Slashdot Mirror
Microsoft Windows: A Lower Total Cost of 0wnership
bahamutirc writes "Dave Aitel of Immunity, Inc. has written an excellent report detailing the lower Total Cost of 0wnership Microsoft Windows has over Linux. Dave takes a unique approach in comparing the two operating systems, and the results are not surprising. The paper was submitted to Bugtraq today and is available in PDF and Open Office."
Mirrored here and here in case of Slashdotting.
And no, this isn't a joke, although it is kind of entertaining!
MD5:
19bd158b9e471db49acd91f0493b81ec *tc0.pdf
5ca7eb699b94967ee2d255c021e1686f *tc0.sxw
A couple of definitions of "parody" for you: Google's and Wikipedia's.
tasks(723) drafts(105) languages(484) examples(29106)
Uhm, you do realize that this is a joke report. It's TC0 (zero), not TCO. This report is about how 0wn1ng W1nd0z3 is easier than Linux, not "owning Windows." That should teach you to at least puruse the article before posting nonsense. To repeat: This is a JOKE!!!
No, no, they're busy on Groklaw. Remember, the puppet-masters are busy everywhere.
You are being MICROattacked, from various angles, in a SOFT manner.
It's a TC0, not a TCO- and I doubt you could come to any other conclusion with a TC0 comparing Linux to Windows. Total cost of 0wnership- that is, total cost to hack the box and get it to send out a bunch of spam or viruses.
SJW: a person who perceives an injustice, and while correcting it, commits a greater injustice.
I avoided using mod points just so I could post this tidbit:
:)
If you think it means Total Cost of Ownership, as it relates to some BS middle-to-upper-management measurement, then you didn't RTFA.
That is all.
Apparently a large portion of the Slashdot commenters aren't aware of what '0wn' means in the hacker/cracker sense of the word. If you root a machine, you 'own' it. "I got 0wned" means "I got hacked/broken into". Now look at the title of this report, total cost of '0wnership', not 'Ownership'. Now do you understand the joke/point of the paper?
I thought perhaps, that some reading this may not like to have to open up acrobat or Open Office... Enjoy:
Microsoft Windows: A lower Total Cost of 0wnership
August 12, 2004
Introduction
Microsoft has long asked third party analysts for accurate assessments of the total cost of ownership of Microsoft Windows deployments, especially against the Linux deployments commonly going into all segments of the market. However, Immunity, Inc. as a third party assessment provider has, until now, not done a thorough analysis, using Immunity proprietary data to tell the true story about the costs of Open Source.
Other sources of 3rd party information can be found here: http://www.microsoft.com/mscorp/facts/default.asp
The point of contact for this paper is Dave Aitel, Vice President of Media Relations, Immunity, Inc. He can be reached at mailto:dave@immunitysec.com. Further information on Immunity, Inc. is available at http://www.immunitysec.com/ .
Executive Summary
Based on our analysis, Microsoft Windows has one half the Total Cost of 0wnership (TC0) of modern Fedora Core Linux based technologies.
Immunity's Methodology
Immunity has four major services: Training on exploit development and vulnerability analysis, Application Security Consulting, the CANVAS assessment product, and the Immunity Vulnerability Sharing Club. In each of these, the costs to penetrate (0wn) systems based on Microsoft Windows Technologies was compared to the costs against a modern Linux system. In general there are three aspects to 0wning a system. These three things, Vulnerability Detection, Exploit Development, and Attack Execution, were used by Immunity to determine the costs to 0wn the different operating systems in configurations encountered during Immunity engagements. As Immunity is not in the rootkit (http://www.rootkit.com/) writing business, this paper does not cover the costs of maintaining 0wnership over a given OS.
Vulnerability Detection
There are several factors that affect how difficult it is to find vulnerabilities on a target platform. Some of these are listed below. Immunity's judgments are drawn from our current collection of remote 0day in the VSC, countless 0day in custom applications for Immunity Consulting customers across many different operating systems and over 80 remote exploits in CANVAS.
Portability of common exploit development tools
IDA-Pro, the premier disassembler and reverse engineering tool (a database and a disassembler together make for a powerful combination) is able to disassemble both Linux and Windows binaries, but only runs on Windows. A Linux version is, however, rumored to be in the works.
PDB (Python Debugger), Immunity's newest tool in the armory, is available only for Windows (although the client is available on both Linux and Windows). This tool allows for many advanced scripts to be run, widely automating the exploit development process.
Ollydbg (Visual Debugger), is far superior to GDB in many ways needed for exploit development. In addition, windbg and Softice provide valuable options for debugging at the kernel and user level.
The TC0 advantage is clearly obvious for the Windows platform.
Availability of Fish
Finding a vulnerability is like finding a fish. If the pond is overfished, it's harder to find them. Hackers are rather evenly split between running Linux and running Mac OSX. As much as few professional NASCAR drivers drive Dodge Neons, a negligible amount of skilled hackers use Windows as their primary OS.
Not to mention, many Win32 fish are given out for free by Microsoft when releasing patches. (See
Help a college student
The word "sic" means "thus." Nothing more, nothing less.
Well, you seem to be pretty bad at getting jokes. The article isn't about cost of ownership, it's cost of 0wnership.
I was getting ready to try out Mandrake 10 for my business, but then I realized that it often makes Windows XP unbootable on a dual boot machine.
Hell, you don't need Mandrake! XP will make itself unbootable!
True story - recently had an XP system with NTFS boot partition. It would not boot; gave an error message about corrupt NTFS. A call to Microsoft confirmed that this was "by design". Evidently booting on a corrupted NTFS partition may make data unrecoverable.
"Well, then, how do I recover it?"
"Reload with the recovery disk."
"Hmmm, you realize that the recovery disk, from this OEM anyway, overwrites everything, don't you? How do I recover the data?"
"There is no way."
Bringing up a Linux live disk with NTFS read capability got all the user's data back. Memory and disk diags showed no problems, so I used the recovery disk, reloaded user data and it's been running 2 weeks now.
Michael Howard, a longtime Microsoft Employee, wears a 'my other computer is your LINUX box' t-shirt when he gives talks on how to write secure code.
saw him in it at directx meltdown last month.