Slashdot Mirror
Unpatched Linux Lives 3 Months on Internet
Allnighterking writes "The Honeypot project Honeynet.org has released their study on the expected lifetime of an unpatched default Linux install. If some of you remember AvanteGarde recently did a study of its own with several versions of Windows products and found that the average lifetime was about four minutes. Internet Week has an article on the study and the PDF with the full details of the study is available on Honeynet.org. Needless to say, from my viewpoint this is a good reason to limit Windows installations in IT that any PHB and/or Smiling Man can understand. Have them put into a spreadsheet and see what this kind of security means to their bottom line."
That value would depend on the distro and its age.
Note that the distros they used were basically just Red Hat variants (RH7.2, 5*RH7.3, RH8.0, 8*RH9, 2*FC1) and Suse (6.3 and 7.2). Suse is very similar to Red Hat, and Red Hat is what my friends call "Microsoft Linux" as it doesn't exactly excel in security.
It would be an interesting thing to see how the other dists would fare. I suspect Debian and Gentoo should survive quite a bit longer than those 3 months. After all, a default minimal Debian Woody installation is 34MB, compared to 0.5GB of Red Hat, and this means you simply don't have that many unnecessary services that can fail.
The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
From TFA:
Windows XP SP1 with the for-free ZoneAlarm firewall, however, as well as Windows XP SP2, fared much better. Although both configurations were probed by attackers, neither was compromised during the two weeks.
Also:
The Macintosh machine, on the other hand, was assaulted as often as the Windows XP SP1 box, but never was grabbed by a hacker, thanks to the tunnel vision that attackers have for Windows. "The automated bot/worm attackers were exclusively using Windows-based attacks," said Colombano, so Mac and Linux machines are safe. For now. "[But] it would have been very vulnerable had code been written to compromise its system," he added
And finally and most importantly:
"No machine is immune," he counseled. "No human is safe from every virus, and it's the same for machines. That's why people have to have some personal responsibility about security. You have to be a good citizen on the network, so you're not only protecting yourself, but others who might be attacked from exploits originating on your machine."
Yep, WinMe Boots almost as fast as it crashes.
Mu
Although exploits of facilities implemented in standard linux kernels, such as arp requests or ICMP echo requests, are possible, they are far rarer than exploits of higher-level network services, such as HTTP or SSH. Consequently, a basic install of a distribution such as Gentoo, in which only those basic network services implemented in the kernel are active, would likely remain unexploited for years. Of course, this only shows that in the case of Linux, the `base install' does not provide for a very good test. (In practice, people are far more likely to use Microsoft Windows, or Linux distributions with a more expansive `base install' than Gentoo or Debian, in their base configurations.)
I'll get modded flamebait for this, but...
The Linux box wasn't compromised because it was being attacked as if it were a Windows box.
Therefore, in this case, the article is suggesting that Linux is secure because it is *obscure*. Linux can't be hacked because nobody would want to/nobody knows how to because it's so rare in comparison to Windows = Security through Obscurity.
Microsoft also uses this practice by threatening to sue anyone who exposes a vulnerability in their OS, and by hiding their source code. Hiding source code and vulnerabilities = Security through Obscurity.
I find it morally offensive that Linux hacks are trying to pass of Linux as secure on exactly the same grounds that Microsoft uses to try and keep their own leaky OS as private and secure as they can. Thankfully the author is sensible enough to write a few disclaimers, but as usual, the Slashdot submitter decided to omit that for the sake of sensationalism (and for a quick boot into Microsoft because we all like that).
I bet I could put an unpatched Windows 3.11 box on the internet, too. I bet no-one would hack that. I'd suggest more people are out trying to exploit even Linux or Mac than old Win3.11/DOS. Or how about an OS/2 box? I bet that would last even longer than Linux. Perhaps we should all switch to OS/2?
I am government man, come from the government. The government has sent me. -- G.I.R.
Why do they use unpatched boxes in these types of tests? It just doesn't make a good security test, IMO. Why don't they setup a Linux box and a Windows box, and patch them both. Set up automatic updates in Windows, and a cron job on Linux to download updates nightly. Maybe install a few server processes just for fun (mail, web, ftp, and file shares / samba services for instance). Open the ports for those services, and block everything else with the vendor's firewall. I bet both boxes would stay un-hacked for years.
Not exactly. I don't want to be an MS apologist, but the TCSEC rating that MS got for Windows NT was indeed while it was not connected to a network. We all agree that is rather useless these days. The problem was the TCSEC (Orange Book) certification; it specifically does not cover networked systems. Networks are covered by the Red Book. This problem is one of the reasons the Common Criteria was created, which can certify systems including networks.
Last time I moved I set up my laptop running Win2K on my new DSL connection without a firewall. It was just for 5-10 minutes or so, to set up the connection. Within those few minutes, I managed to pick up a worm. This was even with most of the latest patches already installed.
Firewalls/NAT greatly cuts down on your risk. Running firefox pretty much gets rid of the rest. But if you put Windows on the internet without a firewall and you're not a security expert who has done a thorough audit of your machine, you're asking for trouble.