Slashdot Mirror
Linux Getting Harder To Crack
AlanS2002 points out today's article from Iain Thomson on vnu.net, which says that "Linux systems are getting tougher for hackers to crack, security experts have reported today," summarizing "A study conducted by the Honeynet Project has found that it takes about 3 months before a unpatched Linux machine will be owned, compared with about 72 hours in the past. According to a report on the study default installations are now more secure with less services enabled by default, added to this is newer versions of software such as OpenSSH being more secure. Interestingly Solaris 8 and 9 did not fare so well."
Yes this story has already been posted. But don't worry! Since there is no link to Netcraft it will be duped again when there is official confirmation!
AntiFA: An abbreviation for Anti First Amendment.
I cracked a linux box in 30 seconds... ...with a hammer
There is no sig
it takes about 3 months before a unpatched Linux machine will be owned
Maybe I'm wrong, but shouldn't it be pwnd or 0wned or 0wn3d or 0\/\/|/|3|) or some variation on that instead of owned
Boxing Equipment Reviews
"A study conducted by the Honeynet Project has found that it takes about 3 months before a unpatched Linux machine will be owned, compared with about 72 hours in the past."
"A study conducted by the Honeynet Project has found that it takes about 3 minutes before a unpatched Windows SP2 machine to be owned, compared with about 72 seconds in the past.
I am happy to hear this, as I run a linux box. These reports are mostly moot, however, because a router will deter all but hackers with a reason to pwn your box, and there is little reason to do so to a home computer. My unfirewalled SP1 Windows XP box has faired similarly to my linux box, with just a bit of spyware.
That should read "with _fewer_ services".
We support all versions of Solaris for some software but it's honestly started to bug everyone that some places are running pre-5.
Solaris 10 is supposed to be much 'safer'. We'll see.
Im now going to switch to OS/2! nobody uses that so it ought to be super secure!
SCO is the easiest to crack judging from all of the smoking going on there....
My day job's in a big hosting facility, and it was a surprise when setting up RHEL 3.0 that it had by default quite the restrictive iptables ruleset which let very little besides SSH through, and pam_tally was set up in the install, so 5 login failures locked out the account.
Quite refreshing to see, since I was doing the install for a customer who'd decided to go for a reimaging because their machine had been compromised.
500GB of disk, 5TB of transfer, $5.95/mo
Comparing new and revised Linux installs to old and decrepit Solaris 8 & 9 installs. Distros release new versions at least once a year while Solaris 9 was released... when? A couple years ago? A default install with patches from the last 6 months versus a default install that is 2 years or so stale. Which one wins?
DUH!
Here's a summary:
(Ranked from most crackable to least crackable)
Linux>Solaris>Glass>Windows
De John Wisniewski - a memorial
The game began at 10 a.m. on Friday. The VMS machine on the Green team was configured with Apache web server. As we are aware, VMS is an extremely secure operating system. While many of the other boxes in the room, mostly Unix, linux, and forms of windows, and even a Macintosh, were compromised and subsequently attended to by their masters, the VMS system remained intact. Here is where a real security issue comes into play.
We were very confident of the VMS box, and a lot of interest was generated by it. In the spirit of spreading the good word and educating the people about VMS, we ended up answering a lot of questions about VMS, and showing how the machine automagically added user accounts, and demonstrated the various terminal games and web pages which had been created. We were also aware that, in this crowd of 5000+ hackers, someone might be able to weasel their way into the machine if any security measures were taken lightly.
As events would have it, we had an issue, which we did not understand, with the operation of the serial port used as the operators' console. At 2:00 a.m. Saturday morning the system manager decided to telnet to the box in order to do some routine checks. Using Telnet in an environment with 5000 hackers on your network is an insecure method of administering a computer system. A lot of people were fascinated by the VMS system, and had asked many questions about it, shoulder-surfing the console operator, who of course answered their questions in this friendly game of an environment.
One of the hackers who had been showing a lot of interest in the VMS box happened to be sniffing packets from the system manager's PC. He discovered the password to the account, a simple procedure any 13 year old kid can pull off with ease after a little social engineering. The hacker logged in, and placed a couple text files (his mark for points) in the manager's user directory, and then notified the system manager in order to claim the points. There were no points for hacking the machine because the files were placed in a user directory instead of the `root' VMS directory. He was awarded 10 points for social engineering.
Was this an instance of VMS being hacked? No, it was just a circumstance where a privileged login session was passed in plaintext over a network with 5000 mechanics, social engineers, and hackers on it. By using a telnet session on an open network, the system managers' login information was freely made available to any who cared to record it. Giving away your login info in this way to a hacker who subsequently uses it does not constitute being hacked, it constitutes an error in security procedure. The thought of improved security, such as some level of encryption for telnet on VMS, immediately comes to mind. Be very afraid.
The Alpha was disconnected from the haxor network, the serial port issue (our fault alone) was fixed, and the network was reconnected. The incident did not repeat, nor did any hack whatsoever of the VMS system take place during the event. The hackers bombarded the box with telnets and ftp attempts to every bizarre port number imaginable, obscure ports in the 40,000 range and more. The word of the early-morning incident had spread, and those seeking glory and a reputation besieged the box.
Another kind of social engineering, involving a clever lie intended to trap those who would think it cool to hack the NOC was presented in this way: People came by, with an IP address, saying, "here is the IP address for the NOC, have fun". It was really an outside IP address, and this was a ruse to make those who listened loose points for attacking sites outside the defcon network. Hacking outside the CTF network was forbidden.
As the game progressed, the goons announced that there were not enough hackers (huh? The tables were *full* of people). To make it more enticing, the point award for placing your mark in the root directory of a server
The number of variables in this study are not even remotely controlled. There are no sensible conclusions you can draw from this, except that an unpatched systems are susceptible to attack and that there are still people out there who are attacking susceptible systems. For all we know an increase in the cost of beef in Tokyo is encouraging the russian mafia to hire more hackers to fake livestock reports and therefore there's less hackers available to attack the useless machines involved in these tests.
How we know is more important than what we know.
RE:A study conducted by the Honeynet Project has found that it takes about 3 months before a unpatched Linux machine will be owned.
:^)
that an unpatched box they tested, i bet a patched, and locked down & firewalled Linux box is nearly impossible to crack...
good news for Linux
I just read an article at the Register (linking to an old article on http://www.usatoday.com/money/industries/technolog y/2004-11-29-honeypot_x.htm about un-patched XP sp1 machines only surviving for 4 minutes when connected to a broadband connection. Within 10 hours the hackers had an IRC channel running on the machines.
Tongue: A variety of meat, rarely served because it crosses the line between a cut of beef and a piece of dead cow.
The article doesn't say whether the Windows boxes were running XP Service Pack 2, which implements a bunch of lock down policies in addition to patching the usual assortment of buffer overflow vulnerabilities. It's well known that XP's security was abysmal before SP2 so I'd be more interested in seeing the results with the lockdowns.
Well they list it in the list but give no data on it what so ever. So one is to assume FreeBSD was never hacked from the data presented (or lack thereof). Way to go BSD!
i have said it before and i will say it again: only because more and more people stand up to state how superior and ultra-safe linux is, won't necessarily make it so!
...) ...). therefore it is as questionable a time to glorify linux as it will ever be.
if it is indeed true what this study claims then i am the first to applaude the kernel guys and the distribution makers.
but there are facts that won't change:
- software monoculture is BAD (no matter what the monoculture consists of)
- linux is NOT the safest alternative out there (compare *BSD, VMS,
- there have been an alarming number of exploits as well for the kernel itself (local root exploits, anybody) as also many exploits for user land applications (mplayer, mpeg123, mozilla,
SECURITY IS A PROCESS NOT A STATE!
please, dear media (and also dear slashdot), make an effort to educate people in security matters instead of putting some solution on the "security pedestal". don't make claims about the absolute security of any alternative.
the complete solution is what makes and breaks security, not the components, and without adequate, highly trained and proficient personell it will always be near impossible to achieve truly secure (whatever THAT means) solutions.
well, at least the uprising unices make it easier for the proficient and maybe even raise the security bar for the amateurs, but alas this is not an end to itself!
jethr0
And most of the spam I see is from home machines that have been cracked (zombies).
Not to mention the DDoS zombies out there.
They'd be happy to get your credit card info off of your home machine, but they attack to turn you into a zombie with bandwidth.
Solaris 9 (while we wait for the 'open-source' 10) is in current use in 'enterprise' situations.
So presumably any compromises of Solaris production system may mean big-trouble for it's operating companies.
This, I would suggest is the reason for the comparison.
Ripping an new rectum in the fabric of spacetime.
Stop nagging, I'll get to it.
Way to go Apple !!!
If users don't care about being penetrated because deep down they have homosexual tendencies which override common sense.........SHUT UP!
BULLSHIT
Apple apologists are one thing, but did you go out of your way to ignore every single security patch that has been inssued in the last several years?! There are tons of exploits
Seeing as you (unbelievably) can't even spell "OS X" properly, I'm not even sure you've ever USED a Mac
Sorry to feed the troll here but:
What about Apple's OS/X ?
No know exploits. Uncrackable.
**NOTHING** is "uncrackable" A machine may be less crackable, or diffucult to crack but as long as it's connected to a network it is crackable. It may take longer than the lifetime of the universe to do it, but it is possible.
I suppose in the same sense, even things that arn't connected to the network are crackable, but that requires mission impossible like stunts.
My UID is prime and so is this number: 09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0.
Parding is such suite sorrough...
Solaris' default install is geared more toward internal datacenter environments. A small amount of hardening effort (e.g., paring
-- Microsoft is the most expensive commodity operating system and office suite vendor in the marketplace.
This is just another example of how hardening keeps your servers from getting compromised. Red Hat and SuSE Linux systems now ship with every remote service in xinetd deactivated and most have a default firewall active at installation. This partly reflects the lessons we've learned with Bastille Linux, a hardening program for SuSE, Debian, Fedora, RHEL, HP-UX, and OS X. What's interesting is that while new releases of HP-UX are shipping with Bastille pre-loaded and runnable at installation, giving the user easy hardening at install time, Sun's still been releasing servers with 50+ network ports listening, including deprecated services like tnamed (Trivial named). The Linux vendors have been leading the older Unix vendors, mostly because users influence them more. But hardening is becoming a more popular practice in all operating systems now... - Jay Beale
I meant, Windows discontents.
I am still right bahahaha
Linux failed it. It was a good idea, too bad it sucked.
Why even bother testing unpatched Solaris when Sun specifically tells you to patch your boxes? It's like never changing your car's oil and then complaining that it breaks down too often. It's almost, but not quite, as stupid as complaining your burrito is frozen because you didn't read the microwave directions.
Don't blame me, I didn't vote for either of them!
It may take longer than the lifetime of the universe to do it, but it is possible.
Well, you better hurry up and get started then.
Erm, maybe it has something to do with the fact most of the worms / exploits out there are just tried-and-true for Windows, and that Linux isn't neccisarily more secure in this sense, but rather, harder to put a finger on the default configuration and thus exploit?
It's been discovered that it takes about 3 months before an owned Windows machine will be patched.
Did he mean "firewall" instead of "router"?
I don't think he did because he refered to his "unfirewalled SP1 Windows XP box".
Unless he refers to a NAT'ing device as a "router".
Would you care to be more specific as to those "obvious reasons"?
The higher the technology, the sharper that two-edged sword.
Can you cite an "OS X" exploit?
:-)
Just buy a mac
http://shit.slashdot.org/article.pl?sid=05/01/18/0 218242
"Ahem, journalistic professionals, it should read, "...Solaris did not _fare_ so well.""
Oh CRAP!! I totally misunderstood that sentence!
"Derp de derp."
Actually, that was referring to the carnival last week in which some Sun representatives were kicked out after yelling "Linux sucks, use Solaris, Java r0x0rs!". Apparently, then, all the workers for the Sun attaction left, and it was taken over by some script kiddies and used to serve cotton candy.
Most of the default services that run on common Linux distributions aren't specific to Linux itself, i.e. you can run apache, openssh, sendmail, etc on a BSD system just as easily as you can on a Linux system.
Granted, the underlying operating system can and does affect the exploitability of bugs that exist in these services, but the system comprimise is more of a direct result of the daemon than it is the underlying operating system.
In fact, the hardware of the system can and does have just as much or more influence over the exploitability of many daemon bugs as the operating system does, yet I see no mention of what architecture these honeypot boxes were running on in Honeypot Project's report.
"Fare," god damn it. Not "fair".
If aspiration is a virtue, achievement cannot be a vice.
of course solaris 8 and 9 didn't fare as well as Linux: you have to wait for Solaris 10 to get the magic open source effect on security;-)
SLASHDOT: news for people who can't concentrate on work or have no life at all and got tired of yelling back at the TV.
Poor quality control (look at 2.6! G-d! Every kernel release is a roll of the dice)
Inconsistent standards
Amateur software engineering
Evolution instead of planned growth - Linux has a lot of appendixes
Reliance on corporate donations for anything good
Buggy drivers
Need I go on?
If my "mission impossible stunts" you mean walking over and plugging a network cable in ;)
The honeynet project had just 4 data points.
I've had five Mac OS9 boxes online for longer,
and they have not been hacked. Therefore,
Macs are very secure.
Aren't statistics fun? All you need is a few
data points, and you can make fantastic
causal arguments. Wheeee!
Gene Spafford was interviewed by linuxplanet couple of years ago. He says why linux isn't completely secure, even though it is a outdated interview, I will like to say most of his ideas do make sense even today.
Even if those honeypots are harder to penetrate that does not mean drivers, or individual applications that many people use are designed with security in mind first. Hackers are always going to be around all this means is that script kiddies are going to be able to do less and less to break into a linux but but more sophisticated hackers are going to want to try harder and within time. You will have the same problems just like in real life a ADT system can make your home safer does not mean you still will not get broken into. Plus, within this article you should be asking who are the security experts?
All in all I would hope people read this article in hopes that linux is their solution too security out of the box. In other words if you believe in security do not rely on the distro. to be 80% secure even if you locked the system up tight like your suppose too you still have a good chance of getting hacked. This article is just showing business people in the IT world that they can setup linux and not need a administartor with good experise to be hired instead of that person they can pay half as much with little experence to manage the network because linux is so secure. See where I am going with this article?
Red Hat, on the other hand, has moved to both turning no remotely-accessible inetd/xinetd services on by default and offers an easy install-time firewall that works transparently on workstations and very simple servers. The difference in exposure of vulnerabilities to attackers is tremendous. The vulnerabilities may still be there, but the attacker often can't get to them or can't get the same level of privilege out of them. For instance, running OpenSSH in privilege-separated mode the way most Linux distros do now means that some exploits don't work, while others only grant the attacker non-root access.
Linux vendors/creators have led the commercial Unix world in pre-install hardening - I like to think this is due in part to the success of Bastille Linux, a hardening program for SuSE, Red Hat/Fedora, Debian, and Mandrake Linux, as well as HP-UX and Mac OS X. Bastille ships on recent HP-UX O/S's, is available from both Debian and SuSE as a vendor-supplied package.
Security is a process AND a state, albeit a state with many degrees and a process with many steps.
I think that the most secure OS is the one easiest to keep up-to-date because the most common reason for hacking is uninstalled patches.
:)
The worst OS I've ever had the displeasure to patch is Solaris (8 - maybe it's better now). 35 patches. Had to calculate patch dependancies and install them one by one. 5 of them needed "immediate reboot", another 15 or so needed to be installed in single user mode. A Solaris server take a LONG time to boot. That's a lot of unwanted downtime.. I'm not surprised that most Solaris systems out there (even very critical ones) are waaay behind security patch schedule..
Compare that to "apt-get update && apt-get upgrade". Rarely even needs a reboot..
Luckily I'm not forced to use Solaris anymore.
My other account has a 3-digit UID.
I do mean NAT/hardware firewall/router thingy. And, yeah, my point was that there are enough unprotected boxes out there that it doesn't make sense to hack through said NAT/firewall device, unless there was sure to be something tempting on the other side, in much the same way that having a deadbolt will protect you from most home breakins.
Don't change your oil and your car breaks down /once/.
When we rolled in Linux to automate our internal business systems, security was at the top of the flag pole for us. Our old systems (AIX) had suffered from numerous repetitive flaws particularly in areas of allowing certain connections and not allowing others, which posed a significant problem when it came to securing the entire network from outside abuse.
We analyzed the various systems available to us at the time we were making the rearchitecture decision, some six months ago or so, and quite rapidly we reached a decision based on the data. That is.. Linux would be more secure in our company because we already have the technical people using Linux outside of work who would be able to already understand the system and be able to fix specific and non-specific security issues themselves rather than having us rely on an outside contractor or vendor. This meant we could buy vanilla beige boxes and install Linux, set up all of our business processes, all without having to go to one of those vendors such as RedHat, Sun, or one of the other many vendors in the Linux field.
So, security is a strong concept of safeness for us, and we're glad we're running Linux.
It's true, I had mine unpatched for about 3 weeks before i "knew" it was hacked. I know I deserved it, but someone didn't have to over-write 60 important system commands with "ps"
Jerk
There's no place like ~/
How about the "less services" gaff? :) Good thing I'm not a writer. My grammar and spelling suck.
Interesting study, not all that surprising.
How about a study like this against the varous NAT/routers being used out there? How easy is it to own systems sitting behind those? This appears to be the standard anymore for the millions of cable/dsl connections.
Whatever, its all about knowing which security holes to exploit. Someone would have a better chance hacking a Linux box than my PC...just because 'tard with a PC is too dumb to patch their system, everyone thinks "Windows sucks, Windows sucks"...put the same 'tard with a Linux machine, and the same thing would happen. Blame the user, not the equipment.
Slashdot News: As serious as a busted rubber
What about client side attacks, such as attacks against web browsers and email clients? These kind of security problems comprise a large portion of attacks against Windows based machines, and with the rising popularity of cheap routers that provide good protection to home users via firewall and NAT rules that will prevent direct attacks against daemons, client side attacks will be rising in popularity over the next few years, and cheaply available firewalls won't do anything to help.
Of course, this kind of analysis would require a more involved approach to testing O/S security, rather than just installing an O/S, throwing it on the internet and sitting back and waiting for whatever randomly happens to it to happen, which doesn't really seem to be the way honeynet likes to operate.
Keep in mind that Honeypots were originally intended to track the behavior of so called blackhats, not to analyze the security of operating systems, and they probbably aren't the best choice for the job.
you know, it's amazing that when the parent says you don't know what the meaning of 'router' is, and you prove him right, that you get modded up. i don't know who belongs on a tard-farm more: you or the moderators.
MOD PARENT UP!!!! That is an excellent analysis.
Quote: "... no-one who has zero day exploits goes around using them on random machines."
It's "pwned", or the variant "pwn3d!!/11", now.
If you're still using "0wned", you're a geezer; over the hill, above the speed limit. Go to the back of the bus with all the other people who've used a PDP-11 in their lifetime.
That's not what the article said. It tested unpatched boxes in all cases. The Linux, Solaris and Windows boxen were all default installations, with no security patches or add-ons.
Good, inexpensive web hosting
I wanted to make the title "Is there an end-point to security" but the answer to that is obvious.
Rather, I'm asking whether, given a system to which no new features will be added, will the process of patching the vulnerabilities (buffer overflows, whathaveyou) eventually make it impossible to enter the system by exploiting the software it is runnning? (ignoring other avenues such as social engineering for the moment).
(The idea being to discourage people from playing at skript-kiddie, but concentrating on the real challenges. Using the above logic, if a box was "practically uncrackable", the incentive should be so great that it becomes almost the sole focus.)
As for Linux, a correctly-configured hardened box should come close to VMS in security. The sorts of things that you could configure to do this are as follows:
The reason for so many steps is that Linux is flexible. Flexibility, if used well, can make for an extremely tough system. If used badly, it can make for a highly vulnerable system. Mistakes are not always easy to catch, so it's better to have enough independent redundancy that a failure isn't catastrophic.
VMS had flaws, too, and could be easily mis-configured. (Being able to put DCL scripts in mail subject lines was plain stupid.) But, again, if set up well, was virtually bullet-proof.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
The attacks are scripted to do port scans to find open ports that correspond to the attacks the zombies are launching.
If you don't have the ports open, then they don't attack the services commonly using those ports.
There was another, better article that stated that Linux boxes had Linux-app-specific attacks against them either twice an hour or once every 2 hours (I don't remember which).
The point is, if you are vulnerable, you WILL be attacked.
How many Windows machines there are out there does NOT matter.
How few Linux machines there are out there does NOT matter.
The attacks are automated and run 24/7/52. Your machine will be found.Read more articles. See how most Linux distributions have things like Apache running in a more secured state (non-root and/or in a chroot'ed environment).
Security is all about limiting the avenues of attack.
No. Go eat dirt. Oh, you're already doing that.
http://www.worleybuggerflyco.com/flytyingtools/arr ow_diagram.jpg
"Something unknown is doing we don't know what." - Sir Arthur Eddington
Nice explanation of "PAT" vs "NAT". Thanks for correcting me.
You might want to toss in "IP Masquerading", too. A term familiar to many of us from the days of the 2.0 kernel.
Also, it is possible to have both PAT and NAT on one firewall. This is commonly seen where you have one firewall providing PAT/firewalling for the users, and NAT for the servers in the DMZ.
I thought it said "linux, like a plumber on the Atkins diet, is harder to crack..."
Actually, if you read it, it says that some of the linux systems had ADDITIONAL SERVICES enabled, not default installs.
Video Production Support
"A big hello to all intelligent lifeforms everywhere...and to everyone else out there, the secret is to bang the rocks together, guys."
But seriously, run whatever you want to. Just remember that your machine can be taken over and used to spew spam and DDoS attacks. Let's all act responsibly with whatever we choose to run and make sure we're keeping the scumwads off of our machines.
Someone donating their time and expertise bothers you that much, huh.
Perhaps you have too much time and too little expertise.
If I want to verify that my Debian box is 100% clean, I just boot with a Knoppix disk, chroot the box and use dpkg to list the installed packages and again to validate all of the files against the installed packages.
/home/~* directory. If you find something somewhere else ...
Any files that are not identified that way should only be in the
Validating a Debian box is easy. I'm sure that validating most other Linux boxes is just as easy. Any advice from Red Hat/Fedora or SuSE or others?
I like Debian.
http://slashdot.org/comments.pl?sid=136414&cid=113 92284/
"What in the name of Fats Waller is that?"
"A four-foot prune."
Actually, I recommend using some elder kernel and elder software (Becuase most of the market uses Win98 -- let's be fair here and put Linux on the same slate). And running all services as root (becuase anytime a service update or any program says it can't do something withtout root access, they *will* give it the password -- they don't care).
Use your fucking head moron, it's all social engineering one way or another.
Any machine truely capable of being infect in 4 minutes is behind a NAT router/firewall, becuase they use a broadband service. Heck, I wouldn't trust my Gentoo box (hardened) without it being behind my NAT firewall... I can't keep up with all those updates, I have a life... oh wait... this is slashdot... you probably don't and *like* updating hundreds of lines of config files just to get %01 more secure. No thanks, I like windows configuring for me. I'm running clean with no problems (and yes, I have looked at my network traffic -- nothing abnormal).
In other words, you morons only read these and believe them -- you never do the dirty work yourselves. Bling faith in security is worse than knowing your insecure -- becuase at least one you can do something about it.
Welcome to the biased slashdot community... filled with Linux zealots of hell...
Oh yes, and please fucking turn caps off when putting a subject in.
Anyone who has even done basic high school statistics can tell you that the numbers in these reports are absolutely statistically insignificant. They don't mean a thing.
I have run Solaris on Sun architecture since 1997.
Out of the box Solaris 5,6,7 and 8 are VERY insecure if left unpatched. Even when patched they can be rather insecure and crackable with ease. Though more secure than Windows servers, Solaris is MUST be patched and basically run with RPCs all shutdown, if the server is running outside your intranet. Placing it in a DMZ is also a must.
So, is this a good reason to use Windoze or something? What's your point? Most of us here are running "random" machines and would rather not be owned before we can update our way out of harm's way. Even if you were right in your reasoning, the result is still in favor of using Linux over the alternatives, Windoze and Solaris.
Do you have a better method to determine system performance than the one used? All your theorizing is so much BS when actual computers are put onto the web in normal configurations. Put it up.
If anything, the Windoze boxes had it easy. I doubt they configured the thing to surf with IE or read email with OE, which are both filled with holes. Surfing with Konqueror/Mozilla/Dillo/Galeon/whatever is a world safer as is reading your email with Evolution/Kmail/MozillaMail/Balsa/mutt/whatever. We can be sure the results would be worse for Windoze if all the machines were set to get mail every 5 minutes. Many would not survive the first shot.
Friends don't help friends install M$ junk.
The "little blue box" is usually both a router AND a hub, and uses NAT (not much good to Joe HomeUser otherwise, since he probably bought it to link up his computers in a home network and connect them all to the net through a single i.p. address). This is enough to deter the script kiddies, unless you've gone and left all your services running without restriction or simply port-forwarded everything under the sun to a computer on your home network without thinking about it.
Combine the little blue box with a firewall, however (e.g., ZoneAlarm) and you've just defeated 99.9% of the so-called 'hackers' out there. Because when all is said and done they're nothing more than little brats who've jacked someone else's code and used it, and they themselves have no friggin' clue how any of this works, much less how to write code themselves. In fact, I'm willing to bet if you asked most of these 'hackers' whether the little blue box was a router or hub or both, they'd just stare at you blankly.
All you need to do from this point on is a) DON'T user IE, and b) don't friggin' download crap from an untrusted source! I admit I rarely use my Windows partition (mostly for gaming, or after gaming when I'm too lazy to reboot or haul my ass to one of my other machines, like right now) but I've never had a successful hack of my system despite the fact that nowadays it's almost constantly being scanned for vulnerabilities.
Max
My god carries a hammer. Your god died nailed to a tree. Any questions?
Only a windows user would be enough of a "'tard" to say PC when they mean windows and fail to understand that Linux was developed FOR PC. Though obviously it runs on just about anything these days.
The Farewell Tour II
Maybe that's the same reason some ATM's use OS/2. Nah, that would be "security through obscurity" and bank's know better than to...never mind.
And did you exchange a walk on part in the war for a lead role in a cage? - Pink Floyd.
I'm I keep getting stack overflows trying to work out what GNU stands for.
And did you exchange a walk on part in the war for a lead role in a cage? - Pink Floyd.
I'm personally wondering how a relatively new system like SELinux combined with Exec-Shield are keeping machines from being rooted. Let's say a cracker a compromises your Apache server through a bug in the server itself or a flaw you've introduced yourself through either a CGI or PHP script. He is simply not breaking out of the kernel security context set by the SELinux policy, so what's a hacker to do these days? Would a local root exploit allow you to bypass SELinux? What if there's no root on the system anymore, which is entirely possible. Doesn't that completely mess up the hacker's plans?
Do people still get rooted running something like Fedora Core 3 with SELinux? I can imagine they do, you just don't really hear about it anymore. Perhaps the system is still too new to tell either way. If every daemon is locked down with a targeted SELinux policy in the future, and I see no reason why you wouldn't want this once someone has done the work of writing the policy, perhaps we'll see a dramatic reduction in compromised systems.
It's like deja vu all over again.
Yeah, you go ahead and trust Windows. I'll just stay here and wait for the explosion.
At least you can spell "grammar" correctly, so you're better than 90% of all "grammer" nazis.
You've never used SE Linux, or any MAC/DTE/RBAC environment I'd wager. *grin*
Anyone connecting an unpatched server to the Internet is looking for trouble. This study is pretty pointless. Anyone with a clue would have patched their servers. It's like doing a study to find out which freeway is the safest to let your kids play on.
.NET VM implementations. The open source implementations aren't even in the same performance league as the commercial implementations from Sun, IBM, BEA and Microsoft and probably never will be.
Yup Solaris 10 is the one to wait for, don't see how open source will make a huge impact though. Just look and Java and
Will you teach me to see the future too?
Or if you don't, will you teach me to be a dumbass just like you?
Let's see, looks like some typical slashdot logic.
Linux is a UNIX clone. Solaris is the leading Linux. Rather obvious where the ideas came from isn't it.
Solaris 10 is FAR more advanced than any Linux implementation. To claim that it is stealing ideas from Linux is just silly.
As for security Linux could learn a lot from Solaris 10's military grade security. You must be delusional if you think a study of the security of UNPATCHED servers is of any relevance to a serious data center.
Yes it is an "old" article and so is my Win98 install. Five plus years now connected to either cable or DSL. Two reasons why my install is stable enough to browse porn with IE.
1. I'm an old fart.
2. The kids moved out and took all thier teenage mates with them.
Please don't take this to mean I want everyone to use Win98 or that my box is "unbreakable". I like it because "it works for me", when it doesn't I will go to the hassle of replacing it.
And did you exchange a walk on part in the war for a lead role in a cage? - Pink Floyd.
If no rule matches an incoming packet from the internet ...
1. Remove packaging and read engine EULA.
2. Erase any existing traces of engine from engine bay and clean with pressure hose.
3. Format engine bay with new engine mounts.
4. RTFM and install new engine.
5. Install patches,
6. Tune engine.
Note: If at any stage you find that you can not proceed to the next step then refer to Workaround #1 ( Keys locked in car).
And did you exchange a walk on part in the war for a lead role in a cage? - Pink Floyd.
Right, and it's my experience that securing Linux is not only a lot easier because there is more information readily available to allow you to determine exactly what you're running and the flexibility in configuring it, but because there are distributions that address these concerns on the desktop with easy to use interfaces such as Redhat's Firewall configuration tool, Services configuration tool, SuSE's YaST 2 configuration tool, so that it's more accessible to the new user.
On OS X and on Windows, applications are categorized in a Extensions Folder and Control Panel, that allows an obvious method of accessing tools that configure the important functions of your system. It is much less daunting than a command line to the new user, as the most important tools and settings are presented in a way that prevents having to collect as much information as is required to accomplish the same tasks on the command line.
In desktop Linux distributions this is happening as well, and often this leads to a greater understanding of the command line. The curious user will notice the relation between the GUI applications and the commands they invoke, and as many tasks still require using the command line, the user will not be totally lost having already been familiar with a more accessible representation of the same tools.
Hopefully more GUI applications will be written to cover a larger scope of command line tools, making them more accessible. A lot of users now have grown up on the GUI, having been the preferred method of interacting with the majority of PC users now since they have become much more affordable and accessible. It's beneficial to provide an interface that caters to that group because it allows more people to get familiar with the OS in a familiar way!
.sig: Open Source, Open Mind
Phrack article on the WANK worm that cracked lots of NASA VMS machines. Yes, it was 1989 or so, but this is VMS, so that's a reasonable timeframe :-)
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Some kinds of cracking methods are timeless and relatively system-independent. The DEC standard logins to the VMS administrative accounts used login name "System" and password "manager", or "Field" and "Service" so that field circus could get access to a machine, and too many sysadmins didn't bother changing either or both of these passwords. I'm posting this separately from the Worms Against Nuclear Killers comment to make the point that VMS _does_ have administrative accounts, and that they were at least at the time an obvious cracking method. (Of course, so was popping off the removable disk pack with the VMS operating system installed and popping on your own copy, so you could go look at the data on the other disk, but you needed physical access to do that one :-)
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
My eyes hurt...
And did you exchange a walk on part in the war for a lead role in a cage? - Pink Floyd.
Nobody ever bothered the Windows box, not that there was much you could do with it.
On the other hand, the Linux box got cracked pretty rapidly, sometimes with Staecheldraht DDOS clients, sometimes with an attacker who appeared to have logged in by hand and installed things once he'd cracked it. After 3-4 rounds of the machine being brutally and senselessly attacked every week, I renamed the box "Kenny"... Sometimes I discovered the crack by looking at the tcpdump ("why is my box pinging a university in Sweden???") and sometimes by running commands like "find" in root's home directory which found files that looked suspicious ("ls" had been replaced with a version that didn't show the cracker's files, and "ps" didn't show his processes, but "ls /proc" showed his processes just fine :-)
As an old Unix hacker, this annoyed me. One major target for the crackers was the WU-FTPD ftp server, so it was somewhat ironic that my machine once attacked or was attacked by machines at Washington University (I forget which - I think my machine was cracking them.) It looked for a while like I was getting attacked by somebody at MIT, but it turns out that the culprit was really in Japan, and had the byte order backwards for the response packets...
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
NAT's a really lame approach to firewalling. But it's usually good enough to let you plug in a newly installed Windows machine behind your NAT box on your DSL/cablemodem so you can download all the necessary Windows updates to make the machine slightly less vulnerable, as opposed to having it 0wned before SP2 is even downloads :-)
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Please stop posting until you have a clue. You are misleading other clueless readers here judging by your moderation.
All those moments will be lost in time, like tears in rain.
I've now read the linked article several times, but couldn't find that statement.
But anyway, enabling more services tends to make a box less secure.
The Tao of math: The numbers you can count are not the real numbers.
I did that two years ago. That is, left windows on another partition when I had migrated almost completely to linux.
Since my linux did most of the work for me I didn't boot to windows during a couple of mounths, but then , for unknown reasons today, I had to do something in windows. And BAM! My network connection was cut after a couple of minutes (university network) because of a worm who got into my system.
I deleted the partition. Told my netadmin about it. Got my network connection back and NEVER looked back at windows again.
Now the question is:
Would it be wise to buy windows, so that I need to buy a "dedicated firewall" to protect it, so that I can buy alot of modern hardware so that I can buy games to play in windows, which I have to reboot twice a day and reinstall every now and then?
Or should I just stick to linux?
"this is enough to deter the script kiddies"
.... your information. Which is worth far far more money than the 2 hours it takes you to wipe the machine and restore your data.
.... but the day will come.
Yes.
"Combine the little blue box with a firewall, however (e.g., ZoneAlarm) and you've just defeated 99.9% of the so-called 'hackers' out there."
I don't want to argue about the terms your choosing to use. I do however want to point out that the bad guys are always one step ahead of the good guys, and assuming that any security you have is good enough to stop practically anyone is the first step towards becoming owned. Not just your machine
Anyone who really wants in can get in, it will take them time and patients. Thats one thing the good guys have going for them, most of the bad guys are script kiddies who just run a scan and move on. Eventually we will get to the point where breaking through firewalls and any other security device is as simple as clicking "ok". We are still some ways away from the kiddies having to learn all of that though since there are many many more unprotected systems out there
"Two things are infinite: the universe and human stupidity; and I'm not sure about the the universe." --Albert Einstein
Our VMS administrator still uses telnet to do administration, thinking that it's secure enough. Personally I use ssh. However, in order to change our passwords once they expires, we have to use telnet. SSH stops working.
Just because the bozo in the above story didn't know what to do once in was in the box, doesn't mean that other bozos won't be more ambitious or do more sniffing.
"it takes about 3 months before a unpatched Linux machine will be owned, compared with about 72 hours in the past" could mean most kiddies moved to M$ to crack.
Privacy is terrorism.
When a story is posted, the previous stories are searched for similarities. If more than, let's say, 80% similarity is found, then the story is a dupe and it is rejected (or the reviewers are notified that the story might be a dupe). It can be automated with a few lines of code.
The fact that the machine gets 0wned at all proves that it's not 100% secure. The only issue now is how long it'll take someone to crack the box. The time to do this is mostly dependent on how easy it is to crack other boxes, NOT on how hard it is to crack this one.
Think about it. If some script kiddie is launching a 5-year-old attack on boxes that still tends to work, he'll keep doing it. If the Honeynet boxes don't fall prey to this, because they're properly configured and people care about keeping them up-to-date, other Linux systems will. If other Linux systems weren't prey to this, the kiddies would find exploits that worked (we've proven they exist already).
This is a measure of how the variety of Linuxes in the wild mean that an up-to-date box will be hacked less quickly, which is certainly a useful data point. But it doesn't mean Linux is "more secure" than in the past, only that the holes in Linux now are less well known that the holes in the past, and those holes are still rife in the wild.
Newer things are, for this reason, always "more secure". For a while.
disable unneeded crap in inetd.conf. add "--nolisten tcp" to X server args. for Windows, disable any unneeded services via start/run/services.msc. firewalling, decent passwords, and patches are obviously good too. i wish more home users would take the time to do this.
I'm sorry for being daft but on the honeypot site I can't find the specific article everyone is talking about. I'd comment more on their study if I knew what they were running. Is the unpatched linux distribution as old as the unpatched XP SP1 they are using, and Solaris?
I'd like to see benchmarks of fully patched systems. I would also like to see server systems (OSX server, win2k3, etc...) being tested.
But more importantly, I'd like to see the number of attempts on each box. If there were 10 to 1 attempts on the XP box vs Linux box, while its performance was deplorable, the measurements would have a bit more context. I was especially surprised with Solaris, because I'll assume the box wasn't targeted nearly as often as the linux and XP boxes.
The article goes to show that it's important to have at least a router between you and the 'live' internet connection. Copies of XP bought after SP2 was released come with SP2, but still for those with older systems, they need a fighting chance to patch.
NAT is only safe if you are the only user (PC) on the local network...You will still get infect by other PCs if they share the same subnet with you. (Our newly installed XPSP1 PC learn this lesson in our office)
2. Switch - Like a hub, except it detects (via MAC address I think) which connection should receive the data.
3. Router - A device which handles the routing of packets to the correct place on a network.
4. Firewall - A piece of software, sometimes running on a dedicated piece of hardware, designed to keep your system safe from hackers, usually via closing ports. This does not count any backdoors or spyware you may download, which, usually unless custom restrictions are in effect, will be able to "phone home" without any interference from the firewall. I believe ZoneAlarm, for one, has a warning if this ocurrs.
5. NAT - Short for Network Address Translation, a system by which computers on a private LAN are able to access the Internet via a device set up to perform NAT. The NAT/Router takes the request of a computer on the LAN, and routes it to the proper destination using its own public IP address. When the response comes back, it then routes it to the proper computer. In many cases, specific ports may be forwarded to the necessary boxes on the LAN, so you don't need one box providing routing, NAT, webserver, etc... This may be added to the functionality of a router, provided that the router in question would require NAT.
6. Proxy - A bit fuzzy on this one. This is quite similar to NAT (described above), except that it is done over a WAN, usually the Internet, and is usually done for the purpose of using an IP address other than your own, for anonymity reasons (to avoid a ban, or content filtering restrictions).
7. Modem - A device that may be internal or external, designed to convert various methods of transport (cable, phone line, etc) into a usable network for a computer (PPP or Ethernet).
For any given TCP or UDP connection, yes, I know that it must travel through several routers. I mistakenly said router when I meant something else. Each router uses a series of routing tables to figure out where the packet must go. This is repeated until the packet finds the correct destination (where it then might be NAT'd if the destination is on a private LAN).
All happy now?
haha eat that windows suckers!!
Mohahah!
-1, buzzword-infested-middle-manager.
I guess today is a passable day to die.
Except exploits are uniquely available to be guaranteed to be on most Windows installs by default as far as IIS goes. Apache with Linux distributions tends to be updated to whatever version the distributor thinks is safe. Which tends to be tried and true apache installs.
Non impediti ratione cogitationus.
so to paraphrase
it is inevitabellely, inevitabbb, inevitable!
I think you mean "Ranked from least crackable to most crackable"
Unless you're some Jew who thinks he's reading Hebrew (read right to left), but then you'd have to change the text:
Linux<Solaris<Glass<Windows
With so many root holes on Linux, it's natural the amount of bugs keep getting down as more and more are published.
would have been nice to add some BSD machines to the list..
That and customized 'router' flavors of linux..
---- Booth was a patriot ----
Self-employment. That's my solution.
When I'm already tens of thousands of dollars deep in student loan debt, how in the world would I get the money to go back to school for business administration training? Do people normally go from a B.Sc. in a technical field to self-employment? If so, how do they learn about how to run a business?
Yes, but those "thingies" are usually bought by clueless users who have never even changed the default admin password. I would estimate that at least 50% of all home hardware routers out there are running 100% default settings. How's that for secure?
Systemd: the PulseAudio of init systems
CRYPTO-GRAM News
Then search for The Honeynet Project. Something to think about.
The postman hits! The postman hits! You have mail.
From an article on USA Today...
While attempted break-ins never ceased, successful compromises were limited to nine instances on the minimally protected Windows XP computer and a single break-in of the Windows Small Business Server. There were no successful compromises of the Macintosh, the Linspire or the two Windows XPs using firewalls.
Who gives an f about unpatched machines?
This is like comparing a baby and a puppy. Put the two together in a locked room and the puppy will kill the baby. Does that really say anything?
On slashdot the headline would be something like "Dogs smarter than Humans".
Whether it's up2date, yum or apt, distros make it easy to keep up to date with patches.
I yum update all my machines every night and judging by the logs it has to be making a difference.
Thanks to the yum guys, dag, et. al., you're making a great difference. DHS should give you some funding.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
"NOTE: Dell does not ship any product with spyware included or installed."
But I'm sure they're lying. *rolleyes*
"With sufficient thrust, pigs fly just fine." -- RFC 1925
It's about time. Soon Linux will catch up to and be as secure as Windows 95 was.
Perfectly happy!
;)
Although I liked the ninja answer someone else gave better
Advanced users are users too!
Yeah! What makes you think my God died just because he was nailed to a tree?
Aah, change is good. -- Rafiki
Yeah, but it ain't easy. -- Simba
Do you really want to talk about out of the box security? And, on OS's meant for general purpose uses? Here's a hacker's nightmare...
If you want real security don't play with Linus' toy, get Trusted.
Its the next best thing to disconnecting from the net.
And yet, the linux boxes were still the most secure....