Slashdot Mirror
The Web's 20 Worst Security Flaws
XsynackX writes "The SANS Institute released its Top-20 list of the biggest vulnerabilities on the web today. The SANS Top 20 Internet Security Vulnerabilities list is actually a compilation of two lists--the top 10 Windows vulnerabilities and the top 10 Unix vulnerabilities. The list goes into almost more detail than any one person could ever take in on individual security flaws, but provides a wealth of knowledge for those who like to get in-depth. Interestingly enough, the browser section of the Windows vulnerabilities lists everyone's favorite browser Internet Explorer with 15 flaws and Mozilla with only 7."
These flaws cover more then just "the web".
They include things like week passwords and non-web network threats.
---- join dshield.org Distributed Intrusion Detec
Fortunately for now, security through obscurity prevails for Firefox, since most exploits will likely target IE users. However, Firefox's development model is inherently better than IE's with regards to security, since the status of these vulnerabilities is known to all and they are fixed much more quickly. Why Microsoft is still in the browser game with their lame, few-and-far-between updates is beyond me.
Is slashdotting a vulnerability?
...Internet Explorer with 15 flaws and Mozilla with only 7
Err... at this point, does it really matter? It's useful to compare BIND against djbdns (many security flaws vs. none), or Linux against OpenBSD (many security flaws vs. one remote hole in 8 years), but 15 flaws vs. 7 flaws? To me, that just says that both browsers are horribly insecure, and slightly more effort has been put into finding flaws in MSIE.
Tarsnap: Online backups for the truly paranoid
...seems to feel that posting a link to it on slashdot is a vunerability.
How many computers are too many?
Windows with 95% has 10 of the top 20 vulnerabilities
Unix with 5% also has 10 of the top 20 vulnerabilities.
I think the stats speak for themselves in which is more secure. If Win boxes can take such a phenomenal market share and still only have the same number of 'top' vulnerabilities, that's putting it 19 times more secure.
RST
Doesn't everyone that reads /. know that MS IE is a gaping security vulnerability by now. Do we *really* need to keep harping on it like a bunch of smug self-righteous motherfuckers?
I've always said that spyware was caused due to Internet Explorer being so popular.... If firefox keeps the rate of growth its doing I don't think it will be that long into we see spy/malware targeting Firefox as well....
Loading Please Wait....
Interestingly enough, the browser section of the Windows vulnerabilities lists everyone's favorite browser Internet Explorer with 15 flaws and Mozilla with only 7.
Don't think I'm trolling but this is like saying the USA has 27,000 nuclear weapons whereas Russia has only 13,000.
Banu
Because Microsoft wants to be in EVERY game, win or lose. They started out as an OS company, then later became an Word processing, database, browser making, video game company. M$ management is the classic "I want that Feature, because I said so" type.
Top Vulnerabilities to UNIX Systems
1. A fool with root access.
I think the stats speak for themselves in which is more secure. If Win boxes can take such a phenomenal market share and still only have the same number of 'top' vulnerabilities, that's putting it 19 times more secure. From the summary:
"The SANS Top 20 Internet Security Vulnerabilities list is actually a compilation of two lists--the top 10 Windows vulnerabilities and the top 10 Unix vulnerabilities."
The two lists are not competeting with each other, it is simply the top 10 win vulns, and the top 10 unix vulns, its not a top 20 list where there happen to be 10 vulnerabilities of each OS.
She's built like a steak house, but she handles like a bistro....
What are the major threats against Mac OS X? Granted a lot of the underpinnings of Mac OS X are BSD userland cousins, but the default install locks down the OS quite a bit. Is my Safari going to let me "owned" like IE? Should I be paying attention to the threats on Linux userland apps? Or is it all "Don't Worry, Be Happy" for Mac users?
Strange women lying in ponds distributing swords is no basis for a system of government.
If not ...
The article separately lists the top 10 Windows and top 10 Unix vulnerabilities. In this case, Top 10 plus Top 10 does not necessarily equal Top 20.
Sort of like if you considered the Top 10 fastest race cars at a Nascar race and the Top 10 fastest race cars at a soapbox derby race - the resulting list wouldn't be the Top 20 fastest race cars.
I thought they started out as a language company.
Shows what I know.
Writers imply. Readers infer.
They list peer to peer as a Windows vulnerability?! That makes about as much sense as saying me taking a sledgehammer to your computer is a Unix vulnerability.
...everyone's favorite browser Internet Explorer with 15 flaws and Mozilla with only 7.
I don't think security flaws in something as commonly used as a web browser should ever be noted as "only" a certain number. Sure Mozilla beat IE, but the point still remains that it had 7 too many. I'll have to read this list when I get a chance and see how many of those were really windows issues and mozilla just passed the data on.
(And yes I know you'll never have bug free software)
can't sleep slashdot will eat me
The entire 56 page report is available in pdf. Lets be sure to slashdot both their servers:
http://files.sans.org/top20.pdf (351KB)
Several reasons:
1. They wove IE into the OS for political reasons, and it's probably impractical to extract it.
2. XUL is threatening what Netscape once threatened, namely getting rid of the applications barrier to entry that preserves the OS monopoly.
3. MS can't be perceived as ever having lost. The image of the invincible monolith must be preserved.
However, Firefox's development model is inherently better than IE's with regards to security, since the status of these vulnerabilities is known to all and they are fixed much more quickly
Unfortunately, not all Firefox vulnerabilities are known to all, and nor are they fixed "quickly".
In cases where the bug is made public, this is true. For cases where they sweep the bug in the rug and keep it from showing publicly in the bug database while they argue amongst themselves if they're really going to fix it, vulnerabilities have been left in the code for years.
This thread is veering way off topic, and I realize this, but there are a couple of important issues here that need to be addressed. (Please don't mod me down.
1) Firefox is about as secure and obscure as any of the less. There are a multitude of different browsers out there now, and undeniably companies like Espial and Opera have lost a lot of ground to the popularity of Firefox. Hackers have the implicit goal of doing something because they can. Exploiting holes in a piece of software starts as a "I will see if I can do this" and may eventually turn into a "Let's see who I can #$%^ over" plan. It varies. If Firefox had the most number of seats it could still be a target.
2) MS is a business, and businesses try to make wads of cash anywhere they can. Every MS success technical success also has a large number of accompanying failures. Businesses have focus changes; some are successful and some are not. The free market (voting with dollars) decides who will be around.
Cases in point:
a) Sun started losing ground in the server market, so they started looking to Java as their next savior.
b) SGI started losing ground the in the graphics workstation market and got behind OpenGL as a standard.
c) Be, Inc changed focus from their operating system to Information Appliances and it wound them up filing for bankruptcy.
d) Apple gave up on the Pippin and the Newton, but
they started doing iPods because they wanted to have a me-too with the Rios and Creative Nomads.
e) Sony for walked right in and created its own games console when Nintendo and Sega were making cash hand over fist. It paid off for them.
f) Many companies created Doom knockoffs in the 90s and everyone and their brother now are trying to make silly bowling games for cell phones. Businesses are copycats. If they see success in an area, it is much easier to imitate (and litigate) than to innovate.
The point behind all of these stories is that you have to diversify and change directions in order to stay afloat in business; With or without any implied innovation. MS, as well as any big business has a lot of potential to stagnate, and diversifying markets is not a bad idea. MS is just one target of stagnation out of many.
So when I run a Windows emulator under Linux, do I get all 20 of them?
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
Go into the registry to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Servic es\NetBT\Parameters
You'll see a string value called "TransportBindName". The default value for that string is "\Devices\". Delete \Devices\ and reboot. Port 445 will close.
But the Criminal Monopoly simply don't care either about other people's security, or about their browser, which was only intended to kill Netscape. As that has been more or less accomplished, they are simply not interested any more. What is more, in common with other Monopoly products, the underlying codebase has probably become such a mess that it would be better to throw it away and start again, but the paranoid megalomaniac Bill would have too many tantrums if someone was brave enough to tell him the truth.
To date no security exposures have been identified in IIS 6.0
Great pun, but seriously, this reminds me of one story. There was a web-based service to conveniently change personal pages of people working in the lab (photo, bio, links to projects) where everyone were usually logged-in permanently with never-expiring cookies (much like Slashdot). One day some students defeced the info page of one professor changing his photo to goatse.cx picture. I have done the investigation (eventually leading to expelling said students and further prosecution for sexual molesting--it was a public network with unfiltered access from the library used by minors) and what I have found out was that they broke into the account by sniffing a password from HTTP traffic while the victim was changing it for security reasons! I checked it and she was the only person who kept changing her password. The password was a random string of 32 alphanumeric characters, changed every morning. Other people had passwords like "pass," "clit" or "arse" (I kid you not!) but those accounts were not broken into since those passwords were not changed periodically via HTTP, effectively remaining secret. The only person paying attention to security was the least secure one. Interesting, is it not? Since that very incident I always keep saying that security layers are like the layers of onion indeed, but it is a rotten onion.
Sincerely,
Pan Tarhei Hosé, PhD.
"Homo sum et cogito ergo odi profanum vulgus et libido."