terrorists intent on destroying free speech.
FUD and marketing tactics from the third party antivirus and firewall makers that fear losing business because more people are moving away from Micky$oft's vulnerable kludgeware...
I'm nor suprised at this at all. I would expect the rate to continue to climb. We will likely see Linux as the #1 target very soon. But I guarentee you will also see no decline in actually breakins or virus infections in WinXX. The only real problem the Linux world will see is the same problem that is at the heart of all secrutiy breakins; lack of updates & errata kept curent.
--
If I actually could spell I'd have spelled it right in the first place.
Which DOS did Microsoft make Win3.1 incompatible with?
Didn't Microsoft spread FUD claiming GPL is viral?
Fight Spammers!
Yep. That's called spin, and MS is getting better at it. Or sneakier, depending on how you look at it. Palladium, anyone?
I'm sure a lot of the slashdot crowd knows about security updates, firewalls, and TCP SYN flags, but remember that there are a lot of folks out there that don't have a clue what any of this means. These clueless folks are the same newbies that are installing an arbitrary distribution onto an old box and promptly plugging that box into their cable modem.
The next time you introduce a friend to linux, be sure to give them a rudimentary security lesson and make sure they are installing security updates.
I think cracking Windows had gone down because the
crackers aren't having any more fun and they want
a challenge.
I find this especially humorous: I've run variants of 95, 98, ME, NT 3.51, NT 4.0, 2000, and XP since August 31st, 1995, and I have never had my machine compromised (nor have I ever had a virus for that matter). A friend, a heavy Linux advocate, has had his Linux box rooted _3_TIMES_. I realize that in both cases we're probably outlyers in the sample spread, but your sample cases are ridiculous.
is it possible that this is because a remote linux machine is more useful than a remote windows machine?
--this is totally unrelated to your post, except your analogy, where it's almost exact. There's a great old movie out there you need to rent and see, called "soldier of the king". You just might enjoy it.
The reason for this is so obvious. A lot of these attacks are done by people in the MP3/warez scene looking for places to distribute their stuff. What good is a Windows machine? Absolutely none! There's no easy way of logging in to it remotely, and even if you can, there are hardly any programs to run.
The combination of Windows and Outlook is riddled with issues. Attachments shouldn't appear to be one data type but actually be malicious executable code (due to Outlook's desire to hide file extensions and how it handles conflicts with MIME types and extensions). But say our users treat all attachments as plague-infested rats and refused to touch them. Past vulnerabilities have meant that simply READING a malicious email (and/or having it displayed in the preview panel) executed malicious code. Yes - the age-old joke about "don't read email called 'fun time'" became reality. Outlook, and its incorporation with Windows, has created a very virus/trojan friendly environment. If it weren't for the excellent scheduling features of an Outlook/Exchange combination, it would likely be dropped from any security-conscious corporate desktop.
Windows systems themselves are an interesting challenge. We'll ignore the fatally flawed Win9x architecture and focus on the industry favorite NT/2k/XP. The very tools that should help an administrator keep his/her system safe has gained a certain degree of fear over the years - service packs and hotfixes have been known to cause more trouble than they fix. WinNT administrators tend to delay rollout of new service packs until they feel comfortable all bugs have been discovered by early adopters. Any system configuration (adding or removing system software components) often reverse changes by service packs, hotfixes, and administrator configurations and requires re-application of those changes. The infosec standard of hardening a host by removing all unnecessary components is foreign to the Windows environment. Windows system components are rarely designed to be removed and attempting to remove them means traversing a minefield of illogical dependencies - thankfully there are a few good minefield maps in the form of hardening guides. Of course, keep the guide close at hand. Any addition or removal of system components, hotfixes, or service packs will mean re-applying the hardening process.
In short, Windows was not designed with good security principles in mind - and it shows. It IS possible to configure a secure Windows host (assuming vulnerabilities are patched in an expedient manner). But its a pain.
...even script kiddies think so.
They are "owning" Linux boxes because Windows doesn't offer any decent DDoS software nor can it compile their exploits easily.
That article is a waste of time.
- They fail to define an "attack".
- They fail to scale figures for deployed boxes (i.e. twice as many OSS web servers should get twice as many attacks).
- They deride OSS admins for slowly applying patches without looking at the closed-source admins.
- The article has a popup window ad. Death to them!
Also, nimda and code red scans are attacks. If those got counted, allong with every virus email, the story would be very different.
If you were given the IP address or a vulnerable WinXP box, a vulnerable Linux box, and a vulnerable OpenBSD box and your life depended on owning one of the boxes without getting detected, which one would you chose given no other information? Only the suicidal would pick OpenBSD... the probability of there being another OpenBSD dedicated IDS box nearby is pretty high.
Let's not forget that a Linux shop can do a minimal install on a retired PII (or maybe even a 486) server and use it as a dedicated IDS box... no MS liscence fee. MS isstill goingto charge you for every running x86 box, regardless of OS, if you have an MS site liscence, so no negligible-cost dedicated IDS boxes for Windows shops.
I'm biased. I sure am... but it's mostly due to experience... I was a residet computer consultant for my fraternity for 3 years. Sure we had the one guy that talked another guy into trying out Mandrake and didn't bother to tell him to keep it up to date, but for the vast majority of the Brothers, the Linux guys could hold thier own. Several of the Windows guys were accidently running "Are you sure? What is IIS? Why is that bad?". And then there were the windows alerts popping up once per minute on all of the Win32 boxes in the house because one guy decided to test his UPS. These are very smart guys, but they gave me a vey bad impression of Windows users. I doubt the general populace can do better than my fraternity.
(Yes, the house GPA was in the 75th percentile fr fraternities and the average fraternity GPA is above the on-campus GPA at MIT. Even the management and bio majors could kick your ass in diferential equations, so no "stupid drunk frat boys" comments. They get tiring... very very tiring... especially comming from people that can't integrate thier way out of a paper bag.)
In summery, let's not forget that Linux and Windows often get deployed in very different environments.
Copyright Violation:"theft, piracy"::Anti-Trust Violation:"thermonuclear price terrorism"<-Overly dramatic language.
One thing I know from working with kids is that they love to fight (or atleast play fight). Computer fighting seems pretty cool and harmless to kids (even if it takes out your business server out, a kid would not naturally assume this is a problem). Being alittle more computer savvy than your friends means that you win the fight, and are thus cooler/more manly than your friend.
Well Linux is considered more l33t than Windows, and its getting extremly easy to use. Kids will think they are VERY computer savvy by installing Linux, and a computer genius for using someone elses program to do a simple attack. Once one kid gets Linux installed they will install Linux on their friends machines. Since Linux is free, there are no barriers to entry, and it will spread rapidly the easier it gets to use.
So all I can say is, I plead you Slashdot Community. Make your GUI's impossible to use, create lots of undocumented features, have your programs be buggy unless your users are using the most difficult to use distribution of Linux.
I mean really, won't someone please think about the children?!
Rob
--I'm one of those linux newbies who is appalled at the lack of security with linux, and the difficulty of setting up an effective firewall. All I hear is how easy it is, to me, it's pretty dang hard. I just spent an hour earlier this morning seaching fereshmeart for an easy to use GUI firewall interface I can use. I have one now-but I'm not sat8isfied with it and I'd bet a nickle I am hacked/cracked right now as I'm typing this. I even downloaded the GUI prog, put it on floppy, reinstalled the OS-RH 7.2-, installed the interface, then got online and still got problems. I can see outgoing packets on my external modem. I'm not a "server", all I want to do is surf the web, listen to netradio, normal easy simple stuff like that. I will admit to being completely a non programmer. Near as I can see, you need to be an ubergeek with linux to actually *have* any security. The replies so far on this thread with guys who claim to be secure, you can tell they are uberusers, probably professionals. HOW is a newbie supposed to get there without all that training and experience? Not use your computer for the internet? Back to using windows or mac for months until you can use linux? Why would anyone even consider doing that if theyweren't running a pro level server, or HOW could they do that with a normal single home box? Like, what's the point, if you have a machine that's working, why would you spend months struggling to make something else work, the fun of reinventing the wheel? an apple or microsoft CD just doesn't cost that much if you look at hundreds of hours of intense skull sweat to save 100$.
This sort of reasoning applies to 99% of the hooman beans out there, they won't care, they'll pay apple or microsoft the 100$, they just will.
This catch 22 is nutso. I posted on the other "top 10 linux problems" thread running as well, to me, LACK of out of the box and EASY to use security will drive more people away from linux. Just faking them out that they have security by checking "high security" on install and running those "firewall wizards" that really don't work as advertised is causing the problems. It's time for the linux "community"-whomever that is-to come clean on actually how difficult it is to maintain even minimum security. It is NOT easy, it DOES require a professional level of command line expertise. This is the ONE serious lack in all the thousands of linux projects ouyt there, the lack of a firewall that isn't betaware hell, one that doesn't require complete command line mastery.
Above, IMO, of course. Personally, I'm waiting one more RH release, whichever the new one is gonna be 7. whatever or if they really make it 8.0. I'll try that one, purchaisng from a clone cd place. IF it works and it has security, I'll buy redhats version at full price and support them. I'm not interested in trying other distros anymore, I tried mandrake and after a week it would never even dialout for me. My opinion is that if the biggest, best named well known linux company can't release something that works on the desktop for joe average homje user, no way will the little companies be able to pull it off, they will become the hobbyist dead ends they are now, except for the server/embedded market, which is what? 1% of computer sales and users, or less?
Bottom line, if linux don't care about me and the other 99% of us out here in normal user land, if our interst and money ain't appreciated, with our concerns, then we probably won't care about you either, no harm nor foul, just don't expect much more cash. The landlord, the grocery, the gas station all run on cash. We don't mind dropping cash on ease of use and security. I'll just re-switch my cash back to where it's been the past decade and a half, back to apple, because my time is worth it. At minimum wage, trying to setup security and reloading the os and searching google I spent more than buying 10 copies of apple or microsoft so far, or some such large number, lost track now..
on the community here at /. I expect the following opinion to be unpopular, but you never know.
No matter how disgusting MS's business practices are, they are still not the evil side in this story. The script kiddies are. So why are we spending so much time blaming MS for this story? I could care less if MS financed this story. I could care less if I am still getting Code Red attempts daily on my machines. What I do care about is that everyone on the internet, even those people running MS products, is secure.
The biggest problem we have on the internet from a security standpoint is ignorant users. The fact that we still get code red attempts shows that this is a huge problem.
MS seems to be a bit more ahead on the curve when it comes to this (somewhat...I'll say more about this in a minute). In Windows XP, the OS will check for critical updates automatically, and will either download and install it by itself, or let you know that it is available. (This depends on how you set it up. You can also have it not do this behavior, and are given the choice to decide when you get on the internet for the first time.) I personally think that the default behavior should be to autocheck and notify, with options to turn it off buried somewhere. This would help protect the ignorant, while giving the choice to those of us who know more and are willing to do more with our OS to make our own choice.
Of course, MS is also very slow at putting out security patches, and there is NO excuse for that.
We will see more problems like this in the future. No matter what anyone says, Linux is not exactly as user friendly to the average Joe as Windows is. So while it may be more secure OOTB, as new exploits are discovered we will run into more and more problems because average Joe will not know that there is a new security hole on his Linux box. I can imagine quite a few of you will try and blame this coming problem on the average Joe, but remember....the customer is always right. If average Joe doesn't feel like subscribing to a security mailing list and sifting through a tone of email a day, he shouldn't have to. And we shouldn't expect him to want to do that, anymore then average Joe should expect us to like Celion Dion.
So we should do something about this now, before it gets out of hand. Make the default action for a desktop Linux setup check for security patches and notify, with a dire warning that will scare the bejeebus out of average Joe. Make it pretty easy to turn off for those of us with a bit of knowledge. Keep pumping out patches. But make sure your average mouth breathing computer user can install the patch, without worrying about dependencies and without having to type anything. Point and click is their friend, even if it isn't necessarily ours.
That is what we should be doing. Let's clean our own side of the street first, and worry about blaming MS for another thing later.
BTW, I still see attempts by rootkits from Linux boxes daily, and these are (like the Code Red attempts) caused by boxes that are unpatched against security holes that have been fixed for a very looong time.
Stupid, stupid article. No one knows how many attacks there are. The numbers are entirely nonsense. My guess is that whoever wrote that saw some way to make money by saying it.
mi2g is a company that makes more money if you think the sky is falling.
Many more stories like that, and Slashdot will stop being popular.
The article says, "But attacks on Windows/IIS systems have already dropped by 20 per cent on last year's figures, from 11,828 to 9,404."
My guess is that attacks occur about 20 times per hour for each IP address. That's how computers are rooted within 25 minutes of connecting to the Internet; there are continuous attacks to find weaknesses. That's how many I see, anyway.
That number cannot be the number of successful attacks, either. Most people who are rooted do not report that fact to anyone. Many Windows users would not even know they have been successfully attacked. How could they report it?
Change in subject: At the top of every article, it says, "The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way."
This sounds like you own your comments, doesn't it? However, the OSDN Terms of Service says at section "4. CONTENT", paragraph 6,
"In each such case, the submitting user grants OSDN the royalty-free, perpetual, irrevocable, non-exclusive and fully sublicensable right and license to use, reproduce, modify, adapt, publish, translate, create derivative works from, distribute, perform and display such Content (in whole or part) worldwide and/or to incorporate it in other works in any form, media, or technology now known or later developed, all subject to the terms of any applicable Open Source Initiative-approved license."
The contract is written in such a way as to appear that it has been made intentionally confusing. However, it looks like "comments are owned by whoever posted them" means that, yes, you own the intellectual property you created, but VA Software Corporation owns it too.
This appears similar to owning a car, but under the condition that someone else can use it at any time, and without notifying you. In any case, The Fine Print is misleading; it is not all of the fine print, although that line at the top of each story certainly encourages you to believe it is.
I don't know about Internet attacks, but we are seeing a rise in the number of sneaky contracts. This seems due to the presence of people with no technical knowledge at technically oriented companies. These people cannot contribute to the real work of the companies; all they can do is invent ways to abuse the customer.
EULA: I've been studying their methods, and I have a sneaky contract of my own. I agree to VA Software Corporation's sneaky contract if they agree to mine: At any time of my choosing, VA Software Corporation will give all managerial and financial control of the company to me.
Obviously... more people are using linux than windows now to run their useful servers. Why would anyone want to attack a worthless win95,98,98se,xp,me computer when there's a juicy unpatched linux box sitting right there, with all the guts and glory?
Think about it... its probably not a good thing in MS' eyes.. at least it shouldn't be..
We have two operating systems, and their associated applications, implemented in unsafe languages, with broken and/or archaic security models, competing for how many weeks they can run before getting rooted by a new exploit.
How pathetic.
Mea navis aericumbens anguillis abundat
Maybe I wasn't paying attention enough when scanning the comments so far, but I don't think I've seen this. What'd be more fun to play with and/or be more useful after you've hacked it? A linux box or a windows box? It's like deciding whether to go after a piggy bank or a bank vault. Thicker crunchy outside perhaps, but a creamy center that is several orders of magnitude yummier...
In 1999, an Elvis Impersonator died from living the good life. Today, there are three Elvis Impersonator Impersonators. If this trend continues, in 2009, there will be 65535 Elvis Impersonator Impersonators.
Maybe the attacks on Linux machines are increasing, because there are more Linux machines running or supporting critical IT infrastructure. IT engineers may be replacing old NT boxen with Linux machines.
Unfortunately this puts Linux in the security spotlight. More exploits will be found and patched (which is a good thing), and the public nature of linux security information may be exploited and used against the Linux community.
Nobody kicks a dead dog.
Think about the hacker mindset for a minute. Most of these attackers are using Linux, because that's what their scripts were written for, and because they think Windows is lame - to use, and to hack. Even most of the ultra-successful defacers out there will only attack Unix systems and network devices/appliances these days, because bragging about hacking into a Windows system isn't elite in the eyes of their peers; they will catch shit from their buddies for attacking such an easy target.
If anybody out there is as clueless as this troll, please e-mail me your questions. I'm in the trenches with these kiddies 24/7 and can give you a better idea of what's going on than most nerdy bugtraq subscribers who think they know shit because they read some mitnick autobiography and they run an unstable kernel.
The article reads to me like analyists out looking for new business. Maybe every major user of MS server software is already employing a security consultant so there's litttle market potential for growth. So the company grab some stats to make it look like there's an explosion in attacks on linux, show the stats to managers, not the IT department, and then get a nice consultancy fee to come in and tell IT that they should run red-carpet every day to check for upgrades.
MS made it so easy to install patches, it ridiculous. You can either go to windowsupdate.microsoft.com and let it figure out what patches to install or you can just run the automatic update in your systray and it will scan updates for you automatically.
The only thing you have to do is reboot your computer.
Live web cams
Topic: "More Attacks on Linux than Windows"
Content: "If the trend continues, by the end of the year, attacks on Linux systems may surpass attacks on Windows systems".
Anyone more than me that thought that Linux had more atacks than Windows?
Beware: In C++, your friends can see your privates!
In another "survey" I wrote on the toilet today, statistics suggest honeypot servers running Linux are significantly more likely to be attacked than IIS servers!
Sorry, but this report is so lacking in facts or sources that it might as well have been a conversation overheard in a pub. In my server logs here, the number of IIS exploit attempts is absolutely overwhelming! In other server's I've administered this is also the case. Sorry, I smell FUD...
Code, Hardware, stuff like that.
... and anyone running a webserver can tell you.
/default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858% ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%uc bd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531 b%u53ff%u0078%u0000%u00=a HTTP/1.0" 400 318 /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858% ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%uc bd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531 b%u53ff%u0078%u0000%u00=a HTTP/1.0" 400 318 /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858% ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%uc bd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531 b%u53ff%u0078%u0000%u00=a HTTP/1.0" 400 318
66.100.173.242 - - [13/Jul/2002:07:46:32 -0700] "GET / HTTP/1.1" 400 373 /scripts/root.exe?/c+dir HTTP/1.0" 404 276 /MSADC/root.exe?/c+dir HTTP/1.0" 404 274 /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 284 /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 284 /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 298 /_vti_bin/..%255c../..%255c../..%255c../winnt/syst em32/cmd.exe?/c+dir HTTP/1.0" 404 315 /_mem_bin/..%255c../..%255c../..%255c../winnt/syst em32/cmd.exe?/c+dir HTTP/1.0" 404 315 /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c 1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 331 /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 297 /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 297 /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 297 /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 297 /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 281 /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 281 /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+d ir HTTP/1.0" 404 298 /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 298 /scripts/root.exe?/c+dir HTTP/1.0" 404 276 /MSADC/root.exe?/c+dir HTTP/1.0" 404 274 /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 284 /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 284 /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 298 /_vti_bin/..%255c../..%255c../..%255c../winnt/syst em32/cmd.exe?/c+dir HTTP/1.0" 404 315 /_mem_bin/..%255c../..%255c../..%255c../winnt/syst em32/cmd.exe?/c+dir HTTP/1.0" 404 315 /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c 1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 331 /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 297 /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 297 /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 297 /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 297 /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 281 /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 281 /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+d ir HTTP/1.0" 404 298 /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 298 /scripts/root.exe?/c+dir HTTP/1.0" 404 276 /MSADC/root.exe?/c+dir HTTP/1.0" 404 274 /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 284 /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 284
193.6.9.33 - - [13/Jul/2002:01:08:20 -0700] "GET
64.164.89.42 - - [13/Jul/2002:03:25:23 -0700] "GET
217.10.221.190 - - [13/Jul/2002:04:04:44 -0700] "GET
66.100.173.242 - - [13/Jul/2002:07:46:34 -0700] "POST / HTTP/1.1" 411 359 64.65.244.2 - - [13/Jul/2002:08:13:08 -0700] "GET
64.65.244.2 - - [13/Jul/2002:08:13:09 -0700] "GET
64.65.244.2 - - [13/Jul/2002:08:13:09 -0700] "GET
64.65.244.2 - - [13/Jul/2002:08:13:10 -0700] "GET
64.65.244.2 - - [13/Jul/2002:08:13:10 -0700] "GET
64.65.244.2 - - [13/Jul/2002:08:13:11 -0700] "GET
64.65.244.2 - - [13/Jul/2002:08:13:12 -0700] "GET
64.65.244.2 - - [13/Jul/2002:08:13:12 -0700] "GET
64.65.244.2 - - [13/Jul/2002:08:13:12 -0700] "GET
64.65.244.2 - - [13/Jul/2002:08:13:13 -0700] "GET
64.65.244.2 - - [13/Jul/2002:08:13:14 -0700] "GET
64.65.244.2 - - [13/Jul/2002:08:13:14 -0700] "GET
64.65.244.2 - - [13/Jul/2002:08:13:15 -0700] "GET
64.65.244.2 - - [13/Jul/2002:08:13:15 -0700] "GET
64.65.244.2 - - [13/Jul/2002:08:13:16 -0700] "GET
64.65.244.2 - - [13/Jul/2002:08:13:16 -0700] "GET
63.207.103.80 - - [13/Jul/2002:11:32:10 -0700] "GET
63.207.103.80 - - [13/Jul/2002:11:32:12 -0700] "GET
63.207.103.80 - - [13/Jul/2002:11:32:13 -0700] "GET
63.207.103.80 - - [13/Jul/2002:11:32:14 -0700] "GET
63.207.103.80 - - [13/Jul/2002:11:32:15 -0700] "GET
63.207.103.80 - - [13/Jul/2002:11:32:16 -0700] "GET
63.207.103.80 - - [13/Jul/2002:11:32:17 -0700] "GET
63.207.103.80 - - [13/Jul/2002:11:32:18 -0700] "GET
63.207.103.80 - - [13/Jul/2002:11:32:19 -0700] "GET
63.207.103.80 - - [13/Jul/2002:11:32:20 -0700] "GET
63.207.103.80 - - [13/Jul/2002:11:32:21 -0700] "GET
63.207.103.80 - - [13/Jul/2002:11:32:22 -0700] "GET
63.207.103.80 - - [13/Jul/2002:11:32:23 -0700] "GET
63.207.103.80 - - [13/Jul/2002:11:32:24 -0700] "GET
63.207.103.80 - - [13/Jul/2002:11:32:25 -0700] "GET
63.207.103.80 - - [13/Jul/2002:11:32:26 -0700] "GET
63.207.103.80 - - [13/Jul/2002:12:19:45 -0700] "GET
63.207.103.80 - - [13/Jul/2002:12:19:48 -0700] "GET
63.207.103.80 - - [13/Jul/2002:12:19:52 -0700] "GET
63.207.103.80 - - [13/Jul/2002:12:19:56 -0700] "GET
Bear in mind that is an unedited log. Over 70% of requests for documents on my webserver are attempted IIS exploits. Are Linux attacks on the rise? Sure, maybe, but as long as there are infected Windows servers worming their way around, Windows attacks will also be higher.
If I were inclined to burgle, I would certainly prefer the bust into the house that has all the cool gear to play with then to spend my time breaking into the dog house in the back yard. No?
In 10 years when all servers are Linux there will be more attacks on Linux than anything else. Or something like that.
So what?
How many are successful?
The reason that the attacks on Linux machines are on the rise is probably because the vast majority of Linux users have taken very well thought out precautions against such attacks.
Windows has almost gotten broing with the huge string of attacks that have been plauging North America for the last couple of years and I think that many of the hackers out there are looking for something challenging to crack; i.e. Linux.
"Truth suffers from too much analysis." Frank Herbert, Dune Messiah
What? Besides the fact that /. is pro Linux anti everything else?
Comment removed based on user account deletion
How were the results of the study obtained? It could be that Windows admins are simply less aware of attempts to compromise their machines than their Linux counterparts.
the ironic thing about your comment is that c#'s original name was c-- (you have to type cminusminus to google it properly, I think), which was, in part, a non gpl'd alternative to gcc's intermediate code system (ie. the way the GNU Compiler Collection uses one comiler for all the languages it supports, and they all compile to the same intermediate code). c-- was designed to be a better core language to use as a base language to code ontop of- ie. a non gpl'd version of gcc.
Microsoft changed c--'s name to c# for marketing reasons.
...and this lie crawls out of its mouth: 'I, the state, am the people.'
Go to http://www.vmyths.com and search for mi2g under RANTINGS.
Credibility is not their strong point.
Alright, aside from the facts the following statments people are making:
A) Linux use is growing
B) How many of these were really successful attacks?
C) What counts as an attack?
D) Studies from the group which conducted this one are questionable.
Clearly people are neglecting to give MS credit for some of it's accomplishments over the last year. One of the largest changes was the speed at which updates were made available and most of these through the windows update site. Now when new holes in their products were found, MS responded for the most part almost immediatly and patched up their code within hours/days and posted it up on for everyone to download. Also, they're working on making these updates even easier than before, anyone with windows 2000 who keeps on top of patches will notice that the interface has changed, you can set it to automatically apply security patches. Also another point is that people are finally realising that their computer will be far more secure if they just apply the latest patches.
Holes in Linux are not always patched up right away and lets face it, Linux code warriors can't always respond to a patch for each distro when ones found like MS can or distribute it as easily. Because they're a single entitiy, they have quite the advantage when it comes to communication and distrobution.
In the last year Microsofts efforts to patch up their software were far and beyond anything they have done in the past, and that is something Linux buffs won't easily admit to. Now, Palladium is a whole nother ball game mind you =)
I will agree with you that ipchains/iptables are great firewall apps. However, I do not agree that win32 personal firewalls are bad.
My laptop is equiped with a winmodem. As such, I have a choice between no internet access, purchacing an external modem, using win32 unfirewalled, or using a win32 firewall. My choice, based mostly on convenience, is to use Norton Firewall. It detects and logs a lot of attacks. All the attacks are sorted and identified by the port that was probed. It even tries to identify the attack that is associated with that port.
For a non-technical user, it is a great program. It has charts, graphs, and logs that are easy to understand. It will even provide nonintrusive popups for attacks in real time. I think that, from a desktop POV, linux developers could learn a lot from taking a look at it.
I'd rather you do it wrong, than for me to have to do it at all.
I don't trust any report that uses the phrase "hack attack". At least "information superhighway" seems to have been eliminated from the English language. ;)
"Quoting famous computer scientists out of context is the root of all evil (or at least most of it) in programming." - K
This is just an inherent weakness of Linux, Open Source.
The type of attacks perpetrated on Linux are typically of a general class, off-by-one, buffer overflows, privalege separation issues, etc. When a general class of vunerability is discovered in an application or protocol, it typically takes idividual patches for each appication at different times to get it closed up.
Microsoft is a unified enitity. Microsoft engineers communicate with each other, and are coordinated by a central managment.
Open Source developers rarely communicate amongst themselves.
care to back that up at all? I don't know the guy from a hole in the head, but those are some pretty nasty allegations to throw around w/no evidence behind them...
I've been running IIS -- and unix-based web servers for about 5 years. Our IIS boxes have NEVER been hacked. We had disabled .htr and other mappings long before Code Red emerged -- as MS had advised. The fact is, 90% of all of the Windows vulnerabilites have been fixable with permissions and registry modifications. Keeping patches up to date is a pain, but not impossible.
Without a doubt, MS has a lot to learn about security, but tools such as URLScan and the like have made it much easier to lock down an IIS server.
It's also worth remembering, that as an application server, IIS has the ability to do a LOT out of the box (COM, ASP, ISAPI (and outdated vulnerable technologies using HTR). In any case, can not compare IIS with Apache -- you must compare it with Apache + Tomcat + Turbine, etc.
Is this sig nificant?
Perhaps you haven't been following the remote Apache worm that's been going around lately?
10 PRINT CHR$(205.5+RND(1)); : GOTO 10
If not, you're vulnerable to a worm that's been going around that is similar to Code Red (hijacks your server and turns it into a DDoS platform). I know at least 4-5 people who were hit by this in the 2 days it took the fix to get into security.debian.org.
10 PRINT CHR$(205.5+RND(1)); : GOTO 10
My Linux box reports a number of attacks against the FTP server and Apache each day
Perhaps the reason Linux gets more attacks reported is that Unix has very good logging and nix admins actually read their logs and report attacks. I knew some Nt administrators even in very big operations that never read their log files. Personally I thing the the script kiddies just scan and hit whatever they can. A linux box might be more useful once the it is compromised, but that is another issue.
Could Jesus microwave a burrito so hot, that he himself could not eat it....HS
It's been my experience that the skill of the admin for the box (and management's willingness to let the admin do his job) has much to do with the security of the box. A good Windows admin (if you can find one) will have a more secure box than a lousy *nix admin. (If both admins are equally good, I'd bet on the *nix over windows any day.)
IMHO, Mandrake has a good idea for their install. At the end of the install, before any servers are turned on, it prompts you to update if you have an internet connection. This feature adds security relatively painlessly.
I see a lot of post here, and hear a lot of apache admins go on about their logs filling with attacks from CodeRed, Nimda, etc (which obviously get no where)
So my thought is could the increase of attacks on linux box be beacuse most(all?) the MS boxes are infected drones, all attacking every IP they see?
and thus more linux boxes get attacked.
I know it an extreme view, but a Nimda drone attacking an apache box, although pointless, is still adds to the statistic of more linux boxes being attacked
There is no challenge in hacking something (Windows) that is already well known for its insecurities.
It makes about as much sense as trying to score with the prom queen even after she's scored with the entire football team--yeah, I could do it, but where's the challenge?
Disco Stu: Disco sales are up by 500%. If this trend continues, BAM.
Thats all I could think of when I read that.
An 'anonymous coward' said: care to back that up at all? I don't know the guy from a hole in the head, but those are some pretty nasty allegations to throw around w/no evidence behind them...
There have been 2 other cases where articles by this guy on VNUNET were clearly wrong, too far wrong for casual error. One of them sprang from the (ill-considered) statistics posted at securityfoucs.com that compared the counts of windows and linux vulnerabilities. But the linux vulnerabilities included applications and the windows numbers did not. securityfocus.com clearly stated that fact. Also, each linux vulnerability was counted each time it occurred in any distribution, causing multiple counting of many of them. Middleton did not mention either of these facts, simply using the raw numbers to imply that windows security is better than linux.
The other case was equally egregious. Its headline was "Hackers turn on open source", with a lead paragraph saying the same, but with no clear data backing it up. In fact, the article referenced an increase in website defacements, then noted that 'virtual websites' where many sites are on one machine, were involved, thereby rendering the statistic fairly useless.
This guy is hack, or worse. He's already had too much benefit of the doubt.
"that's not encryption - it's a new perl script that I'm working on..." - from some Matrix parody
the trend continues, by the end of the year, attacks on Linux systems may surpass attacks on Windows systems. It is the Seattle Mariners fault, if they had not had "Bat Day"(Get a Free Bat) on the same day that Bill Gates paid admission for any MS employee going to the game, this would not have happened.
Both of these stories are availability via linuxtoday.com, BTW. If you go to vnunet.com, please use a browser with image-loading turned off (mozilla, galeon, lynx, links, w3m). No point giving the advertisers of these morons any hits.
"that's not encryption - it's a new perl script that I'm working on..." - from some Matrix parody
Maybe that's because there are MORE Linux boxes out in production than there were a last year and people are starting to drop IIS because of the security nightmare it is?
Think about what happened last year....Code Red abused IIS servers to death and sysadmins started realizing that Linux/Apache was a viable alternative, what with the kernel networking code improvements it got in 2.4.x, (or was that 2 year ago?) not to mention the publicity Linux has been getting increases every year.
Not exactly a profound leap of logic to make this deduction.
This message brought to you by the Council of People Who Are Sick of Seeing More People.
More Attacks on Linux than Windows
AND
If the trend continues, by the end of the year, attacks on Linux systems may surpass attacks on Windows systems.
is FALSE
I can't see the correctness of the subject line. It should say "More Attacs on Linux than Windows... um, maybe... in the future.."
Although I agree with you on the first item I am surprised by the comment in support of the terrorists is Russia.
With Windows there is one attack per host, death afterwards, so what one has to look at is how many attacks per minute on the same host between down time.
I have had "scratch" Linux machines (i.e., ones that I didn't care about) broken into. One via a "lpd" buffer overrun remote-root exploit, and one via a similar nfs exploit.
I've *NEVER* had this happen to a Windows machine.
Of course, machines I care about are behind a hardware firewall that blocks EVERYTHING (including ICMP/ping).
The worst problem regarding security is probably the fact, that today's mainstream processors mix up code, data and adresses in memory without being able to distinguish between these categories.
You can put anything (even some characters of input from the keyboard) into memory and let the computer use it as a memory address - and this is really a very, very bad architecture.
If an attacker could only modify data by exploiting buffer overflows instead of being able to put additional code on your machine and to execute it, his or her possibilities would be much more limited.
Most secure operating systems can't prevent a security breech within an application, but are still able to prevent access to the OS itself, to other applications or to sensitive data. This is done by strictly following the 'principle of least privilege', which mainly means that you do not run any process with all-powerful root privileges.
(Take a look at Argus' homepage for more information about secure Unix kernels with authorizations/privileges instead of 'root')
IBM invented a technology which would be suitable for protecting the system from unintentionally modified addresses, almost 20 years ago (in the System/38).
We definately need better processors and better operating systems.
A short summary of methods to prevent from buffer overflow exploitation:
* If a process CALLs a subroutine, the return addresses shall become pushed onto the stack and marked as a 'valid address' in some kind of shadow memory (if you have 64bit long addresses, you need 128MB additional memory as the shadow RAM for each 1024MB RAM).
* If some piece of data is MOVed to memory, then the memory region shall become marked as 'non-valid address' in shadow memory.
* If a processor tries to fetch an address from a memory region which is not marked as 'valid address' then the processor shall raise an exception (interrupt) to inform the operating system about the invalid pointer.
* Shadow memory shall only be accessible from the highest privilege level (that is, from kernel mode)
* User mode processes shall not be able to use OS APIs in order to mark modified addresses as 'valid address' unless the user process has the privilege to use the API.
* There should be a privilege which causes the OS to ignore invalid pointers and resume execution of a user process, in order to ensure that even very old programs (which use pointer manipulation without correct casting, etc.) can be used.
Unfortunately, there is almost no information on the net about hardware pointer protection, so you will possibly need to look into Frank Soltis' book "Inside the AS/400" to get very detailed information.
Inside the AS/400, Frank Soltis
Isnt that ironic? :)
http://securityportal.com.ar
I mean, to me, a shell exploit isn't that bad, and I guarantee you a significant number of Linux exploits are shell users rooting a box, not some script kiddie on the Internet owning your box cuz he knows the IP address. Windows probably doesn't have many local exploits, due to the architecture. I'd take 10 local exploits vs. one remote one.
...for a web dev position with cross training to network security (which I was, and still am, very interested in.) This was in 1998, IIRC. The head geezer is one D.K. Mattai. He told me they did consultancy for a lot of City (financial) firms, including info-sec work, and that I'd be paid a small basic (about 20K IIRC, not much even then) with substantial commission on any sales I made. Between the man himself, his dodgy "lounges" microsite idea (he wanted a "carlounge" site, a "videolounge", etc, but had dodgy ideas about advertorial as a revenue stream), the very non-technical, "hobby job" feel of the place (I only met him, and saw little evidence of anyone else using the rather flashy offices in Battersea - right on the Thames in fact, not a cheap location!)... just weirded me out a bit. I remember walking along the embankment afterwards, looking at the sun on the river and thinking "I know I hate Logica, but I'm not sure I trust this set-up - in fact I don't think I'd take it if he offered me the job." He tried to pressure me into signing up on the spot, too, IIRC. Oh yeah, and he thought NT4 and IIS were the bee's testes for secure servers.
Anyway, over the next four years or so I kept coming across sitings of him in Need To Know. Search for mi2g or "D.K. Mattai" and you'll see what I mean. He puts up some new FUD release every six -12 months, and presumably reaps some consultancy fees from the credulous and ill-informed. The other day I saw he'd even got himself onto the BBC with some nonsense "survey" about virus attacks by Al Qaeda... before that, it was anti-globalisation
protesters who were going to make the sky fall.
In short: nothing to see here, move along please.
"None are more hopelessly enslaved than those who falsely believe they are free." -- Goethe
Does Nimda trying to propogate itself count as an attack?
Here's a good piece on Vmyths about mi2g. They're full of it. I wouldn't be surprised if the entire "report" was based on a sample of two machines. On a home network. With an inquisitive teenager around :)
"None are more hopelessly enslaved than those who falsely believe they are free." -- Goethe
I've seen too many newbies laughed at in the IRC #security channels or the newsgroups.
I totally agree! I used to hang out in the linux* IRC channels to help people quite a lot, but became sick of all the bitching and script kiddies kicking anyone who didn't run their preferred version of Linux (anyone mentioning they ran RH was usually banned for some reason), or trying to start arguments by giving obtuse or antagonistic replies to questions. That sort of bullying is not anything I want a part of, and does Linux no good what-so-ever.
I don't know if Windows has any sort of community, but I can't imagine it would have such a high percentage of irritating know-it-alls driving people away.
Rant over
Code, Hardware, stuff like that.
From an attackers perspective (that isn't just doing it for the "hey lets 0wn these boxes just because we can!" but actually wants to abuse rooted systems for other things... porn, warez, etcetera...), a linux system would be worth more due to the ability for the attacker to turn around and do useful things with the machine. Additionally, linux systems tend to have higher uptimes (especially with servers) hence it'd be a lot more valuable to have access to a rooted machine 24 hours a day instead of some guys office workstation he turns on at 8am and turns off at 5pm.
Oops... must have read that title wrong, sorry, I thought that a miracle had occurred, and more people were dissing Linux than Windows... that'll only happen when Bill Gates realeases "Micronux", then we'll all have something to laugh at. :)
And so we go, on with our lives
We know the truth, but prefer lies
Lies are simple, simple is bliss
Comment removed based on user account deletion
In the first six months of this year 7,630 covert attacks have taken place on Linux boxes. The total number of attacks last year amounted to 5,736. But attacks on Windows/IIS systems have already dropped by 20 per cent on last year's figures, from 11,828 to 9,404.
The title should read "Linux attacks on the rise."
-just wanted to clear that up
After the whole "Mac people are smarter" and this new "more linux" attacks are coming out I would like to see more ratios. The more people on a system causes more attacks to go up, most likely expodentially. Why make a mac or linux virus that exploits their browsers when your only getting such a small part of the market.
I would take a guess and say windows systems have more expoitable code than linux and mac but does this fact only become apparrent b/c of their market share? If apple had 96% of the market and windows had 4% would we have that many people attacking (or even hear about it for that matter) windows users like we do now?
I think this is also the reason we don't have too many cell phone/pda virus or attacks....yet.
Which are more successful? The attacks on Windows machines, or the attacks on Linux machines?
A better thing to know is what the goals of the attacks were. For instance, attackers trying to get credit card numbers from major e-commerce sites would be more likely to attack Linux machines because (I believe that) Linux powers more successful e-commerce sites than does Windows. This is even more true lately, when respected security professionals are warning customers off of IIS (It Isn't Secure) and Windows platforms.
Another possible motivation is bragging rights. Defacing a web site running on Windows NT and IIS is not really all that impressive when Microsoft is issuing new security warnings and patches on an almost hourly basis. If you are going to try to impress everyone, you pick a fight with the biggest, meanest guy at the bar, not with some little shrimp that can't defend himself.
"Linux systems are up, attacks on Windows based systems have actually dropped dramatically when compared to last year."
If the average System Administrator for Windows platforms are anything like the ones where I work, they are just unaware of the attacks. So they go unreported.
The race isn't always to the swift... but that's the way to bet!
"In 1979, sales of Disco records were up over 800%! If this trend continues..."
"Umm, I think those fish in your shoes are dead"
I would guess more and more people are using 2k or XP instead of older versions of Windows. Things are improving in Windows, and a unix machine are just more interesting to have hacked into. In fact, it is not even hard to break into a computer that isn't patched quickly when an exploit is released.
I'd say that all OSes needs to become more safe, because it is going to affect people in negative ways when their computers are compromised. That is way more important than arguing over which OS is the best.
As far as I can tell, a compromised Linux machine is far more useful than a compromised Win* box, to the attacker.
With all the FUD attacks Microsoft launches against Linux, I'm surprised the attacks actually on Microsoft products weren't too low to measure. Hell, Microsoft has even incited the dead into attacking Linux. Maybe Bill Gates really is related to God!
> but in my opinion the article is wack.
:-)
No, you just misunderstood them. They meant that Linux is being attacked more IN THEIR LAB.
// I know at least 4-5 people who were hit // by this in the 2 days...bla...bla...bla
All right, I call bullshit on this one. You know 4-5 people who were running servers that got exploited by the worm? Like, what are the actual ratios for exploited:exploitable? possibly as high as 1:1000 would be conservative to say the least which means that your 4-5 people represent about 4-5 thousand servers. Either your group of friends are extremely unlucky or extremely stupid, one or the other. Now, get the hell off your mommy's computer before you break something.
I am so sick of people who try to bolster themselves with bullshit.
Actually, I found a URL at Linuxtoday that lists many articles by Middleton. Although there are some doozies there, there are also some that show significantly more balance than the 3 we've discussed here. I'm at a loss to understand the radically varying quality of his work.
"that's not encryption - it's a new perl script that I'm working on..." - from some Matrix parody
There are a lot more linux/unix servers out there then windows servers?
I mean servers, not domains mind me...
Cheers...
How many successful attacks have there been on Linux boxes vs successful attacks on Windows boxes. Just because there are more attacks on Linux doesn't make it less secure, it just means that hackers are targeting it.
Thanks for the heads up. It doesn't mean squat.
GJC
Gregory Casamento
## Chief Maintainer for GNUstep
Really? Heh. Well, we'll have to fix that. ;)
First, trying to prove something with a single statistic is meaningless. A person using a single number to attempt to prove a point generally has either had a lapse of judgment or has no understanding of statistics, math, or the logical process. As an aside, using the GPA to justify the existence of the fraternity indicates either a lack of respect for the process of learning, or the misconception that GPA and learning are equivalent.
Furthermore, using a double step statistics, i.e. the ranking of the fraternity within fraternities, and the ranking of fraternities in the general population, instead of the single step of the rankine the fraternity within the general population, is a classic tricks used to lie with statistics.
Finally, the statics, even at face value, is quite ambiguous. Were there a few people allowed in the fraternity merely because they were smart, and the rest of the fraternity cheated off these poor saps? Did the members of the fraternity have lots of money to hire tutors to do homework and take home tests? Did the fraternity know of the lazy professors who did not change their tests every semester , and, with copies of past tests, have training sessions to let the otherwise uneducated brothers pass the test?
It is really not my intention to be mean or disparage frat boys. I just find it incredible ironic that in an article that is largely about lying with statistics, the author, who claims to be an intelligent educated man of letters, would justify his existence by doling the same.
"She's a scientist and a lesbian. She's not going to let it slide." Orphan Black
Its also worth noting that the mi2g people are offering security services, so the interesting ambiguities in their report are clearly a way to attract new business.
This /. article is AWESOME!
Because they actually used the word "than" (in the title) rather than "then" when it was appropriate to do so.
I think I could die happy now.
Furry cows moo and decompress.
From the point of view of a machine connected to the Internet by cable modem, in terms of rejected TCP SYN packets, grouped by destination port, over a period of a little over 2 weeks:
- port 1433 (MS SQL server), with 1325 packets
- port 27374 (SubSeven, a Windows backdoor program), with 393 packets
- port 12345 (NetBus, another Windows backdoor program), with 361 packets
- port 80 (HTTP, of course), with 205 packets. (Since the connections aren't accepted, I have no data on which specific exploits they might be intended for.)
- port 119 (Usenet NNTP), with a paltry 66 packets
- port 21 (FTP), with 59 packets.
There were a few others (notably the SOCKS proxy service, the SunRPC portmapper, Telnet, and lpd) in the list, but none had more than 8 packets.But they should be real studies and not some fud, which is what I am going to guess this is.
Even the management and bio majors could kick your ass in diferential equations, so no "stupid drunk frat boys" comments.
Those stupid drunk frat boys...
Ow, my ass.
On-topic bit: It is interesting that you back up your criticism of the statistical methods used in the article by citing anecdotal evidence of Windows users' cluelessness. I think it unlikely that the members of your fraternity made up a non-trivial sample space. Despite its flaws, the article made the point that Linux is increasingly perceived as a viable target, and that as its acceptance as a server platform increases, the likelihood that a given installation is vulnerable seems to rise.
"Your notation sucks!" -- Serge Lang (1927-2005)
... it might make your stronger.
Linux will probably benefit from the exercise.
Now, if we make a Linux server that will survive Slashdotting, then we've really got something.
[also misbehaves on Kuro5hin as Peahippo]
They fail to mention or reference the expliots/apps used and I haven't heard of that many new/successful exploits that remain unpatched for any length of time.
In the 24 posts listed on your user info page, 17 of them mention you went to MIT. Are you sure the reason for this post wasn't just to tell everyone that. Again.
"Imagination" isn't quite the word I would put there. :-)
Oh, windows systems... that makes a little more sense.
The reason my mom doesn't want to use linux is 'cause she's not a sys admin, and won't get around to applying patches. She needs an OS that auto-updates, like OS X or WinXP.
okay yeah sure ill belive that there alot of ATTACKS on linux sure , but how many actually work ? and of the ones that do work how many of them are either do to an un-patched server or a noob admin ? ... sometimes NEVER.
not to mention most of these "holes" in linux actually require a brain cell and time to exploit whereas most windows holes have scripts for them ....
now compare that to windows.
i am pretty damned sure windows has way more exploits that are UNFIXED than does linux. most OSS holes are patched within days, most microsoft holes are patched in WEEKS or MONTHS
not to mention this is all one big assanine discussion SOLARIS and openBSD are the two security OS's. you wanna be paraniod run them.
hell i dont think i EVER remember hearing of a gapping hole in solaris and i WORK for sun..... (of course i could be wrong about that)
"Two things are infinite: the universe and human stupidity; and I'm not sure about the the universe." --Albert Einstein
-rozzin.
Those attempts to run ``/MSADC/root.exe'' directed toward Apache servers? I must have seen several dozen of those this week alone. (Heh heh heh)
CUR ALLOC 20195.....5804M
Ignoring the poorly presented, ill-defined etc etc stats. It should not be surprising to see attacks and Linux and unix-like machines on the rise. This year has seen remote holes found for OpenSSH and Apache, which *are* being exploited in the wild right now. It has never been so easy for script kiddies to crack Linux etc type boxes as it is now. There are still plenty of vulnerable machines out there that have not been patched yet...
--
Simon
I find the statistics which are used to justify the headline of the article to be surprising. Last year (the year of Code Red) this analyst counts only 11,828 attacks? :O And the U.S. government suffered only 254 and 54 attacks in the first halves of these two years? :O These figures seem awfully low.
I'm also confused about WHAT is being measured. Apache runs on MS-Windows (as well as BSD, Solaris, and several other Operating Systems). However, the article seems to equate Apache with Linux. Having assumed this, does it also count exploits of other software (e.g., OpenSSH, bind, perl, rsync, squid) as attacks on "Linux-Apache" web servers? And if so, why doesn't he count the (hideously numerous) Outlook disasters which occur on Outlook Servers?
Microsoft employees, of course, frequently encourages customer to run IIS and Outlook on isolated systems. (Separate from each other, separate from "normal" file servers, and separate from all other software products.) I suspect that M$ software will remain too buggy to trust, even in isolation, for many years to come.
Does that hundreds of Code Red attack on my Debian servers count?
Just curious.
Are you confident enough in win/iis to post the URL here?
the VNU author did not question the methodology of the Mi2G piece, but The Register did. mi2g after it compiled a database on attacks culled from data from defacement archives (such as alldas.org), hacker bulletin boards and "information from automatic robots". "Sites such as Alldas.org make no attempt to suggest that their data is comprehensive, and it's questionable if mi2g's figures can be used as a metric to compare the vulnerability of different operating systems. But then it's very hard to get solid figures on this kind of data so mi2g's figures may be indicative. " http://www.theregister.co.uk/content/55/26177.html
Mi2G has a history - its Y2K forecasts were notorious -
http://www.kumite.com/myths/opinion/thoughts/1999/ mi2g.htm
Though the study is pretty badly flawed, this phenomeenon will likely continue, perhaps not to exceed windows, but it is a possiblility. What is being seen here is that linux is gaining market share, and it at least perceived as valuable information to know by even Windows administrators. The main problem plaguing Windows security is quality of the administrators. Commercials give the impression that MCSE = big buks, so people with little drive or knowledge go for it for the cash. Administrators are suddenly a dime a dozen and with MCSEs all over place and limited knowledge of managers conducting employee selection, its hard to determine quality among candidates, so you get lazy or unknowledgable sysadmins. These large masses of people have been seeing Unix as a dying, historical thing and have ignored it. Now, to *these* people, Linux is a sort of renaissance to Unix computing, so they see it as possibly figuring into their job and start to take it up. Also, other computer people who want to feel elite also pick it up and start doing things without fully understanding the risks and consequences. As Apache and even OpenSSH have shown us, no software is perfect, and ultimately it is the awareness and competency of the sysadmins that determine security. And for linux the signal-to-noise ratio is getting lower...
:) There haven't been many serious widespread issues for a while until recently. Now with the increased market and exposure, script kiddies and the like find linux a more appealing target, especially those who thinks linux users need to be taken down a notch or two. So all of a sudden, we have lazy or new sysadmins faced with an increasing number of attacks.
Also, sysadmins of Unix systems especially are getting lazy, I'm guilty of that
Personally, I think I'm going to start deploying gentoo more on servers. Patched versions seem to work into the portage tree most quickly, while other places tend to a bit slower, either because of QA or lack of maintainers.. I know QA is good, but to tie up *security* patches in QA too long is bad... I'll take my risks on testing a patch with a possible, yet unknown exploit than a certain, known exploit..
XML is like violence. If it doesn't solve the problem, use more.
Turn off all services except ssh
Mmmh... having only openssh running on a box sure makes it very secure! History has shown this to be true, too, with not many ssh vulnerabilities out there, not many implementation flaws!!
-- Matti Nikki
...that you didn't forge yourself.
/. , but that's not the target audience anyway. It's targeted at industry decision makers, who depressingly often have no idea about IT and/or research methodologies. They will read it as: "WINDOWS MORE SECURE THAN LINUX AFTERALL - Gates better than Torvalds"
The parent poster named some very important flaws that go with this particular article that is reporting about this study.
Here are two more:
1. Overall methodology
2. Sample group (i.e. how many machines, how many running Linux/Windows, setup of the machines, default/hardened etc.)
It can be argued (I love academic talk) that this article would probably even fail as an abstract in most universities. Nevertheless, this article is read and even gets coverage, so it can be assumed that many people will read it. How many readers know about flaws in studies and statistics to read the article on an informed basis?
Very few, most of their readers will most likely be management people (I am one myself btw) and misinterpreted (not me). In fact it is written so that the uninformed (read: non-IT, non-security) reader has to misinterpret it.
The interesting thing is, that anyone who is knowledgable in the industry could have written a better article making the point for Windows. Surely it would have been ripped apart here on
It's FUD, and not good one at that.
I feel so sig.
that makes this show how much you know of windows, is that on windows you can't delete or edit a log file before the system hase closed it and started a new log for the next day, you can only read it.
It represents that fewer and fewer idiots use Windows. And by the end of year, people using Linux systems may surpass ones using Windows systems!
Maybe people don't care what system they are trying to hack. Increases in Linux hacks could be attributed to an increase in Linux use last year. If IT departments (or whoever reported this) are as bad as our Social Psych department then I refuse to read on. Causation folks, not correlations.
I'm hanging out for a (+5, Underrated) myself.
Nerd: Derogatory term typically directed at anybody with a lower Slashdot ID than you.
Still no "real" attacks on the system today, though.
They must be on the level...right?
Right?
Neat-looking site plus buzzwords equals credibility, doesn't it?
this is only due to the fact that there are more people running linux than there are windows...
I write code.