Slashdot Mirror
Microsoft's IIS is Twice as Likely to Host Malware?
eldavojohn writes "According to Google, Microsoft's server software is at least twice as likely to host viruses or malware. The reason why? 'Google reports that IIS is likely used to distribute malware more often than Apache because many IIS installs are on pirated Windows versions which aren't configured to automatically download patches. (Even pirated Windows versions can automatically receive security fixes, however.) Our analysis demonstrates how important it is to keep web servers patched to the latest patch level,' Google notes."
Patches? Patches for what? Has IIS had any remotely exploitable holes since version 5? Or are these machines that get owned via some other method and then just happen to have IIS so it is used to serve the malware? So really, this has more to do with unpatched windows than IIS? Or am I missing something?
The problem is anyone out there who can install windows services considers themselves a knowledgeable sys-admin. Sure there are technical reasons why LAMP tends to be more secure than IIS but more often than not it comes down to poor configuration (running unneeded services, poor network security, poor hardening standards), lazy maintenance (not checking logs, updating software), and a lack of understanding threats (not keeping up with cert).
Linus once said of Gnome that when you design assuming you're users are idiots in the end thats all the users your going to have. Find an experienced competent admin who has cut his teeth in the real world and not in a MCSE bootcamp and you should be ok.
How can I tell? Because it's really easy to duplicate.
Nice dupe
> (Even pirated Windows versions can automatically receive security fixes, however.)
Well, the ones who either patched or didn't download the WGA fix, anyway.
Those of you in the front row would be advised to watch for falling chairs.
First, there is not nearly enough information provided by Google to come to any real conclusions.
It could be that IIS is more likely to become infected than Apache and then be used to distribute malware, or it could be that malware purveyors are more likely to host their malware on IIS. Or it could be a combination of both.
They also fail to mention what versions of IIS we're talking about, as that makes a huge difference. IIS 5.x had more holes than a cubic mile of swiss cheese. IIS 6, on the other hand, appears to be rock solid and actually has fewer vulnerabilities than Apache.
Second, the fact that Google is a direct competitor to Microsoft is an obvious reason to find their conclusions dubious, at best. They have plenty of reasons to bash Microsoft at every possible opportunity.
Aahr. There be unpatched pirate servers here.
u-bend
Please don't flame me for this, it's a genuine question: Does Apache download and apply patches itself automatically? Or are sys administrators more careful and quicker to apply patches as soon as they are released?
It may be true, but it is in the name of FUD.
What are the motivations behind Google even doing this survey/report? Some will say because Google does no wrong and that they are doing it for the betterment of the web, but I smell a few ulterior motives. Hell, even the author of the article smells that same stench when he says, and I quote:
While I can't quibble with the data per se, I find it interesting that Google used this survey to promote Apache over an Internet product made by its chief competitor.
FUD
h
Valkyrie is about to die! Wizard needs food -- badly!
I use it on a honeypot server, leaving linux and apache as my real machine.
Bad admins run bad servers!
Wouldn't have expected that one.
Why is Linux always referred to as free as in beer? It's GPL'd and there are distros (Debian anyone) that are free as in freedom to the core. Where does this come from?
My Babylon
see subject :)
Notice I placed a question mark after each one of my phrases so I cannot be held responsible for them. You know, just asking questions, like Fox News and their "Hillary Clinton turns tricks?" headlines.
Speaking of that, there's a hilarious Jon Stewart skit on YouTube about placing question marks after inflammatory statements that surprisingly enough targets Faux News, mostly. Might want to take a look at that? Thanks?
Web2.0: I love when people Flickr my cuil and digg my boingboing until my google is reddit and I start to yahoo
Posted anonymously for your enjoyment:
w eb-server-software-and-malware.html
http://googleonlinesecurity.blogspot.com/2007/06/
So how much would operating system vendors have to pay the firewall/viris scanner people to add a feature to the firewalls that clearly identified the operating system and web server of the site that was attempting to download a viris/keylogger.
Envision this pop up with appropriatly named guilty parties.
---
Alert: WebServer: MosaicC64 running on AmigaOS_1.5.6 is attempting to infect your computer !!
Anti-Viris-Firewall: Bad Application (XXPdeleteAllYourStuff) found in web stream from site
all.bad.stuff.com: Blocked.
This is probably XP Pro machines that get infected by means other than the webserver.
Once someone has control, they can pretty easily start the service and stick malicious files in the default root in IIS.
You don't need a remote hole to get numbers like this.
...but it is IMPOSSIBLE to get patches for a pirated copy of Apache.
I doubt anyone on Slashdot can prove they did it even with the most leet of cracking skillz.
It may be reckless to run pirated IIS, but it is simply gross negligence to run pirated Apache.
Pie Graph
However when said user is frustrated because of inability to use a specific feature of the pirated IIS software then they go looking for patches, service packs and such. More often than not they use a newer pirated version on their development/testing workstation/server.
I work for a company that identifies hacked sites that house phishing attacks. We have analyzed tens of thousands of sites. It was a surprise to me, but over 90% of hacked sites out there are running Linux/Apache -- not Windows/IIS as most people would suspect. The problem is that there are too many people out there install the free version of open source software, but don't have the ability to apply the patches. Since known vulnerabilities are well documented and kits exists to scan these weaknesses, Linux/Apache gets hacked.
You don't have to visit their sites and if you do, they are perfectly within their rights to distribute anything they wish, so long as they keep the copyright intact and provide updates. Unless they are using a BSD license.
1. Since there are many more than twice the number of Internet-connected Windows machines on the planet vs Linux, there's a lot more than twice the opportunity to use a vulnerability to own the machine, start IIS, and distribute whatever you want on it. If this is the main disitribution method for malware, the 2x figure is a compliment to Microsoft.
2. Or if we're talking about sites that intentionally distribute malware, what does the choice of server have to do with the quality of IIS vs Apache? Gun A's manufacturer is not more evil than gun B's simply because A is the choice for hardened criminals. Fact is, Windows/IIS is easier to set up for fly-by-nights with minimal knowledge than Linux/Apache, whether that's Mother Teresa or Russian Mafia. Again, we have a compliment for Microsoft warped into a criticism.
Nice FUD, but try harder next time. Thankfully, Microsoft will have no trouble poking holes in Google's "do no evil" claim, should a PR war begin. Quick, quick, create another new beta service, Google, to distract the fanboys from the fact that, since 1997, you've not actually done much more than copy or purchase!
And that link was SIX years old.
If that is the best Slashdot can do, It be safe to say IIS 6 is rock solid.
With the release of IIS 6, security was significantly improved & according to various stats out there, IIS 6 is actually stronger than Apache in a lot of areas. We are running IIS & have had several intrusion attempts but our systems have been pretty solid; Humble admission, we did get hacked once but it was our negligence more than anything else.
Having admin'ed both Apache and IIS servers, IIS has treated us well, with a properly configured firewall and auto-patching servers, IIS is rock solid
I think the research really mean is the administrators behind those softwares are the weak links, not the software. Those bad administrators use pirated windows servers and refuse to update are the most dangerous and damaging guys around.
There is a spark in every single flame bait point.
So a bunch of thugs pirate Windows and start serving malware via IIS? So how do we know the discs they installed with weren't pre-infected with malware or that they didn't INTENTIONALLY put up servers for the purpose of serving malware? This story is coming from a competitor of Microsoft who has every reason to bash their products. It is probably a total crock anyway.
What with the lack of MS hate? Is google on the shitlist now too or something? I haven't seen so many comments bashing an article that pokes at MS ever...
Correlation =/= causation.
Sorry, can't take you seriously.
It's amazing how M$ security problems are always the user's fault when you ask a M$ person. Case in point, you blame the problem on ignorant, lazy and stupid users:
I'm going to leave alone how you just called most M$ customers idiots. Why would consider someone lazy because they are forced to do all the work it takes to keep up a Windoze box?
What you don't mention is that most distributions have reasonable defaults for Apache because they can. In the free software world people are free to share ALL of their improvements and that includes configurations and updates. Of course, there's no such thing as a "pirated" GNU/Linux, which eliminates the problem Google identified.
As with desktop users, the only consistent trait and problem people with problems have is choosing the wrong OS. Software design, configuration, documentation and ease of upkeep are all inferior in the Windoze world - the user is screwed at every point. It's not their fault.
Friends don't help friends install M$ junk.
The fact they're IIS and pirated seems to be moot, the point is many people just don't feel like "proving" to M$ that their version isn't pirated and give up trying to do security updates. I have one computer, out of about 9 or 10 I own at home, that has XP loaded on it. When I put it online and try to patch it, it does it's "Authenticity Check" and fails saying it was not a valid install. I know I bought a copy of XP specifically for this computer since it was for a businesses' use (and hence, tax deductible as an expense). Since it's never going to be on-line I said, "Screw it" and didn't bother with trying to update it. I'm sure many home owners are in the same boat...except they keep it online.
Maybe they'll come around like they did on Win2K. They said they stopped supporting updates and I noticed no nags on my laptop for a really long time...lately I've noticed M$ is pushing security updates to it again. This is a computer I almost pulled from the "on line" array when it got infected twice by MySpace and YouTube....but I got it cleaned up through a few programs and a couple hours...
That's funny, because I got patches for every single pirated Apache server I own!
Please, for the good of Humanity, vote Obama.
... stolen cars are much more likely to be carrying Bad Guys, smoke detectors owned by people who never check the batteries are less likely to notice a fire burning, and people who never cut their grass are more likely to harbor rodents and snakes. In-freakin'-sightful, I say!
Yeesh.
Don't disappoint your bird dog. Go to the range.
bad analogy time, with no cars involved!
Joe banana republic has a revolution, the old dictator is out, new "free" elections are held! What people want is the right to vote!
GPL brand "elections" one man, one vote! A new president is elected! Years later, another election is held, this time a new guy gets in, because the elections are free forever, and multiple parties can exist, and different people can run, because they built a system designed to last through election cycles and the population makes sure it stays that way, because they remember the dictator and how rank it got eventually!
BSD brand "elections", one man, one vote, one time. The first election a new guy gets in! A few years later, "elections" are held again, the same guy is the only candidate, his "party" is the only legal party you can "vote" for, he and his cronies have "locked out" any other candidate or party, right back to the "closed off" system they had with the original dictator. the people only got one chance at a new guy and even when it was shown to be a mistake, it can't be fixed, because the system got locked back down again and the people are powerless to change it back, they picked wrong and "elected" another dictator who was as bad as the first guy that they had a revolution over..
Which is the freer system long term? Both started out getting rid of the one dictator "lock in" model, one makes sure it stays that way, the other goes right back to the one vendor lock-in model after the first election.
I'll say it again
GPL-one man, one vote
BSD one man, one vote, one time
both start out free, but only one guarantees freedom forever to all parties
Yes, you can be pedantic about this, but remember it's a bad analogy, as all of them are. BSD is a simple and free license, but it allows downstream f*tards just one step away from the originator to become jerk dictators. Might as well just stick with the dictator software model to begin with and stop faking yourself out that the potential isn't there. If you absolutely don't care about downstream, sure, do what you want, if you care about others maybe years later-think about it.
Do you have any actual data to cast doubt upon the story as written, or will you enlighten us with disbelief, conjecture, and a rant about question marks?
Oh, right, sorry. I'm not allowed to use that bit of punctuation, I guess. Perhaps I should rephrase my question as a statement...
I mean, windows users are 99% more likely to be hosting malware.
Basic Conditional probability:
Probability of {Malware given that running IIS} = P{Malware and running IIS} / P{Running IIS}.
So the Slashdot summary was correct: P{Malware given that you're running IIS} is twice as big as P{Malware given that you're running Apache}.
What's purple and commutes? An Abelian grape.
What's purple and commutes? An Abelian grape.
IIS is 100% likely to be hosted by malware!
Sometimes boldness is in fashion. Sometimes only the brave will be bold.
Really? I guess I'll have to reconnect it and try again. To be honest, WMP is the ONE thing I don't want updated.
They can't possibly be genuine pirated versions, then!
Arrrrrrrr(gh)!
licet differant, aequabitur
>The majority of that malware appears to originate from China and South Korea, according to Google.
I don;t know about you guys but this looks more like the sysadmin is installing the malware on purpous rather than being infected by malware.
Bigger question, does this article mean the "security through obscurity" argument people throw at systems like OS X is bullshit? Apache servers outnumber IIS, yet IIS gets twice as owned.
"Sufferin' succotash."