Slashdot Mirror
Breakdowns of Website Defacement by Platform
SkiifGeek writes "Zone-H have recently posted the statistical breakdown of the collected website defacements from the last few years. Surprisingly, in 2007 more Linux servers suffered a successful attack than all versions of Windows, combined. Similarly, more Apache installations were successfully attacked than all IIS versions combined. A day after posting this data, Zone-H have questioned the appropriateness of continuing to operate the archive. Despite the valuable information that can be gleaned from the service, it may soon be lost to the world. The natural successor to the now-defunct Alldas archive of defaced websites, Zone-H's archive maintains records of over 2.6 million defaced sites but may be shut down due to the continuous accusations of impropriety leveled against them any time they disclose and mirror a reported defacement."
Even for slashdot that is terrible........
Websight? I hope that is in TFA, which due to tradition I did not read.
Signature v3.0, now with 42% less memory usage.
Given the proportion of Apache servers to IIS servers on the Internet, I don't think the ~280% difference is that strange. After all, most websites are vandalised through oversights in custom scripting etc., rather than security holes in Apache.
Actually mention proportions. Clever little summary, it was as if one million slashdot readers suddenly cried out in indignation... "I have to read the article? Nooo"
I record my sleeptalking
Perhaps I missed it in TFA, but I saw no weighting for market share...
To pick an arbitrary statistic, in June 2007 Google reported Apache with a 66% market share and IIS with a 23% share (source). Given that the TFA lists "Attack against the administrator/user" as the most common attack method by a wide margin, and it seems to me that both Apache and IIS would be equally vulnerable to dumb administrators, wouldn't it make sense that the server with the larger market share would see more attacks?
When the cure (more often than not these days) involves not having to disturb Apache at all (save for possibly changing something in httpd.conf), but instead fixing/dumping the bad script that let the baddies in, or patching PHP to plug the hole in it, then odds are good that it ain't Apache's fault, no?
To be fair, it would also be like blaming IIS for crap XML or ASP script, and MSFT would certainly waste no time in saying so.
Quo usque tandem abutere, Nimbus, patientia nostra?
You know it comes across as interesting that whenever statistics come out that show that "Windows had more worms and viruses this year than Linux or MacOSX!" people use that as fuel to the fire to continually denounce Windows as a bad platform, Microsoft is the devil, Microsoft is evil, and any other number of ways of putting down Windows to make themselves feel better.
Then a statistic that comes out that shows Linux/Apache at the top of a security vulnerability list, and it's immediately "Oh it's the users! They don't know how to implement the platform properly! It's the scripting language they used! These numbers are meaningless without marketshare values!"
What we have as facts when it comes to security vulnerabilities:
1. When more people use it, there is a tendency to have more security vulnerabilities since more eyes are scrutinizing what is or isn't possible with that platform.
2. No matter which platform, it is only as secure as the person's implementation. If they don't know how to configure the system properly, it doesn't matter in the end.
So why all the hate against Microsoft for their products if these same problems affect all platforms?