Slashdot Mirror
Microsoft's IIS is Twice as Likely to Host Malware?
eldavojohn writes "According to Google, Microsoft's server software is at least twice as likely to host viruses or malware. The reason why? 'Google reports that IIS is likely used to distribute malware more often than Apache because many IIS installs are on pirated Windows versions which aren't configured to automatically download patches. (Even pirated Windows versions can automatically receive security fixes, however.) Our analysis demonstrates how important it is to keep web servers patched to the latest patch level,' Google notes."
Patches? Patches for what? Has IIS had any remotely exploitable holes since version 5? Or are these machines that get owned via some other method and then just happen to have IIS so it is used to serve the malware? So really, this has more to do with unpatched windows than IIS? Or am I missing something?
The problem is anyone out there who can install windows services considers themselves a knowledgeable sys-admin. Sure there are technical reasons why LAMP tends to be more secure than IIS but more often than not it comes down to poor configuration (running unneeded services, poor network security, poor hardening standards), lazy maintenance (not checking logs, updating software), and a lack of understanding threats (not keeping up with cert).
Linus once said of Gnome that when you design assuming you're users are idiots in the end thats all the users your going to have. Find an experienced competent admin who has cut his teeth in the real world and not in a MCSE bootcamp and you should be ok.
> (Even pirated Windows versions can automatically receive security fixes, however.)
Well, the ones who either patched or didn't download the WGA fix, anyway.
Those of you in the front row would be advised to watch for falling chairs.
First, there is not nearly enough information provided by Google to come to any real conclusions.
It could be that IIS is more likely to become infected than Apache and then be used to distribute malware, or it could be that malware purveyors are more likely to host their malware on IIS. Or it could be a combination of both.
They also fail to mention what versions of IIS we're talking about, as that makes a huge difference. IIS 5.x had more holes than a cubic mile of swiss cheese. IIS 6, on the other hand, appears to be rock solid and actually has fewer vulnerabilities than Apache.
Second, the fact that Google is a direct competitor to Microsoft is an obvious reason to find their conclusions dubious, at best. They have plenty of reasons to bash Microsoft at every possible opportunity.
Aahr. There be unpatched pirate servers here.
u-bend
Please don't flame me for this, it's a genuine question: Does Apache download and apply patches itself automatically? Or are sys administrators more careful and quicker to apply patches as soon as they are released?
I use it on a honeypot server, leaving linux and apache as my real machine.
Bad admins run bad servers!
Wouldn't have expected that one.
Why is Linux always referred to as free as in beer? It's GPL'd and there are distros (Debian anyone) that are free as in freedom to the core. Where does this come from?
My Babylon
Notice I placed a question mark after each one of my phrases so I cannot be held responsible for them. You know, just asking questions, like Fox News and their "Hillary Clinton turns tricks?" headlines.
Speaking of that, there's a hilarious Jon Stewart skit on YouTube about placing question marks after inflammatory statements that surprisingly enough targets Faux News, mostly. Might want to take a look at that? Thanks?
Web2.0: I love when people Flickr my cuil and digg my boingboing until my google is reddit and I start to yahoo
Posted anonymously for your enjoyment:
w eb-server-software-and-malware.html
http://googleonlinesecurity.blogspot.com/2007/06/
So how much would operating system vendors have to pay the firewall/viris scanner people to add a feature to the firewalls that clearly identified the operating system and web server of the site that was attempting to download a viris/keylogger.
Envision this pop up with appropriatly named guilty parties.
---
Alert: WebServer: MosaicC64 running on AmigaOS_1.5.6 is attempting to infect your computer !!
Anti-Viris-Firewall: Bad Application (XXPdeleteAllYourStuff) found in web stream from site
all.bad.stuff.com: Blocked.
This is probably XP Pro machines that get infected by means other than the webserver.
Once someone has control, they can pretty easily start the service and stick malicious files in the default root in IIS.
You don't need a remote hole to get numbers like this.
...but it is IMPOSSIBLE to get patches for a pirated copy of Apache.
I doubt anyone on Slashdot can prove they did it even with the most leet of cracking skillz.
It may be reckless to run pirated IIS, but it is simply gross negligence to run pirated Apache.
Pie Graph
However when said user is frustrated because of inability to use a specific feature of the pirated IIS software then they go looking for patches, service packs and such. More often than not they use a newer pirated version on their development/testing workstation/server.
I work for a company that identifies hacked sites that house phishing attacks. We have analyzed tens of thousands of sites. It was a surprise to me, but over 90% of hacked sites out there are running Linux/Apache -- not Windows/IIS as most people would suspect. The problem is that there are too many people out there install the free version of open source software, but don't have the ability to apply the patches. Since known vulnerabilities are well documented and kits exists to scan these weaknesses, Linux/Apache gets hacked.
You don't have to visit their sites and if you do, they are perfectly within their rights to distribute anything they wish, so long as they keep the copyright intact and provide updates. Unless they are using a BSD license.
With the release of IIS 6, security was significantly improved & according to various stats out there, IIS 6 is actually stronger than Apache in a lot of areas. We are running IIS & have had several intrusion attempts but our systems have been pretty solid; Humble admission, we did get hacked once but it was our negligence more than anything else.
Having admin'ed both Apache and IIS servers, IIS has treated us well, with a properly configured firewall and auto-patching servers, IIS is rock solid
I think the research really mean is the administrators behind those softwares are the weak links, not the software. Those bad administrators use pirated windows servers and refuse to update are the most dangerous and damaging guys around.
There is a spark in every single flame bait point.
So a bunch of thugs pirate Windows and start serving malware via IIS? So how do we know the discs they installed with weren't pre-infected with malware or that they didn't INTENTIONALLY put up servers for the purpose of serving malware? This story is coming from a competitor of Microsoft who has every reason to bash their products. It is probably a total crock anyway.
What with the lack of MS hate? Is google on the shitlist now too or something? I haven't seen so many comments bashing an article that pokes at MS ever...
It's amazing how M$ security problems are always the user's fault when you ask a M$ person. Case in point, you blame the problem on ignorant, lazy and stupid users:
I'm going to leave alone how you just called most M$ customers idiots. Why would consider someone lazy because they are forced to do all the work it takes to keep up a Windoze box?
What you don't mention is that most distributions have reasonable defaults for Apache because they can. In the free software world people are free to share ALL of their improvements and that includes configurations and updates. Of course, there's no such thing as a "pirated" GNU/Linux, which eliminates the problem Google identified.
As with desktop users, the only consistent trait and problem people with problems have is choosing the wrong OS. Software design, configuration, documentation and ease of upkeep are all inferior in the Windoze world - the user is screwed at every point. It's not their fault.
Friends don't help friends install M$ junk.
The fact they're IIS and pirated seems to be moot, the point is many people just don't feel like "proving" to M$ that their version isn't pirated and give up trying to do security updates. I have one computer, out of about 9 or 10 I own at home, that has XP loaded on it. When I put it online and try to patch it, it does it's "Authenticity Check" and fails saying it was not a valid install. I know I bought a copy of XP specifically for this computer since it was for a businesses' use (and hence, tax deductible as an expense). Since it's never going to be on-line I said, "Screw it" and didn't bother with trying to update it. I'm sure many home owners are in the same boat...except they keep it online.
Maybe they'll come around like they did on Win2K. They said they stopped supporting updates and I noticed no nags on my laptop for a really long time...lately I've noticed M$ is pushing security updates to it again. This is a computer I almost pulled from the "on line" array when it got infected twice by MySpace and YouTube....but I got it cleaned up through a few programs and a couple hours...
That's funny, because I got patches for every single pirated Apache server I own!
Please, for the good of Humanity, vote Obama.
I mean, windows users are 99% more likely to be hosting malware.
Basic Conditional probability:
Probability of {Malware given that running IIS} = P{Malware and running IIS} / P{Running IIS}.
So the Slashdot summary was correct: P{Malware given that you're running IIS} is twice as big as P{Malware given that you're running Apache}.
What's purple and commutes? An Abelian grape.
What's purple and commutes? An Abelian grape.
Sometimes boldness is in fashion. Sometimes only the brave will be bold.
Really? I guess I'll have to reconnect it and try again. To be honest, WMP is the ONE thing I don't want updated.
They can't possibly be genuine pirated versions, then!
Arrrrrrrr(gh)!
licet differant, aequabitur
I think it would be fair to note that the BSD maintains a Quasi Government through out the dictatorship, still giving freedom to the Freedom Fighters outside the reach of the dictatorship. Every now and then another leader would come along and use the Freedom Fighters' ideas to launch an attack against the current dictatorship and cause another election between the two dictators. Freedom Fighter spies would also gain access to the dictatorship's secrets every now and then and implement policy against them. Finally the Freedom Fighters would be forever immortalized in the history of every dictatorship, no matter what the dictator wanted to do, because he would face a revolution if he chose to take down their names from The Great Temple of the About Tablet That Few Even Visit. And the saying BSD programmers code for free GPL programmers make free code. holds true. Viva la GPL.
>The majority of that malware appears to originate from China and South Korea, according to Google.
I don;t know about you guys but this looks more like the sysadmin is installing the malware on purpous rather than being infected by malware.
"bad analogy time, with no cars involved!"
Actually, it was a good one.
Well... At least if was not incorrect. And... It was amusing.
What else can you ask for?
http://www.dieblinkenlights.com
Bigger question, does this article mean the "security through obscurity" argument people throw at systems like OS X is bullshit? Apache servers outnumber IIS, yet IIS gets twice as owned.
"Sufferin' succotash."