The Web's 20 Worst Security Flaws

XsynackX writes "The SANS Institute released its Top-20 list of the biggest vulnerabilities on the web today. The SANS Top 20 Internet Security Vulnerabilities list is actually a compilation of two lists--the top 10 Windows vulnerabilities and the top 10 Unix vulnerabilities. The list goes into almost more detail than any one person could ever take in on individual security flaws, but provides a wealth of knowledge for those who like to get in-depth. Interestingly enough, the browser section of the Windows vulnerabilities lists everyone's favorite browser Internet Explorer with 15 flaws and Mozilla with only 7."

Comments

not just "the web"

[UnderAttack]

These flaws cover more then just "the web".
They include things like week passwords and non-web network threats.

Re:not just "the web"

[StyxRiver]

I can see plume of smoke from the servers at the Sans Institute! Succumb to the /. effect!

Re:not just "the web"

[pjt33]

But surely changing your passwords every week is good? (Well, against external attackers - not so good against internal attackers if you have to write your password on a PostIt and stick it to your monitor).

Re:not just "the web"

[tomsuchy]

NEVER stick your password post-it on the monitor! It goes under the keyboard.

Re:not just "the web"

[flossie]

NEVER stick your password post-it on the monitor! It goes under the keyboard.

That's precisely why you should stick it to the monitor - nobody will find it because they will be busy looking under the keyboard! Cunning, eh?

Re:not just "the web"

[ArbitraryConstant]

Changing your password every week is dumb, or at best of little benefit.

Better pick a good password and hang onto it for a while so you can remember it.

Re:not just "the web"

[DarkSarin]

Remember this: if the attackers have physical access to the machine, there is almost no security to speak of. You may be able to limit access to one machine at a time (thus preventing intranet assualts), but once an attacker is sitting at the computer in question, there is very little that they cannot do. This is true for both windows and linux. Even password theft is possible on Linux, given the right amount of time.

Certainly some attacks take longer, but in general, if they have your machine, its too late for security!

Re:not just "the web"

[Jesus_666]

Certainly some attacks take longer, but in general, if they have your machine, its too late for security!

Shows what you know. My computer contains a chunk of C4 which is set up to go off when someone presses the power button or opens the case.
Okay, so I can't turn the thing on without killing myself but hey, it's secure!

Re:not just "the web"

[0racle]

No its not. A small accident will destroy your data, desk, you and who knows what else.

Re:not just "the web"

[Jesus_666]

If I can't use my computer I can't input sensitive data, which means that anything can happen with my computer and there still won't be any data loss.
Besides, ever since I started putting explosives into my hardware everyone is too scared to actually talk to me or make me work.

Re:not just "the web"

[Slime-dogg]

Yeah. Give someone access to the physical computer with an extra hard disk, or a jump drive, and there's very little that you can do. The only thing, I imagine, is setting a bios password.

Now, one of my buddies had a Compaq laptop which had a bios password that he didn't know. He drained the CMOS battery, in hopes of resetting the password. This had the effect of breaking the whole thing. He called Compaq, and they said that he'd have to replace the motherboard.

Now, if you can implement security like that, the only other thing that someone could do is take your HD out, put it in another computer, and read off of that drive. I'm not too sure about ACL's, but even those can't stop someone from reading the physical media. (Unless your entire system is an image mounted on the loopback device with heavy encryption... hmm. Get those tin-foil hats out.

Re:not just "the web"

[ScrewMaster]

Well, they only get one chance to guess MY password. If they get it wrong, the thermite charge under the hard drive goes off and that's that.

Granted, I go through a lot of hard drives.

Re:not just "the web"

[Anonymous Coward]

Which implies that you also have at least one backups which isn't thermite-"protected"... ;-)

Re:not just "the web"

[zerocool^]

I know a guy who used to be a computer tech...

Whenever a windows 98 machine would come in for a wipe-and-reload, it was fairly standard policy that, if the end user didn't have the key with them, but it was obvious that they had a copy of windows on the machine, my friend would use another windows98 key - they all work anyway, and there's no activation.

So, after doing the install 40,000 times, he had the key memorized, and used it as his password.

There's nothing like seeing someone type 25 random characters as a password.

~Will

Re:not just "the web"

[TRIEventHorizon]

good idea, i think i'll use a windows key!

Re:not just "the web"

[ArbitraryConstant]

My passwords inspire similar awe. :)

http://homestar.sytes.net/cgi-bin/passgen

I typically rotate my passwords when I have to get my iBook fixed-- about every 6 months. I love the looks on their faces when I tell them my password.

Re:not just "the web"

[lachlan76]

A BIOS password is not an effective security measure.

I had to bypass one the other day - you just unplug the computer, move the jumper into the 'CLEAR CMOS' position - if you have trouble finding it, it should be near the battery, or at least they are on every computer I've done it on.

Re:not just "the web"

[kai.chan]

nobody will find it because they will be busy looking under the keyboard!

But what if they know that you will stick it to the monitor because they know that you know that they will be too busy looking under the keyboard? A ninja must read underneath the underneath. So it is best to put the post-it inside your pants. This plan is absolutely flawless except for one minor drawback: Retrieving the password might look suspicious to your coworkers.

Re:not just "the web"

[Ohreally_factor]

your password is "fhqwhgads"?

Re:not just "the web"

[Dwonis]

What's better is to disable remote password authentication entirely, if you can.

Re:not just "the web"

[ArbitraryConstant]

Not to give away any information about my password, it's possible for my password generator to generate that. So, maybe.

Re:not just "the web"

[AK Marc]

A BIOS password is effective for security on most laptops. They have no documented proceedure to clear the CMOS. HP requires MB replacement on lost BIOS password. The grandparent said Dell required the same. At that point, they would have an easier time buying an identical laptop and pulling the HD out and moving it.

Most desktops have a jumper you can get to, but most cases have the option to be padlocked shut. Again, if someone has physical access and no restriction on what they can do to it, there is pretty much nothing you can do to protect it.

Re:not just "the web"

[goober1473]

I love the change your password every x weeks rule.

I have a good secure password that I use for my own stuff and rarely change it, it's long and not even close to a real word.

At work I suffer from the change your password to a hard to guess/remember version, my password becomes a word with a few numbers at the end as it's easy to increment and change every month.

Another case where too much security actually reduces security!

Re:not just "the web"

[plover]

No, but according to his logs YOUR password is now most likely "Cz=+LCjxP3renBK7".

I just love web-based password generators...

Re:not just "the web"

[plover]

I have a good secure password that I use for my own stuff and rarely change it, it's long and not even close to a real word.

But how do you know that this password hasn't been compromised? What if you used it when you signed up for the InnocentHobbyAndNotEvilHackers.org newsletter? And is this password (or a close variant) the same as the password and email address you use at BigCorporateBank.com?

Passwords don't stand up and shout "I've been compromised!" when a bad guy learns them. Expiring passwords may lead to bad security on improperly secured websites, but static passwords used on just one compromised web site are just as bad.

Re:not just "the web"

[goober1473]

Arrgh, InnocentHobbyAndNotEvilHackers was my password :)

Your right I don't, but then do I sign up to newletter etc. with this password? no.

If my password is used for my bank, well yes I use the stronger password. If it's compromised, well it's the banks problem for not forcing me to change passwords and making me use a hard to guess password.

My original point of forcing a user to change a password every month doesn't work still stands, changing a password from fred123 to fred124 doesn't work, if an account is compromised the first thing I would try if cracking would be to increment the magic numebr at the end by one. Realistically this is what the user does as it's easy to remember!

I would rather use a very hard to remember/crack single password than just rotate through a number of easy passwords, but to be honnest I would prefer to use a password protected key based security model with a random (like secure ID) element included. By then you get into the security/usability arguments though.

Re:not just "the web"

[gcaseye6677]

That's not a security feature, that's extreme incompetence on the part of Compaq. Their junky machine couldn't recover from the simplest of hardware failures. What a waste.

Re:not just "the web"

[freedom_india]

True. Create a couple of passwords and hang onto them for life...

Changing passwords weekly is a hassle.
Most Admins never do that. (eh, i know it is flamebait.)

Re:not just "the web"

[Anonymous Coward]

No, *you* fuck will dunn goats. By the way, FT9CH-XVXW7-7BFCM-RPR49-VDHYD

Firefox vulnerabilities IE vulnerabilities

[thre5her]

Fortunately for now, security through obscurity prevails for Firefox, since most exploits will likely target IE users. However, Firefox's development model is inherently better than IE's with regards to security, since the status of these vulnerabilities is known to all and they are fixed much more quickly. Why Microsoft is still in the browser game with their lame, few-and-far-between updates is beyond me.

I can't see the site

[Anonymous Coward]

Is slashdotting a vulnerability?

Only 7?

[cperciva]

...Internet Explorer with 15 flaws and Mozilla with only 7

Err... at this point, does it really matter? It's useful to compare BIND against djbdns (many security flaws vs. none), or Linux against OpenBSD (many security flaws vs. one remote hole in 8 years), but 15 flaws vs. 7 flaws? To me, that just says that both browsers are horribly insecure, and slightly more effort has been put into finding flaws in MSIE.

Re:Only 7?

[Anonymous Coward]

Openbsd'd claim is for holes in a default install. Virtually no services are running in a default install.

Add open ssh, your ftp daemon of choice, apache etc and the amount holes look about the same as Linux. Both OSs do, after all, run mostly the same software.

Comparing MSIE vs Mozilla is useful, as both do the same job and are exposed to the internet in the same way.

Re:Only 7?

[msgregory@earthlink.]

Yeah, 7 sounds like a lot. I guess it depends on the nature of the vulnerabilities, too. If I cared about web browsers I would probably go look those up, but I'd rather not waste my time.

Re:Only 7?

[Anonymous Coward]

Nice troll!

Re:Only 7?

[Negativeions101]

That's bogus... Of course Mozilla isn't horribly insecure. The flaws in Mozilla are a lot less severe than the ones in IE. Again as has been pointed out time and time again, Mozilla is built to be inherintly more secure and IE is inherintly more insecure. Regardless it's Windows afterall... so any program is inherintly less secure on a windows platform compared to Unix based one.

Re:Only 7?

[endofoctober]

The numbers may not matter, but the response to the threats from both organizations matters very much. Of the 7 flaws in Mozilla, all have been fixed as of Moz1.7/FF.9 whereas of IE's 15 vulnerabilities, only 6 have vendor patches.

Re:Only 7?

[Anonymous Coward]

OpenBSD has ssh and apache in the default install.

Re:Only 7?

[Anonymous Coward]

but apache is not enabled

And ssh is the same whether you're on Linux or OpenBSD (assuming OpenSSH). And they both had the same flaw.

OpenBSD's claims are nothing more than marketing because the software is identical in most cases.

Now kernel flaws allowing exploits might be another thing. That's the only thing you can really compare though.

Re:Only 7?

[Anonymous Coward]

Exactly so.

The "browser v browser based on security debate" confounds me.

Internet Explorer is an application that makes extensive use of the Windows API.
Mozilla is an application that makes extensive use of the Windows API.

Using the recent JPEG exploit as an example, did Mozilla write their own JPEG interpreter and Graphics Display Interface code?

Highly unlikely.

An alternate browser provides little or no security advantage.

Re:Only 7?

[Anonymous Coward]

>To me, that just says that both browsers are horribly insecure, and slightly more effort has been put into finding flaws in MSIE.

There was a scientist who had trained fleas
to jump upon receiving a sound signal.
He then removed the legs off the fleas
and produced a sound signal. The fleas
failed to jump. Therefore he concluded
that fleas cannot hear without their legs.

Now what do you think that has to do with
your conclusion? Hint, which browser has a
database of bugs submitted by users? Which
source code can be inspected by one and all?
Given that the database is large and well-known,
and yet only 7 flaws are provided out
of that database what does that say about
the quality of the code in mozilla?

Conclusion: You've volunteered to be a moron
by failing to do proper, well-documented
research.

Re:Only 7?

[Nyder]

No, Internet Explorer used Active X
Mozilla does NOT use Active X

Active X is very insecure, and probably the leading cause of problems.

Because of that, is why Mozilla is more secure.

Re:Only 7?

[ArbitraryConstant]

OpenSSH is on by default in OpenBSD. The one hole in 8 years was in OpenSSH. OpenSSH is the only service visible to the outside that's on be default.

The forked Apache in OpenBSD is much more secure than any you'd find elsewhere. On top of all the patches rejected by the Apache people for various reasons and thus not distributed to anyone else, it benefits from W^X protection (on i386, which no one else has) and ProPolice (it's not that widely used, some of the userspace stuff in Linux seems to use it but the kernel doesn't). This has turned a bunch of arbitrary code exploits into DOSs, which merely crash the server process.

The ftpd in the base install as well as everything else benefits from W^X and ProPolice. W^X is handled by the system, and ProPolice is used by default on anything you compile. Therefore, unless you work pretty hard to avoid it, anything that's run on OpenBSD benefits from the added protection. As a result, it's more secure because exploits aren't always exploitable on the platform.

DOS issues are still patched, but the difference is that they're not exploitable before the patch is issued.

Re:Only 7?

[mdfst13]

"An alternate browser provides little or no security advantage."

In this case, it reduced the number of security holes to patch from 15 to 7. I.e. Mozilla needs to be patched to cover up MS Windows security holes half as often as does IE.

Switching from IE to Mozilla does make one's system more secure. The fact that switching from MS Windows to a unix based system will have a greater effect on security should not keep people who are using MS Windows from swapping browsers.

Re:Only 7?

[Anonymous Coward]

Openbsd'd claim is for holes in a default install. Virtually no services are running in a default install. Well looky here, I just happen to have a default install to hand...

netstat -a | grep -i listen | awk '{print $1, $4}'
tcp *.6000
tcp *.ssh
tcp *.time
tcp *.daytime
tcp *.auth
tcp localhost.rainbo.sunrp
tcp *.sunrpc
tcp6 *.6000
tcp6 *.ssh
tcp6 *.time
tcp6 *.daytime
tcp6 *.auth

Does that count as a rebuttal?

Re:Only 7?

[Anonymous Coward]

tcp *.6000
tcp *.ssh
tcp *.time
tcp *.daytime ; practically impossible to exploit as it does not accept user input
tcp *.auth
tcp localhost.rainbo.sunrp ; this one only listens on localhost, pretty hard to exploit remotely.
tcp *.sunrpc
tcp6 *.6000 ; ipv6, same service as above
tcp6 *.ssh ; ipv6, same service as above
tcp6 *.time ; ipv6, same service as above
tcp6 *.daytime ; ipv6, same service as above
tcp6 *.auth ; ipv6, same service as above

which leaves us with..
tcp *.6000
tcp *.ssh
tcp *.time
tcp *.auth
tcp *.sunrpc

That's pretty impressive, dude..
Good luck exploiting time, auth, and sunrpc.
btw, what's listening on port 6000?

Re:Only 7?

[ArbitraryConstant]

Those services are running, but not visible or available to the outside.

Re:Only 7?

[Anonymous Coward]

It's rare that there is ever a case for "no
security holes". It is possible - you can prove
the code correct, for example - but it is rare.
Mainly because software proofs are horribly
difficult, tedious and time-consuming, which also
means very very expensive. It's usually considered
"cheaper" to wait until someone stumbles into a
flaw than to have the code correct to that degree.

Having said that, the essence of your post is correct. Software is secure or it isn't. There's really no middle ground. It would be like a bank arguing that it only had N open doors leading to its vaults. How many does a thief need?

Re:Only 7?

[Anonymous Coward]

Please, XPI can do the same damage, it has all the privs of your user account just like ActiveX. Put IE on "do not download activex controls' and you're equivalent in security to Firefox 1.0PR. /uses Firefox but hates fanboys

Re:Only 7?

[Anonymous Coward]

Amen brother.

Re:Only 7?

[JawaSpot]

To me, that just says that both browsers are horribly insecure, and slightly more effort has been put into finding flaws in MSIE.

I feel compelled to point out (to those who haven't actually rtfa) that ALL 7 of the items listed there for Mozilla have already been fixed.

On the other hand, several of the Microsoft vulnerabilities include "solutions" (listed on secunia.com) such as "Use another browser" or (essentially) "Disable X functionality."

Re:Only 7?

[Anonymous Coward]

w^x in OpenBSD is rather new. I've run RSBAC in Linux for many years now. I'd say my Linux box has been much more secure than an OpenBSD one because of that.

OpenBSDs ftpd has had vulnerabilities, it's just not enabled per default. vsftpd has had none.

Re:Only 7?

[jesser]

I wouldn't take SANS's list of browser security holes too seriously. It lists the most publicized holes in Mozilla rather than the most serious holes. (To get a list of the most serious holes, look the "critical severity, high risk" holes (marked in red) on mozilla.org's list.) SANS's list includes Mozilla XPInstall Dialog Box Security Issue, which was fixed a few months ago, but fails to mention that a fully-updated version of IE in SP2 is still vulnerable. Under the list, SANS claims that Firefox does not have automatic updates, which is false.

Re:Only 7?

[ArbitraryConstant]

"w^x in OpenBSD is rather new. I've run RSBAC in Linux for many years now. I'd say my Linux box has been much more secure than an OpenBSD one because of that."

That depends on what you're doing with it. If you're running a system where you have to let people in for them to do what's needed, access controls are probably the way to go (on Linux or other OS).

If you want a server that does generic serving or firewalling, OpenBSD is the way to go because it is more resistant to exploits of any kind, and the servers tend to be running in jails with dropped privs. It's hard to get out of there even if you've subverted the process.

"OpenBSDs ftpd has had vulnerabilities, it's just not enabled per default. vsftpd has had none."

OpenBSD's ftpd is old. It's been audited extensively over time (just like everything else), but it dates back to 1985.

I couldn't find any vulerabilities after 2000 when I checked.

Re:Only 7?

[Anonymous Coward]

Regardless it's Windows afterall... so any program is inherintly less secure on a windows platform compared to Unix based one.

Please justify this statement.

Re:Only 7?

[Anonymous Coward]

Using the recent JPEG exploit as an example, did Mozilla write their own JPEG interpreter and Graphics Display Interface code?

They used libjpeg instead of GDI+. It would have been hard for Mozilla to use GDI+, considering that it didn't exist when they started, and it only exists on one of the platforms that Mozilla runs on anyway.

I don't think it's possible to exploit GDI (not the same as GDI+), especially without the ability to send in arbitrary pointers or screw up user-mode GDI data structures. If a certain pattern of pixels could cause nasty stuff, that'd be a severe and unlikely bug in code that's now at least 8 years old and very widely used.

Highly unlikely.

I don't see why. They wrote their own string classes, http code, xml parsers, css parsers, javascript interpreter, rendering and compositing code, even SVG and MNG support (though later removed). What's so special about JPEG?

Of course they didn't, since there are freely available, portable, open source libraries that already handle it, but I don't think it would be all that unlikely if they had.

Re:Only 7?

[Demonspawn]

Top of my head answer: X listens on 6000

When did X become part of the default OBSD install? (and if it does, it probally only listens to localhost)

--Demonspawn

Their web server...

[ttldkns]

...seems to feel that posting a link to it on slashdot is a vunerability.

Re:Firefox vulnerabilities < IE vulnerabilities

[thre5her]

I'm a fool for not using the & lt;.

Hrm. statistics speak for themselves.

[rebeka thomas]

Windows with 95% has 10 of the top 20 vulnerabilities
Unix with 5% also has 10 of the top 20 vulnerabilities.

I think the stats speak for themselves in which is more secure. If Win boxes can take such a phenomenal market share and still only have the same number of 'top' vulnerabilities, that's putting it 19 times more secure.

Re:Hrm. statistics speak for themselves.

[otlg]

I think your interpretation is not quite correct. This was simple a pair of top 10 lists jammed together. It has nothing to do with instance or severity outside of their respective platforms.

Re:Hrm. statistics speak for themselves.

[Anonymous Coward]

The SANS Top 20 Internet Security Vulnerabilities list is actually a compilation of two lists--the top 10 Windows vulnerabilities and the top 10 Unix vulnerabilities.

Re:Hrm. statistics speak for themselves.

[ThomaMelas]

Um...bad math. It's the top ten vulnerabilities for each. Not just that both of them have just ten major vulnerabilities.

Re:Hrm. statistics speak for themselves.

[Negativeions101]

I know this is a joke. But really this is a serious issue. This affects so many people, it should be taken seriously.

Re:Hrm. statistics speak for themselves.

[Anonymous Coward]

It was no joke. Look at her posting history. She is a Microsoft troll.

Re:Hrm. statistics speak for themselves.

[Negativeions101]

I saw your other posts. For some reason you seem to like Microsoft. Others who have legitimate reason to even hate Micrsoft are just MS bashers, right? You seem fairly intelligent but your inability to realize that MS is such a train wreck really makes you an idiot since it's so painfully obvious. Unless you were joking, of course.

Re:Hrm. statistics speak for themselves.

[r3m0t]

Join the Get The Facts roadshow! THey have a job for you.

Re:Hrm. statistics speak for themselves.

[Anonymous Coward]

Yeah, because Slashdot is known as being the home of free thought.

Please, just kill yourself already. Since you're "anti-stupidity," you must be self-loathing already.

Re:Hrm. statistics speak for themselves.

[ConceptJunkie]

Wow! You have a future in presidential debating!

Re:Hrm. statistics speak for themselves.

[Negativeions101]

What's your problem, dick? We both agree. She's a Microsoft troll.

Ok I'm sure I'll get slammed for this but...

[otlg]

Doesn't everyone that reads /. know that MS IE is a gaping security vulnerability by now. Do we *really* need to keep harping on it like a bunch of smug self-righteous motherfuckers?

Re:Ok I'm sure I'll get slammed for this but...

[Anonymous Coward]

Do we *really* need to keep harping on it like a bunch of smug self-righteous motherfuckers?

Yes, because it makes our penises feel bigger.

Re:Ok I'm sure I'll get slammed for this but...

[Anonymous Coward]

Yes, because it makes our penises feel bigger. Is that feel bigger, or appear bigger to other people?

Re:Ok I'm sure I'll get slammed for this but...

[Anonymous Coward]

Doesn't everyone that reads /. know that MS IE is a gaping security vulnerability by now. Do we *really* need to keep harping on it like a bunch of smug self-righteous [censored]?

Yes. Until the day that Mozilla, Firefox, Konqueror, and other browsers hold a majority share, and IE is crushed into oblivion, then yes, we do.

Re:Ok I'm sure I'll get slammed for this but...

[Anonymous Coward]

This is a couple days too early... Isn't Microsoft's next bug dump due Oct-12.

Duck and cover!

Re:Ok I'm sure I'll get slammed for this but...

[hai.uchida]

Yes, actually, we do. Harping on their security "oversights" isn't picking on the little guy when he's down... As long as Microsoft holds a virtual monopoly their sloppiness and failures affect all of us.

Re:Ok I'm sure I'll get slammed for this but...

[Jesus_666]

Do we *really* need to keep harping on it like a bunch of smug self-righteous motherfuckers?

Like a bunch of smug self-righteous motherfuckers?

Re:Ok I'm sure I'll get slammed for this but...

[otlg]

You've totally missed the point I was trying to make. There is nothing wrong with chastising manufacturers over security flaws. I have *no* problem with that. However, the tone of the article was 'IE has 15, mozilla only has 7, microsoft sucks, open source rules'. The reality of the situation is as follows: Microsoft has security holes, and we all know it. Mozilla/Firefox/etc. with their open source, open book approach has bugs as well. I guess what I'm saying is, I'm disappointed by the attitude that states, since it's open source we're happy with fewer security holes. One of the pro-open source arguements I hear all the time, is more secure, quicker bug fixes, etc. Given that, why isn't the Mozilla count at 1 or 2??? We should spend out time fixing what we have control over, rather than trash talking MS. That's how open source will win in the end. Trash talking won't do a damn thing.

Re:Ok I'm sure I'll get slammed for this but...

[LGagnon]

IE is still the most "popular" browser, so yes, we do have to. Until other browsers have greater or equal market share, there's a need to inform all those who still use IE (and yes, this includes some people on Slashdot).

Re:Ok I'm sure I'll get slammed for this but...

[Anonymous Coward]

"Yes, because it makes our penises feel bigger."

Than a microsoft one?

In my oppion

[Ziak]

I've always said that spyware was caused due to Internet Explorer being so popular.... If firefox keeps the rate of growth its doing I don't think it will be that long into we see spy/malware targeting Firefox as well....

Re:In my oppion

[ttldkns]

Crack sites and (my friend told me this) some pron sites used to have XPI install spyware (but you had to click ok to install it).

This was fixed by the mozilla dev team's implementation of a XPI installer website whitelist consisting of (by default) just mozdev.org. The user can add other sites though, should they want to.

Re:In my oppion

[Space_Soldier]

That is not entirely true. It is well known that Microsoft abandoned IE after it has won the first browser war. Microsoft have also had a unsecure programming mindset because they started as one-user-minded company instead of multi-user-minded company. Because they did not care about security at first, now they are paying the price. Unfortunetly, the consumer is facing the heat worse than Microsoft.

Firefox does not allow extensions to be installed from another web site besides update.mozilla.org by default. The user must specify in the options that it wants to allow extensions from a certain site to be installed, which should keep spyware low for now. Firefox users also have more computer skills than IE users. Firefox holes are filled faster than IE. All this should keep spyware low on the Mozilla platform.

PS: I believe that a recently passed bill made spyware illegal with the penality of prison, and I think that I saw on Google news something about the first spyware trial.

Re:In my oppion

[Anonymous Coward]

Crack sites and (my friend told me this) some pron sites

So you violate copyright law, but your friend merely indulges in completely legal pornography. Hm.

Re:In my oppion

[skinfitz]

What happens if your hosts file or DNS is compromised?

Re:In my oppion

[legirons]

"Crack sites and (my friend told me this) some pron sites used to have XPI install spyware (but you had to click ok to install it)"

You also have to be running Windows (or WINE) -- the XPI trojans all seem to contain just a regular windows .EXE file.

Presumably there's some way to modify this for unix-like systems, but you'd have to circumvent another layer of protection, i.e. the filesystem "executable" tag (unless mozilla does this automatically when you click "Install")

As a side-issue, I do quite like the way Mozilla makes you wait 5 seconds before enabling the "install" button -- I imagine that could prevent a lot of unintentional installs by distracted people, or those in the middle of pressing "enter" in another window when the XPI dialog appears.

Re:In my oppion

[ttldkns]

Thats why you should set your hosts file to read only. Spybot S&D does this for you but you can do it yourself too.

Re:In my oppion

[skinfitz]

Setting my local hosts file to read only stops DNS being compromised?

Wow! Tell the BIND guys that quick! ;)

Re:In my oppion

[ttldkns]

yeah, you know i was talking about your local hosts file being compromised

7 is not `only'

[mukund]

Interestingly enough, the browser section of the Windows vulnerabilities lists everyone's favorite browser Internet Explorer with 15 flaws and Mozilla with only 7.

Don't think I'm trolling but this is like saying the USA has 27,000 nuclear weapons whereas Russia has only 13,000.

Re:7 is not `only'

[26199]

That was my initial thought, too.

Then I thought, why the hell am I trying to see meaning in statistics quoted on the Slashdot front page? It would be more meaningful to flip a coin to decide which is more secure.

You'd have to actually RTFA and think about it for a while before coming to any kind of sensible conclusion. That said, past experience has me biased in favour of mozilla...

Re:7 is not `only'

[ricotest]

Also, 'flaw' is stupidly vague. There's a big difference between 'sometimes the Slashdot page isn't rendered correctly' and 'a JPEG image allows remote code execution'. From a quick look at the article, however, it covers 'vulnerabilities' which is more specific: data loss, remote code execution and crashes.

Still, I agree with the parent - this is an AvP situation. Whoever 'wins' with the least problems, we still lose.

Re:7 is not `only'

[fireboy1919]

RTFA. It's more like saying that USA has 27,000 nuclear weapons and Russia has 13,000, but they've all been disarmed.

Not only do the Mozilla vulnerabilities not actually allow much of an attack, but they've all been fixed in the latest versions of the browser.

This is not true on the Windows side, as Secunia recommends disabling or switching browsers to deal with a lot of the bugs.

Re:7 is not `only'

[mdfst13]

Not just that, but there is also overlap. I.e. most of the Mozilla vulnerabilities also apply against IE. If the basic issue were solved (for example, the JPEG flaw in MS Windows), then Mozilla wouldn't have to add code to catch OS and protocol level flaws.

The shell: vulnerability is a perfect example of this. Mozilla didn't fix anything. They simply decided that the shell: protocol was so incredibly insecure that they would disable it entirely. IE is still vulnerable, as the protocol still sucks. Now though, people using IE have to click the run from remote location button rather than "Save As" in order to get cracked.

Re:7 is not `only'

[Anonymous Coward]

SP2 fixed the shell:. Yes, I know it's only for XP.

Re:Firefox vulnerabilities IE vulnerabilities

[Anonymous Coward]

Maybe it's the fact that their browser has been the dominant browser for years, and still is? It's just that simple. Compared to firefox, their browser looks bad, but that's always the case. There's (nearly) always some small project in the wings that's better than the one that controls the market.

Re:Firefox vulnerabilities IE vulnerabilities

[superpulpsicle]

Because Microsoft wants to be in EVERY game, win or lose. They started out as an OS company, then later became an Word processing, database, browser making, video game company. M$ management is the classic "I want that Feature, because I said so" type.

That should be...

[Anonymous Coward]

Top Vulnerabilities to UNIX Systems
1. A fool with root access.

Erm no.

[colonslashslash]

Windows with 95% has 10 of the top 20 vulnerabilities Unix with 5% also has 10 of the top 20 vulnerabilities.

I think the stats speak for themselves in which is more secure. If Win boxes can take such a phenomenal market share and still only have the same number of 'top' vulnerabilities, that's putting it 19 times more secure. From the summary:

"The SANS Top 20 Internet Security Vulnerabilities list is actually a compilation of two lists--the top 10 Windows vulnerabilities and the top 10 Unix vulnerabilities."

The two lists are not competeting with each other, it is simply the top 10 win vulns, and the top 10 unix vulns, its not a top 20 list where there happen to be 10 vulnerabilities of each OS.

Re:Erm no.

[Valar]

annnndddd whhhhooossshhh.... there goes the joke.

Re:Erm no.

[mattdm]

I know -- we really need an "uninsightful" moderation.

MOD PARENT FUNNY

[Anonymous Coward]

Either he's an idiot or he's funny, I prefer to give people the benefit of the doubt :-)

Re:MOD PARENT FUNNY

[Anonymous Coward]

And if she is just an idiot, that's pretty damn funny too.

What about threats to Mac OS X?

[toupsie]

What are the major threats against Mac OS X? Granted a lot of the underpinnings of Mac OS X are BSD userland cousins, but the default install locks down the OS quite a bit. Is my Safari going to let me "owned" like IE? Should I be paying attention to the threats on Linux userland apps? Or is it all "Don't Worry, Be Happy" for Mac users?

Re:What about threats to Mac OS X?

[Anonymous Coward]

Or is it all "Don't Worry, Be Happy" for Mac users?

Let's put it this way: Robin Williams is in the next room, wearing odd costumes, jumping around like an idiot and mugging for cameras that aren't there.

Re:What about threats to Mac OS X?

[Anonymous Coward]

Given a normal install, it would take a combined Safari exploit + root exploit to 'own' your box. You should only worry about the Linux apps you're running on your machine, ie fink. A compromise of one of those would still need a root exploit, though.

Generally, with automatic update turned on, and the ocasional glance at the Apple section on /., you should be fine.

Re:What about threats to Mac OS X?

[ibennetch]

Don't worry, I went in and ran the updates for you...things are nice and secure now.

Oh, and you really should think about changing that wallpaper...it's not really work-friendly.

You were going for the Funny mod, right?

[wasted]

If not ...
The article separately lists the top 10 Windows and top 10 Unix vulnerabilities. In this case, Top 10 plus Top 10 does not necessarily equal Top 20.

Sort of like if you considered the Top 10 fastest race cars at a Nascar race and the Top 10 fastest race cars at a soapbox derby race - the resulting list wouldn't be the Top 20 fastest race cars.

I feel safe

[davesplace1]

Oh yea I feel so much safer after reading about all these security flaws :(

7<15, remote root > info disclosure, apples

[Anonymous Coward]

Apples and oranges

The number of vulnerabilities is far less important than the impact of these vuln.

btw, I reported this news yesterday^Wthis morning... but was ignored.

Re:Firefox vulnerabilities IE vulnerabilities

[Inthewire]

I thought they started out as a language company.
Shows what I know.

Rewriting the last line of the topic

[Anonymous Coward]

Interestingly enough, the browser section of the Windows vulnerabilities lists everyone's favorite browser Internet Explorer with only 15 flaws and Mozilla with 7!!!"

Re:Rewriting the last line of the topic

[SoSueMe]

It also has this little note which I find amusing:

Outlook is only installed on a machine if the user has specifically installed it, either as a standalone application, or as part of the Microsoft Office suite.

or if you install IE (service pack or upgrade) The last time I tested a IE 5.5 to 6 "upgrade", I found OE was installed as well.

Re:Rewriting the last line of the topic

[otlg]

Hrmmm.. maybe I missed something here, but: "Outlook is only installed on a machine if the ..." to which you replied: "The last time I tested a IE 5.5 to 6 "upgrade", I found OE was installed " You seem to have forgotten that Outlook != Outlook Express. I mean you might as well confuse pine and outlook or ie and mozilla. (Yes I *still* like pine :P )

Re:Rewriting the last line of the topic

[Anonymous Coward]

Outlook!=Outlook Express. Outlook comes with Office, OE comes with IE, and they both suck.

Why is OpenSSL mentioned for unix and not windows?

[Anonymous Coward]

I thought it was well known that MS copied the ASN.1 parser from OpenSSL and was vulnerable to the same flaws.

-1, Flamebait

[BorgCopyeditor]

Excellent campaign-trail mathematics! Karl Rove has a job waiting for you.

Re:Firefox vulnerabilities IE vulnerabilities

[fafaforza]

Its more like "We haven't come up with anything innovative since Windows 95, but still want to make wads of cash".

That's why they jump on anything that looks like it might be taking off. IE: their own music store, game console, etc.

More One Liners

[Eberlin]

1) Does Windows XP count as 1 flaw or 10?

2) I suppose it can't be more than 5 'cause it has to make room for Windows 2003

3) Where's Didio of yankem grope to tell us all that those *nix flaws are really SCO Unix flaws that they've copied over?

4) FLAWS? I'm all for FLOSS -- ask Perens!

5) ESR waves hand -- "These are not the ports you're looking for."

6) Security Flaws? Ha! Here in Redmond, we call it Innovation(TM) Why do you think we call it Trashwor...um, Trustworthy Computing?

IE is #1 browser

[jlefeld]

Number 1 in flaws that is.

P2P???

[Reason58]

They list peer to peer as a Windows vulnerability?! That makes about as much sense as saying me taking a sledgehammer to your computer is a Unix vulnerability.

Re:P2P???

[Anonymous Coward]

Not really. P2P applications can allow malicious code into an environment quite easily. Ask any security professional if they allow it in their environment and their answer is usually a resounding no.

Re:P2P???

[mdfst13]

"That makes about as much sense as saying me taking a sledgehammer to your computer is a Unix vulnerability."

Only if people with sledgehammers are as common as P2P use in MS Windows. This isn't a listing of default install vulnerabilities. This is a list of the most likely reasons for a system to get cracked. Apparently idiot installing P2P software is the 7th most common reason for a MS Windows box to get cracked. I doubt that DOS via sledgehammer appears very high among crack causes.

Re:P2P???

[DarkEdgeX]

Yeah but P2P is such a generic term. P2P isn't an inherent vulnerability.

Re:P2P???

[rts008]

You're correct- more often DOS via sledgehammer appears among very high crack users!

Re:P2P???

[jesser]

It makes as much sense as listing "Web browsers" as a Windows vulnerability. If you read the sections on Web browsers and P2P apps, you'll see that they're talking about specific vulnerabilities in Web browsers and P2P apps, not Web browsers and P2P apps themselves.

Re:P2P???

[mdfst13]

Neither is a browser. P2P allows for three classes of exploits, all of which they describe.

The main reason that businesses should keep P2P software off their machines is that it makes them vulnerable to lawsuits by copyright holders (the legal exploit). *All* P2P programs are vulnerable to that and the spoofed content (social) exploit. The technical exploits (which are program specific) are much less serious in comparison.

This is not a technical article. They aren't giving prizes to the best exploits. It is simply a discussion of various things people can do to minimize the exploitability of their computer systems. It includes things like being sued for copyright infringement as an "exploit" (presumably because it does harm to the system owner).

Re:P2P???

[Tony-A]

"taking a sledgehammer to your computer is a Unix vulnerability."

Yep, Unix is vulnerable. It's all a matter of degree of what it takes to smash it. Vulnerability is not a yes-no thingee. It's all a matter of degree.

One of the top ten missing

[cyberkahn]

1.) Being Slashdotted

Re:Firefox vulnerabilities IE vulnerabilities

[Anonymous Coward]

I don't think you know shit about Microsoft management.

Worst flaws?

[Anonymous Coward]

Interestingly enough, the browser section of the Windows vulnerabilities lists everyone's favorite browser Internet Explorer with 15 flaws and Mozilla with only 7."

Huh? When was the last time you heard of somebody getting infected through a Mozilla hole?

Cry "security through obscurity" all you want, it still doesn't excuse the fact that they can in no way be counted as some of "the web's worst security flaws". They'd actually have to have a widespread effect on people to even make the short-list.

Sans.org not responding - under attack?

[Anonymous Coward]

Ah, yes - Slashdotting: The Original DOS Attack

Accept no substitutes.

Re:Firefox vulnerabilities IE vulnerabilities

[Anonymous Coward]

Nope. Traffic light controller programming. The Gates III lifted the source for BASIC from the trash, his mommy arranged for him to sell an OS (MSDOS) to IBM (which Gates III then had to rush out and buy from someone else).

Re:Firefox vulnerabilities IE vulnerabilities

[westlake]

Microsoft began as a language company (BASIC interpreters for microcomputers) in 1975. Microsoft .

And you were going for the Informative mod, right?

[mobby_6kl]

well it ended up being insightful, but usually the explain-the-obvious-joke posts are moded informative.

Only?

[powerlinekid]

...everyone's favorite browser Internet Explorer with 15 flaws and Mozilla with only 7.

I don't think security flaws in something as commonly used as a web browser should ever be noted as "only" a certain number. Sure Mozilla beat IE, but the point still remains that it had 7 too many. I'll have to read this list when I get a chance and see how many of those were really windows issues and mozilla just passed the data on.

(And yes I know you'll never have bug free software)

Re:Only?

[Skater]

Uh, very few of the users of each browser are testing for security holes... I would imagine the people looking for security holes in each is about even.

--RJ

Re:Only?

[repvik]

IE is a bigger target, ie. a much more attractive target for malware writers. If I wanted to write something that installed malware through the browser, I'd target IE browser for that simple reason.
Besides, a few security holes are found by "accident". That is, the browser behaves oddly on a page, and some geek tries to figure out why and stumbles over a hole.

Re:Only?

[Anonymous Coward]

I keep hearing that crap about "no software is secure". Well, that's just not true. My box runs lshd, vsftpd, qmail, dovecot, djbdns. Let's see... that box has had one security problem (with lshd).

For added protection, all daemons are running locked down by RSBAC. So even if there are holes I have a pretty good chance of discovering the break-ins before they do damage.

Sure, there may not exist bug free software, but that doesn't mean you have to accept remote exploits.

Re:Only?

[powerlinekid]

Did I ever accept any exploits? I just said 7 is too many. Read before flipping out.

Re:Only?

[Skater]

It might be a more attractive target, sure. But, I think most of the security holes found lately have been the result of someone looking for security holes in an effort to get them fixed (or just bash IE, I dunno) rather than because an exploit was in the wild...

In other words, it seems like many of the exploits we've been hearing about lately came out only after the security hole was publicized, not before.

--RJ

The Entire 56 page report.

[Anonymous Coward]

The entire 56 page report is available in pdf. Lets be sure to slashdot both their servers:
http://files.sans.org/top20.pdf (351KB)

Re:The Entire 56 page report.

[Saturn49]

Doh. Forgot to login. Mod parent up.

Re:Firefox vulnerabilities IE vulnerabilities

[jejones]

Several reasons:

1. They wove IE into the OS for political reasons, and it's probably impractical to extract it.

2. XUL is threatening what Netscape once threatened, namely getting rid of the applications barrier to entry that preserves the OS monopoly.

3. MS can't be perceived as ever having lost. The image of the invincible monolith must be preserved.

Good job

[Anonymous Coward]

This has to be one of the least funny posts on /. in, well, days. Considering the crap that gets posted here, you can truly feel special.

Re:Good job

[Anonymous Coward]

I do feel special when someone takes the time to tell me I'm not funny. When it's so un-funny that someone feels compelled to comment on it, that's saying something. Thanks. :)

Re:Good job

[Anonymous Coward]

stop thinking ur all that just cuz of that slashbot rhyme thing u did... u need to be consistently good to make it here.

Only?

[repvik]

lists everyone's favorite browser Internet Explorer with 15 flaws and Mozilla with only 7.
Well now.. Of course IE has more known security issues than mozilla. IE is used on 94% of all PC's (IIRC). Mozilla-based browsers thus account for less than 6% (Seem to remember Opera being two percent, which brings Mozilla to max 4%).

I don't use IE. I don't like IE. But this is like comparing apples and oranges. The number of security flaws found in mozilla would probably be a lot higher if it had the same installed user-base. Why can't people get this simple fact? Why are we so dependent on bashing "the great enemy"? Get a life people...

/me watches as karma drops to previously unknown levels

Re:Firefox vulnerabilities IE vulnerabilities

[Anonymous Coward]

However, Firefox's development model is inherently better than IE's with regards to security, since the status of these vulnerabilities is known to all and they are fixed much more quickly

Unfortunately, not all Firefox vulnerabilities are known to all, and nor are they fixed "quickly".

In cases where the bug is made public, this is true. For cases where they sweep the bug in the rug and keep it from showing publicly in the bug database while they argue amongst themselves if they're really going to fix it, vulnerabilities have been left in the code for years.

13 Windows specific ports...

[Anonymous Coward]

I find it interesting how there are 13 ports that are most exploited and are specific to Microsoft products. Is it me, or does that sound like a really good reason not to run Microsoft Windows?

Re:13 Windows specific ports...

[Anonymous Coward]

Only if you are chomping at the bit looking for *any* arbitrary reason to not run Windows in the first place. If you're afraid of all the big bad exploits on the internet, unplug your rip out your NIC and/or WiFi card, and bury your computer as well as your head in the sand and you will be safe.

I guess you could say...

[rmdyer]

...that Mozilla isn't half bad! :)

Re:Firefox vulnerabilities IE vulnerabilities

[HellYeahAutomaton]

This thread is veering way off topic, and I realize this, but there are a couple of important issues here that need to be addressed. (Please don't mod me down. :)

1) Firefox is about as secure and obscure as any of the less. There are a multitude of different browsers out there now, and undeniably companies like Espial and Opera have lost a lot of ground to the popularity of Firefox. Hackers have the implicit goal of doing something because they can. Exploiting holes in a piece of software starts as a "I will see if I can do this" and may eventually turn into a "Let's see who I can #$%^ over" plan. It varies. If Firefox had the most number of seats it could still be a target.

2) MS is a business, and businesses try to make wads of cash anywhere they can. Every MS success technical success also has a large number of accompanying failures. Businesses have focus changes; some are successful and some are not. The free market (voting with dollars) decides who will be around.

Cases in point:
a) Sun started losing ground in the server market, so they started looking to Java as their next savior.

b) SGI started losing ground the in the graphics workstation market and got behind OpenGL as a standard.

c) Be, Inc changed focus from their operating system to Information Appliances and it wound them up filing for bankruptcy.

d) Apple gave up on the Pippin and the Newton, but
they started doing iPods because they wanted to have a me-too with the Rios and Creative Nomads.

e) Sony for walked right in and created its own games console when Nintendo and Sega were making cash hand over fist. It paid off for them.

f) Many companies created Doom knockoffs in the 90s and everyone and their brother now are trying to make silly bowling games for cell phones. Businesses are copycats. If they see success in an area, it is much easier to imitate (and litigate) than to innovate.

The point behind all of these stories is that you have to diversify and change directions in order to stay afloat in business; With or without any implied innovation. MS, as well as any big business has a lot of potential to stagnate, and diversifying markets is not a bad idea. MS is just one target of stagnation out of many.

Re:Firefox vulnerabilities INSIDER KNOWLEDGE???

[chewmanfoo]

Your insider knowledge is quite amazing. How on earth do you know that what you say is true? Can you quantify your allegations? If so, provide proof please. Otherwise, please keep your paranoia to yourself.

Re:Why is OpenSSL mentioned for unix and not windo

[Anonymous Coward]

I thought it was well known that MS copied the ASN.1 parser from OpenSSL and was vulnerable to the same flaws.

Because it is nowhere near the top ten for Windows.

ooh ooh, I know

[Anonymous Coward]

1. Microsoft
2. Microsoft
3. Microsoft
4. Microsoft
5. Microsoft
6. Microsoft
7. Microsoft
8. Microsoft
9. Microsoft
10. Microsoft
11. Microsoft
12. Microsoft
13. Microsoft
14. Microsoft
15. Microsoft
16. Evil virus writers
17. Microsoft
18. Microsoft
19. Microsoft
20. Microsoft

Re:Firefox vulnerabilities IE vulnerabilities

[Inthewire]

Traf-O-Data wasn't MS.
Bill and Paul chasing bugs in the Computer Center Corporation wasn't MS.

IBM wanted to buy CP/M from Digital but Kildall wouldn't come to terms.
MS did, and purchased a CP/M-like OS that they then rewrote for IBM.

Sigh

[pjt33]

The mods understood. Well, two of them. I've no idea why I was modded insightful.

Re:Sigh

[Finuvir]

I often mod funny comments as insightful if there's any way I can justify it to myself. Funny doesn't boost the karma of the poster, so I go for a mod (usually insightful) that does give the karma. Or maybe they just didn't get it.

Re:Sigh

[jrockway]

Maybe "Underrated" is a better mod choice then? If you do that, you don't have to worry about paying hell in M2. M2-ers are mostly on crack these days (the mods are fine).

Re:Firefox vulnerabilities IE vulnerabilities

[bhima]

Be, inc went out of business because of Microsoft's unethical and illegal business practices. Palm eventually won that law suit a received a tidy settlement from Microsoft.

Re:Firefox vulnerabilities IE vulnerabilities

[HellYeahAutomaton]

Microsoft did indeed have anticompetitive practices that they conceded to by paying out for the lawsuit. However, it is not the sole reason. (NetPositive still has the least number of exploits around. ;))

You cannot blame Microsoft for the fact that as a company they "shifted focus" and sent out press releases stating so. Having a business is a gamble. Microsoft took the blame because they were the biggest monopolist around.

It could have just as easily been Apple that the lawsuit was targeted at.

This is somewhat reassuring ...

[JamesR2]

... because I always believed that it was impossible that MS gathered all the insecure developers nor undervalued security that much. I believe that secure code is hard to write, period.

Windows + Linux

[Nom du Keyboard]

So when I run a Windows emulator under Linux, do I get all 20 of them?

Re:Windows + Linux

[ggy]

If so, would you get them all running Cygwin on Windows?

Re:Windows + Linux

[magefile]

This is an interesting question. If you got all 20 in one configuration but not the other, would it mean that the one with the holes was better (i.e., emulates the target OS/shell better) or worse (less secure)?

Re:Firefox vulnerabilities IE vulnerabilities

[Anonymous Coward]

In cases where the bug is made public, this is true. For cases where they sweep the bug in the rug and keep it from showing publicly in the bug database while they argue amongst themselves if they're really going to fix it, vulnerabilities have been left in the code for years.

You are saying this in regards to Firefox, but we know that Microsoft has done just such things in IE. Do you have any proof of this as regards Firefox?

Re:Firefox vulnerabilities IE vulnerabilities

[Anonymous Coward]

And by "tidy" you mean a miniscule kissoff of $23Million.

NetBIOS protection -- close port 445

[Gary Destruction]

Go into the registry to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Servic es\NetBT\Parameters You'll see a string value called "TransportBindName". The default value for that string is "\Devices\". Delete \Devices\ and reboot. Port 445 will close.

Re:NetBIOS protection -- close port 445

[Dibblah]

Someone stop this guy. Seriously. This has been available through the UI since Windows 95. Here's a hint: Windows Is Not Unix. You don't have to go looking for the config file.

7 of 7 fixed VS. 5 of 15

[Anonymous Coward]

If you have a new version of Mozilla/Firefox you are not susceptible to any of the flaws. Whereas if you have a completely patched Windows machine and are running IE, you are still susceptible to 10 of the bugs, unless you set some settings in your preferences.

A matter of attitude?

[tiger99]

If someone finds a security hole in Mozilla, it gets fixed as quickly as possible, and a patch issued. Some of these such as the shell: exploit were in fact Windoze problems which the Moz developers kindly patched around. That one was a tiny download.

But the Criminal Monopoly simply don't care either about other people's security, or about their browser, which was only intended to kill Netscape. As that has been more or less accomplished, they are simply not interested any more. What is more, in common with other Monopoly products, the underlying codebase has probably become such a mess that it would be better to throw it away and start again, but the paranoid megalomaniac Bill would have too many tantrums if someone was brave enough to tell him the truth.

No one understands security, sadly.

[Captain McCrank]

A vulnerability is a security weakness. This article goes on to list technologies that are often implemented insecurely. The difference is not so subtle that this article is exuseable. It is indicative of a much larger problem.

The first 'vulnerability' listed is "Web Servers/ Web Services." While these can be implemented insecurely, they are not implicitly security weaknesses. A more useful list would have stated implicit examples of the most common mistakes implementing the most commonly used technologies- things like open SMTP relays, DNS servers that accept false dns responses, etc.

This article is some proof showing that the security 'industry' is infected by a lot of frauds who don't even understand it's terminology.

Re:No one understands security, sadly.

[Anonymous Coward]

Hrmm, as you seem to be one of your frauds. A system that is not setup properly or configured properly is considered vulnerable, hence it has a vulnerability. Weak implementations are insecure and as such ARE SECURITY WEAKNESSES in the overall scheme of things. Perhaps you need to go back to school..

Re:No one understands security, sadly.

[Anonymous Coward]

After reading this post and a few of your other posts, it becomes clear to me that YOU are another one of those CISSP bandwagon info sec guys. It's easy to act big and bad while criticizing others work. You need to take a look at some of the people who contributed to the SANS Top 20. There are a lot of bright security people who ACTUALLY know security. SANS dictates how they want the list shaped and molded. For you to make a generalization about something such as the Top 20, really shows your inexeprience in the info sec industry. Hey I have an idea.. next year why don't you help write the list out so the industry can be saved by someone who apparently is a security genius.. pffft

Re:Firefox vulnerabilities INSIDER KNOWLEDGE???

[Cereal Box]

The parent poster is actually correct. I'm not going to go to the trouble of digging up the links right now, but if you go back and look at the past few Firefox vulnerability Slashdot stories you'll see the links to Bugzilla that state that many of the problems (for instance, the shell: exploit) have not only been known for years before being fixed, but only had their status changed from "confidential" to "public" soon after the fix was released.

Might be a silly question

[Pop69]

"Outlook Express (OE) is a basic email & contact management client, bundled with Internet Explorer since the earliest versions - which itself has been an integral part of all versions of Microsoft Windows starting with Windows 95"

Didn't MS start bundling IE with Windows 98 ?

Re:Might be a silly question

[Anonymous Coward]

There was a version of Windows 95 that came with IE3, until then the browser was a separeted application, not integrated to the sistem.

Windows 98 came with IE integrated to the Explorer shell.

Re:Might be a silly question

[Pop69]

That must be what I'm thinking of. I knew my original 95 didn't have IE anywhere near it.

Re:Might be a silly question

[JudicatorX]

Win95 original... no

But OSR2.1 had IE 4 tightly integrated

mode the parent down for fu**'s sake

[Anonymous Coward]

wtf?????????? this shit is trolling, it's not even funny. somebody mod this idiot down.

"Only 7" for Mozilla compared to IE

[Anonymous Coward]

Uh, isn't anyone else a little bothered by the fact that Internet Explorer, used by like 95% of the web, has 15 vulnerabilities, but Mozilla which is only in the 1% or so percentile (according to Zeitgeist when it was back up) already has 7 major vulnerabilities? You'd think such a relatively less-used program compared to IE wouldn't have close to half of IE's vulnerabilities already. It really hasn't been good for Mozilla/Firefox lately.

Interesting quote from the article

[RodeoBoy]

To date no security exposures have been identified in IIS 6.0

Re:Interesting quote from the article

[Proudrooster]

That's what THEY want YOU to believe. The hackers have just figured out it's more profitable to exploit security holes for "protection money" than it is to write virii that cripple the Internet. I am sure the IIS has plenty of holes.

In fact Microsoft's latest security hole requires IIS5 or IIS6.

Re:Interesting quote from the article

[RodeoBoy]

Nice try, but IIS 6 is not effected by this exploit. The article you liked to said that you require IIS 5 5. or 6 to install, but if you read on the exploit a bit more you would of found out that IIS is not effected. Also the exploit is based on a simplistic securtiy model based on checking the URL. Any real application does explicit check in the code of each page that needs to be secured not some general check of a url.

TROLL

[Anonymous Coward]

TROLL
TROLL
TROLL
rebeka thomas is a TROLL

The Slashdot's 2 Worst Colour Flaws

[Anonymous Coward]

http://shit.slashdot.org/article.pl?sid=04/10/09/1 728243

Really?

[ScrewMaster]

ONLY 7?

I was going for the "Genius" mod, but lost..

[wasted]

..that one big time.

Actually, the original post was marked Interesting with no children when I replied, and I thought to myself, "That can't be right! It probably should be Funny!" So I spent too long typing, and ended up with Insightful. If I type any worse, I'm going to have GREAT karma without trying.

Re:Firefox vulnerabilities IE vulnerabilities

[Anonymous Coward]

This is slashdot. Nobody knows shit about anything here. The trick is to make it look like you know slightly less shit than the person you're arguing with.

Re:Firefox vulnerabilities IE vulnerabilities

[tomhudson]

And Traf-O-Data was just smoke and mirrors, anyway. Turns out that the Gatester's widely-reported first foray into computer services never made a dime - the $20,000 contract reported in most biographies turned out to be a bit of "feature enhancement".

Re:"Only 7"

[Anonymous Coward]

Personally, I'm startled by the idea that you would continue to post here when you obviously hate Slashdot, its clientelle, and every it stands for.

Why don't you go post on a pro-M$ site. I'm sure you'll find you get a much warmer reception there.

Re:Firefox vulnerabilities IE vulnerabilities

[drsmithy]

Be, inc went out of business because of Microsoft's unethical and illegal business practices.

Be went out of business because no-one bought their OS. One of the main reasons no-one bought their OS was because it never made it out of beta.

what are missing from the list...

[quetzalc0atl]

...are:

1) Sun's default echo '+ +' > ~/.rhosts
2) NIS
3) NFS

these things led to massive compromises

U3. Authentication

[Dunkirk]

I think it's pretty telling that the #3 issue on *nix is about how to make good passwords. That's a completely meat-space issue, not code. In fact, a solid half of the *nix list is just good administration practices.

Funny

[Pan T. Hose]

They include things like week passwords and non-web network threats.

But surely changing your passwords every week is good? (Well, against external attackers - not so good against internal attackers if you have to write your password on a PostIt and stick it to your monitor).

Great pun, but seriously, this reminds me of one story. There was a web-based service to conveniently change personal pages of people working in the lab (photo, bio, links to projects) where everyone were usually logged-in permanently with never-expiring cookies (much like Slashdot). One day some students defeced the info page of one professor changing his photo to goatse.cx picture. I have done the investigation (eventually leading to expelling said students and further prosecution for sexual molesting--it was a public network with unfiltered access from the library used by minors) and what I have found out was that they broke into the account by sniffing a password from HTTP traffic while the victim was changing it for security reasons! I checked it and she was the only person who kept changing her password. The password was a random string of 32 alphanumeric characters, changed every morning. Other people had passwords like "pass," "clit" or "arse" (I kid you not!) but those accounts were not broken into since those passwords were not changed periodically via HTTP, effectively remaining secret. The only person paying attention to security was the least secure one. Interesting, is it not? Since that very incident I always keep saying that security layers are like the layers of onion indeed, but it is a rotten onion.

Re:Funny

[pjt33]

Why do they need to sniff the password if they can sniff the cookie? Surely the cookie wasn't sent over SSL and the password in plaintext.

Simple

[Pan T. Hose]

Why do they need to sniff the password if they can sniff the cookie? Surely the cookie wasn't sent over SSL and the password in plaintext.

It wasn't sent over SSL but of course it wasn't a simple:

Set-Cookie: LOGGED_USER=name; ...

but instead included enough information about the client encrypted and signed by the server that simply sending the same data by anyone else wouldn't work.

As an example please consider this simplified idea: the server verifies the password during the login and has to set the session cookie but instead of setting SESSION=username it sets the cookie to SESSION=$session where $session is:

$session = "$username:$signature";

while the $signature is:

$signature = md5_hex("$username:$ip:$secret");

With the $ip being the client's IP address and $secret being some secret string. Now, every time the client sends such a cookie, the server computes the $signature and compares it with the one in the cookie itself, thus making it impossible to use the cookie with someone connecting from a different IP. Of course I am greatly simplifying, but even such a poor man's digital signature using MD5 with a secret value can be quite effective, especially when more info is used.

Of course if the attackers were smarter they would try to invalidate the sessions of other logged-in users, thus forcing them to reauthenticate with their passwords, trying a monkey-in-the-middle attack, hijacking their TCP sessions, etc. but if they were smarter, they wouldn't insert pornography into public websites, now would they?

That's not 'security through obscurity'

[ekhben]

Firefox may be relatively obscure, as far as a browser goes, but the ways in which it attempts to be secure are not obscure. The source code is there for all to read. Oh... maybe you meant security through obfuscation?

Re:"Only 7"

[Anonymous Coward]

Personally, I'm startled by the idea that such a widely-used program as IE only has 15 (~98% web share), while such a little-used program like Mozilla (in comparison, of course) already has 7.

Only a true Microsoft fanboi could take something like the number of security holes in IE and attempt to spin it into something positive. Not to mention the numbers that you pulled out of your ass (IE has ~98% marketshare? Really? Not according to the stats on *my* webserver).

Little used or no, (again, I'm seeing the share of it going *up*) that has absolutely *nothing* to do with the fact that IE has more security holes than Mozilla.

Greatest security flaws...

[John Allsup]

1. Micro$oft internet explorer
2. Micro$oft lookout!
3. Micro$oft lookout express
4. Micro$oft windows
5. Micro$oft internet explorer
6. Micro$oft windows
7. Micro$oft internet explorer
8. Micro$oft lookout!

Re:Firefox vulnerabilities IE vulnerabilities

[mad_goldfish]

MS can't be perceived as having lost, so why not remind everyone that their database is called Access in order to cover up an older program.

Re:"Only 7"

[Anonymous Coward]

Urine1diot, don't you have anything better to do?

Re:"Only 7"

[Anonymous Coward]

Still trolling anonymously, Urine1diot? Wow, your webserver globally represents the worldwide web. Can't argue with that kind of research.

Re:"Only 7"

[Anonymous Coward]

I'm sure he or she does, whoever he or she is bonch. Don't you have anything better to do (like trolling slashdot with yet another troll account)?

Re:"Only 7"

[Anonymous Coward]

Wow, your webserver globally represents the worldwide web

It's certainly more substantial than the numbers you pulled out of your ass, bonch. Why don't you give it up?

First you thought it was Disevidence that was following you and now you thinks its Urine1diot? You might take a look at this list for more likely suspects. Moron.

Hrm. If you reason like that...

[BrokenHalo]

... Then you can't reason at all.

That's a lot like saying 25% of road accidents are caused by drunk drivers, therefore 75% of accidents must be caused by sober drivers, and therefore you're safer driving drunk than sober.

Re:"Only 7"

[Anonymous Coward]

"Give it up?" This coming from the person who denies that he has two other troll accounts? Whose said troll accounts are now all posting at -1? Give it up?

Seriously, dude, you need to get a life.

(posted by someone who is NOT Disevidence or Urine1diot or anyone else on this list.)