Akamai Warns: Linux Systems Infiltrated and Controlled In a DDoS Botnet

An anonymous reader writes Akamai Technologies is alerting enterprises to a high-risk threat of IptabLes and IptabLex infections on Linux systems. Malicious actors may use infected Linux systems to launch DDoS attacks against the entertainment industry and other verticals. The mass infestation of IptabLes and IptabLex seems to have been driven by a large number of Linux-based web servers being compromised, mainly by exploits of Apache Struts, Tomcat and Elasticsearch vulnerabilities. Attackers have used the Linux vulnerabilities on unmaintained servers to gain access, escalate privileges to allow remote control of the machine, and then drop malicious code into the system and run it. As a result, a system could then be controlled remotely as part of a DDoS botnet. The full advisory is available for download only with registration, but the (Akamai-owned) Prolexic page to do so is quite detailed.

Comments

Hmmm

[Anonymous Coward]

So vulnerable servers get compromised. This is news? News worth registering to read? Hrmph.

Re:Hmmm

[Anonymous Coward]

It's news because it illustrates that, as much as Linux users like to throw stones at Windows, they too are vulnerable. Anyone can pick through the source and find security holes what can be exploited - perhaps even much more subtle ones than anyone would ever find on Windows.

Re: Hmmm

[Anonymous Coward]

The vast majority of Linux deployments are on server systems. These are easier to lock down, since there are no users downloading cool stuff and bringing in malware. Generally speaking, a remote exploit is required to bring down a server system. There are two newsworthy things in this report. First, a botnet of (presumably well-connected) Linux machines has been used in a DDOS, probably not the first time this has happened. Secondly, and this should not be newsworthy, not keeping up with patches will sink a system of any kind. Server, client, Linux, Mac, Windows, all need to keep up with rapidly evolving security threats.

Re:Hmmm

[bobbied]

The people that have their servers compromised in this way are amateurs and shouldn't have put their servers on the web, EVER. This is roughly equivalent to fielding IIS from 2001 on windows XP and not keeping your patch set up to date. You are going to be hacked.

Any sysadmin who is thinking about it, would put a web server and all it's components in a chroot jail and force it to run in user space and set up to refuse interactive logins for this user.. That way any "escalations" of privilege won't get you much more than the web server. It's easy, quick and effective.

So this isn't a really fair comparison you are making. Linux is BY DEFAULT more secure than Windows, mainly by design. Microsoft has made great strides of late, but fundamentally they are starting from a weak position (remember Windows 3.1?) and you have to install components to make it more secure, where Linux starts secure and gets security downgrades when you install and configure stuff. Either way, if you don't manage your server, you will have problems.

Re:Hmmm

[Barsteward]

they throw stones at the OS mainly

Re:Hmmm

[Opportunist]

I prefer to throw at the users. The chance to hit the culprit is so much higher.

Re:Hmmm

[mystikkman]

So this isn't a really fair comparison you are making. Linux is BY DEFAULT more secure than Windows, mainly by design. Microsoft has made great strides of late, but fundamentally they are starting from a weak position (remember Windows 3.1?) and you have to install components to make it more secure, where Linux starts secure and gets security downgrades when you install and configure stuff. Either way, if you don't manage your server, you will have problems.

The point of comparison should be between the server OSes. So, do you really think Linux on the server is more secure than Windows Server 2012R2 ?

Re:Hmmm

[Anonymous Coward]

No, unmaintained web servers getting attacked and turned into bots is not news. This problem is not even specific to Linux systems. Any server that isn't patched with latest security fixes for the OS and applications is at risk regardless of the OS used.

Re:Hmmm

[pooh666]

This comparison is pointless and simply minded or just a troll. Security is about layers, so who really cares, one layer or another always needs attention, sanity, and in particluar maintenance. The parent had good points, but still, again, who really cares about out of the box? No one who should have a job setting up servers. Out of the box my bricked Nintendo is very secure. Or should we say OpenBSD for all cases? No of course not.

Re:Hmmm

[Anonymous Coward]

Yes, but that doesn't mean you don't need to apply security updates when they show up. GNU/Linux is easier to maintain the security of. Users on the desktop only have to worry about one screen popping up, not dozens. It's allot harder to get tricked into installing a malicious piece of software when everything you need to install comes from a well maintained central repository. The default settings are also more secure (macros as example aren't on by default, unnecessary services don't start automatically for desktop distributions, etc). By default users are segregated and even hooking up a dial-up modem requires permission be granted to the user.

Re:Hmmm

[Lumpy]

Linux was not vulnerable it was Apache and other software. running Apache on BSD, Windows or OSX would give them the same attack vector. This is the same as Outlook launching and running an executable in an email. It's not the OS it's an application that has the problems.

Lastly it's all software that has not been updated in a very long time and is not being maintained.. That alone causes giant holes in any OS or software ever made.

FYI: there are a LOT of windows machines out there running ancient IIS... I see code red worm attempts in my logs daily. It's not the OS, it's the idiots that own and run the machines.

Re:Hmmm

[wirefarm]

"code red worm ..."

Those words gave me a twinge of nostalgia.
Yes, I just got a bit sentimental about an old buffer overflow.
Sysadmin Things (tm)... :-)

Re:Hmmm

[Anonymous Coward]

The people that have their servers compromised in this way are amateurs and shouldn't have put their servers on the web, EVER. This is roughly equivalent to fielding IIS from 2001 on windows XP and not keeping your patch set up to date. You are going to be hacked.

Any sysadmin who is thinking about it, would put a web server and all it's components in a chroot jail and force it to run in user space and set up to refuse interactive logins for this user.. That way any "escalations" of privilege won't get you much more than the web server. It's easy, quick and effective.

So this isn't a really fair comparison you are making. Linux is BY DEFAULT more secure than Windows, mainly by design. Microsoft has made great strides of late, but fundamentally they are starting from a weak position (remember Windows 3.1?) and you have to install components to make it more secure, where Linux starts secure and gets security downgrades when you install and configure stuff. Either way, if you don't manage your server, you will have problems.

https://securityblog.redhat.com/2013/03/27/is-chroot-a-security-feature/
Daemons are NOT chrooted by default.
Processes inside a chroot can still execute privilege escalation attacks against the kernel.
Root can escape a chroot.

On top of all THAT, a normal user inside a chroot is PERFECTLY capable of joining a DDoS botnet anyway.

Remember Windows 3.1... and forget twenty years of Linux bugs?
I'm just going to repeat the GP..
"It's news because it illustrates that, as much as Linux users like to throw stones at Windows, they too are vulnerable. Anyone can pick through the source and find security holes what can be exploited - perhaps even much more subtle ones than anyone would ever find on Windows."

Linux security is not magic, _especially_ "by default".

Re:Hmmm

[Anonymous Coward]

What low IQ dumbfuck modded this down? it's 100% correct. Software is far more of an attack vector than the OS is. and it always has been.

Re: Hmmm

[Anonymous Coward]

These are easier to lock down, since there are no users downloading cool stuff and bringing in malware

No, just users downloading content management systems outside of package management, and thus never updating them or their accompanying modules.

The majority of spam I receive is coming from Linux systems. The majority of brute force attacks I see knocking on port 22 are coming from Linux systems.

Easier to secure, absolutely. But Windows itself is in the realm of "easy" to secure. It's all meaningless if people aren't freaking securing it.

Re:Hmmm

[dmpot]

Any sysadmin who is thinking about it, would put a web server and all it's components in a chroot jail and force it to run in user space and set up to refuse interactive logins for this user.. That way any "escalations" of privilege won't get you much more than the web server. It's easy, quick and effective.

If an attacker find a way to escalate privileges to "root" within the chroot jail, he can take over the whole system. So, a chroot jail does not help much except by limiting the surface of the attack to escalate privilege. For example, you can eliminate all suid programs within the jail environment. However, such manual installation can be difficult to maintain as automatic updates may not work. So, the chroot jail is not any better than properly configured AppArmour or SELinux, which also allows significantly to restrict what the web user can access.

Usually a more secure and simpler solution is to use OpenVZ (or another paravirtualization) to isolate the virtual machine that run the web server.

Linux is BY DEFAULT more secure than Windows, mainly by design.

I am not sure I can fully agree with you here. A lot depends on application installed, the system configuration, and how the system is used, and other things that have nothing to do with design. The only thing where Linux clearly wins is when you want to harden security accordingly to your needs. Linux is far more transparent, so it is easy to configure it properly, while Windows does a lot of things behind your back and some of them may unintentenly can compromise security.

Re:Hmmm

[Tharkkun]

The people that have their servers compromised in this way are amateurs and shouldn't have put their servers on the web, EVER. This is roughly equivalent to fielding IIS from 2001 on windows XP and not keeping your patch set up to date. You are going to be hacked.

Any sysadmin who is thinking about it, would put a web server and all it's components in a chroot jail and force it to run in user space and set up to refuse interactive logins for this user.. That way any "escalations" of privilege won't get you much more than the web server. It's easy, quick and effective.

So this isn't a really fair comparison you are making. Linux is BY DEFAULT more secure than Windows, mainly by design. Microsoft has made great strides of late, but fundamentally they are starting from a weak position (remember Windows 3.1?) and you have to install components to make it more secure, where Linux starts secure and gets security downgrades when you install and configure stuff. Either way, if you don't manage your server, you will have problems.

Neither OS is secure unless it's behind a firewall.

Re:Hmmm

[KingMotley]

Not exactly the same. Windows 3.x line died back with Windows ME. Windows XP and beyond are all using a different kernel with a different architecture based on the Windows NT line, but share much of the same public APIs (Win32). You don't "install components to make it more secure", and that hasn't been true for nearly 20 years (20 if you used the Windows NT line). At least no more true than it is for linux, or any other OS. Of course there are packages that attempt to identify and mitigate issues, but so does every other OS, including linux.

Re:Hmmm

[chipschap]

"It's news because it illustrates that, as much as Linux users like to throw stones at Windows, they too are vulnerable. Anyone can pick through the source and find security holes what can be exploited - perhaps even much more subtle ones than anyone would ever find on Windows."

I find this fascinating. Some Windows fans will grab onto something like this, an exploitable bug in Linux, and use that to "prove" that Windows is better. "Look here, Linux has an exploitable bug, obviously it's no good. I told you how much better Windows is, now it's proven science!" And the additional comment about finding bugs more subtle than those on Windows? Where's the evidence for that statement, other than perhaps in the fact that Linux source is readily available while Windows source is not?

Any OS has exploitable bugs. Failure to patch is, as noted by many other posters, the real issue. Don't necessarily condemn one system or the other because there are bugs. Instead, maybe we might look at the track record, in which case some conclusions should emerge.

Re:Hmmm

[bobbied]

Neither OS is secure unless it's behind a firewall.

Unless you (or the distribution you use) configures it, Linux is 100% secure from network attacks when installed. Why? Because the network card driver won't be loaded and the network adapter will be unconfigured and ZERO services will be running. All three will need to be true, or nobody is getting into your system from the net.

So.. Unless you intend to protect your server from physical fires, you don't need a firewall on a bare Linux system...

However, both Windows and Linux have fine network firewall's these days. You might want to tweak them to your needs, but they exist. Where I would recommend not putting anything directly on the internet if you can avoid it, most firewall's are pretty useless unless you actually think about what you let in and out and configure the thing properly. In any case, I'd not be totally opposed to putting a Linux box on the Internet if necessary, but I'd never do that with a windows box. Just my opinion though.

Re:Hmmm

[mlts]

On one hand, Linux has had a reputation for being secure. On the other hand, Windows has made great strides in improving things.

On the gripping hand, security really belongs to the person sitting at the admin console [1]. The first thing a lot of Linux users do is kill SELinux, which weakens the security model tremendously, where it takes is just one weak SUID program or one running as root to have the machine. The second thing is that because Linux doesn't have signed executable functionality [2], something like AIDE or tripwire is a must.

From there, it is about basic security practices. If a server sits for months to years without updates, it doesn't matter what OS it runs, eventually there will be a hole, and eventually it will get pwned.

[1]: Be it an actual window, a serial port, a VMWare console, SCVMM window, remoted in via SSH or RDP.

[2]: It would be nice if the Linux kernel had functionality compared to trustchk in AIX. It isn't signed executables per se (since it uses a manifest list), but it does help prevent unauthorized stuff from loading, even libraries.

Re:Hmmm

[synapse7]

I think you meant to say windows NT?

Re:Hmmm

[mlts]

In a way, I'm hoping for more eyes on Linux for security vulnerabilities. The reason is that if they appear, they can get fixed almost immediately. MS is decent at handling patches, but most bugs end up waiting until Patch Tuesday, unless it warrants an out of band fix.

Maybe I'm showing my age... part of the standard procedure of getting Linux set up and deployed was getting onto security mailing lists like Bugtraq and its successors. It is a lot of mail, but better some time spent finding and fixing a vulnerability, than the time it takes dealing with a successful attack, or even an intrusion attempt, especially if an organization has different IT groups (network, system, SAN, etc.)

Re:Hmmm

[mlts]

If I can get code to execute in a context of a jailed UNIX process, such as a webserver, which would allow me to send traffic in and out, a malware writer has a usable client for a botnet, for spam, DDoS, and other uses. Even if they just have control of that webserver's port 80, they can use that and modify the server to occasionally serve malformed pages in hopes of nailing a buggy browser or browser add-on.

Similar to a program that just gets access to a user context in Windows. With just user access, their files can be encrypted for random, pictures can be copied off for blackmail, and the machine can still function as a botnet client.

Layers are critical. Even with limited contexts, firewalls are still crucial (to prevent a web server from making outgoing communication, for example), as well as integrity checks.

Re:Hmmm

[bobbied]

There is a lot of room for improvement on both sides of this argument. I would support a "trusted" executable and shared library loader as being a vast improvement in Linux security, but the fact remains... Windows/Microsoft has been playing catch-up in security where Linux has been leading over the last decade. Microsoft has been gaining ground, but they are still running in second place in security (well, maybe third if you include Apple, Fourth if you include SCO Unix and fifth if we include Solaris).

Re:Hmmm

[Anonymous Coward]

So why have all of the NT kernel based systems required anti-virus programs from multiple vendors?

I guess you call anti-virus programs "components".

Re:Hmmm

[avgjoe62]

...Linux source is readily available while Windows source is not?

To the general public that is true, but don't forget this leak and more recently this disgruntled employee. And remember - these are only the leaks of source code that we know about. I am sure that a lot more of the source is available to those with fewer scruples than you or I.

Re:Hmmm

[benjymouse]

but the fact remains... Windows/Microsoft has been playing catch-up in security where Linux has been leading over the last decade.

So where are those facts?

Because they way I look at it there has been several embarrasing, high-profile successful attacks on Linux servers over the past few years:

Debian server compromised: http://www.zdnet.com/debian-se...
Ubuntu servers compromised: http://www.theregister.co.uk/2...
kernel.org compromised: http://lwn.net/Articles/457142... (we're still waiting for the post morten on that)
linuxfoundation.org and linux.com compromised: http://thehackernews.com/2011/...
red hat and fedora servers compromised: http://www.cnet.com/news/red-h...

(and we do not even mention the OpenSSL fiasco)

So where are the widespread Windows Server compromises?

Re:Hmmm

[bobbied]

You cannot seriously believe that windows started out better than Linux security wise?

Do you remember DOS? Windows 3.1.1? Security was woefully lacking, it wasn't even a concern. At the same time, Linux was being developed, with the security model it has today, mostly unchanged. Windows has gong though many revisions and changes in the security design from ZERO security and no such thing as having separate user accounts to where we are now. Linux started out, very similar to what it is now.

There are exploits on both Windows and Linux platforms, I'm not saying Linux is 100% secure, it's not. But, it starts from a better place than Windows does. If you refuse to actually manage, patch, and monitor systems you are not managing the risk, it doesn't matter what OS you use.

(and we do not even mention the OpenSSL fiasco)

So where are the widespread Windows Server compromises?

Seriously? OpenSSL was not a LINUX issue persay, it was a library that was used on multiple OS's INCLUDING Windows.

So you are claiming there where no widespread Windows Server compromises? I can see you are new here, never ran NT and IIS then? Shesh... Newbies..

GET OFF MY LAWN!

Re:Hmmm

[Anonymous Coward]

but the fact remains... Windows/Microsoft has been playing catch-up in security where Linux has been leading over the last decade.

So where are those facts?

Because they way I look at it there has been several embarrasing, high-profile successful attacks on Linux servers over the past few years:

Debian server compromised: http://www.zdnet.com/debian-se...
Ubuntu servers compromised: http://www.theregister.co.uk/2...
kernel.org compromised: http://lwn.net/Articles/457142... (we're still waiting for the post morten on that)
linuxfoundation.org and linux.com compromised: http://thehackernews.com/2011/...
red hat and fedora servers compromised: http://www.cnet.com/news/red-h...

(and we do not even mention the OpenSSL fiasco)

So where are the widespread Windows Server compromises?

To be frank, I don't think anyone bothers reporting on them anymore. For a journalist "Linux server compromised" sounds far more sexy than "windows server compromised." These guys, after all, have to get readers in order to put food on the table.

Re:Hmmm

[ne0n]

Well, it's for a good cause... TFS did mention DDOS against the entertainment industry. Good news is news worth reading.

Re:Hmmm

[mystikkman]

So when Linux gets infected, it's the users fault but when Windows gets infected, it's Microsoft's fault[1]?

[1] http://yro.slashdot.org/commen...

Gotta love Slashdot logic.

Re:Hmmm

[Blakey Rat]

Ok your brain is broken in two ways here:

1. You keep talking about history. Nobody gives a shit which OS was more secure in 1986, we care which is more secure now. The question is, if I were standing up a server today, which OS would be the best choice?

2. You're redefining "Linux" to mean whatever happens to make it best in any given situation. Saying OpenSSL isn't part of "Linux" is both technically correct, and extremely intellectually dishonest.

To be perfectly frank: the grandparent has an extremely good point that you're completely ignoring. In recent years, Linux server security has been measurably worse than Windows server security.

Re:Hmmm

[mystikkman]

Do you remember DOS? Windows 3.1.1? Security was woefully lacking, it wasn't even a concern. At the same time, Linux was being developed, with the security model it has today, mostly unchanged. Windows has gong though many revisions and changes in the security design from ZERO security and no such thing as having separate user accounts to where we are now. Linux started out, very similar to what it is now.

Please stop repeating that, it stopped being true as of 10 years ago since Windows ME was the last OS based on DOS/Win 3.1.1 code.

XP, Vista, 7 and 8 are all based on the Windows NT family which was developed with security in mind and separate user accounts etc.

http://en.wikipedia.org/wiki/W...

Re:Hmmm

[HermMunster]

Everyone is vulnerable when they aren't patched (and sometimes when they are). This particular warning only affects unpatched servers. I assume because servers, though they should be patched right away, they often aren't, because businesses (business managers) doesn't want to down the server for the patch. New technologies will allow patches even to the kernel without taking down the server. When that happens things like this will mostly disappear.

No, most reasonable people do not say that Linux is invulnerable, however, the Linux desktops and servers are far less vulnerable than almost all other operating systems.

Re:Hmmm

[bobbied]

So when Linux gets infected, it's the users fault but when Windows gets infected, it's Microsoft's fault?

Personally, I haven't said that here..

Microsoft chooses to install and activate a lot of risky stuff that most Linux distributions don't, but having a box compromised is not the vendor's fault. I'd never put a Windows freshly installed box on the network without first applying all service packs and locking the system down. However, a Linux box is not a risk (at least not the distributions I run) after a clean install so I don't have an issue drooping them on the net to pull patches and configure the software.

In both cases, if you mismanage their security, you get a bad result. It's just harder, in general, to get a secured Windows box, because you have to actively do something to secure things before it is safe, while a minimal Linux box starts out fairly safe and goes down hill from there. One comes off the install media in an unsafe configuration, the other is usually locked down.

So who's fault is it? Yours, if you put an unpatched unconfigured Windows box directly on the net right after you install it. It's also yours if you open up the holes in your Linux install.

Re:Hmmm

[Anonymous Coward]

Do you remember DOS? Windows 3.1.1?

Yes, they were from over 2 decades ago and their code has long since been purged from the modern codebase (over a decade ago). Making them completely irrelevant.

At the same time, Linux was being developed, with the security model it has today, mostly unchanged.

Which is part of the problem.

So you are claiming there where no widespread Windows Server compromises? I can see you are new here, never ran NT and IIS then? Shesh... Newbies..

Why are you living in the past? The world has changed and you obviously can't keep up, time to retire grandpa.

Re:Hmmm

[bobbied]

Ok your brain is broken in two ways here:

1. You keep talking about history. Nobody gives a shit which OS was more secure in 1986, we care which is more secure now. The question is, if I were standing up a server today, which OS would be the best choice?

Best choice or most secure choice? I cannot answer the first question for you because there are reasons to use Windows and reasons to use Linux which have noting to do with security. Most secure choice? That too depends, but if you are talking about a situation where "all other things are equal" then a properly configured Linux box seems like a better choice to me. Of course, if you cannot manage a Linux box properly, then go with what you know that you can manage, but in that case we are not "all things being equal" anymore.

2. You're redefining "Linux" to mean whatever happens to make it best in any given situation. Saying OpenSSL isn't part of "Linux" is both technically correct, and extremely intellectually dishonest.

To be perfectly frank: the grandparent has an extremely good point that you're completely ignoring. In recent years, Linux server security has been measurably worse than Windows server security.

I think you are wrong on that. There has been an explosion of Linux based servers on the Web in the last decade. Many of these are not appropriately managed and suffer as a result, plus you also see a lot LESS Windows/IIS installs out there for a number of reasons (mostly due to cost and the past issues with IIS exploits) so the attack surface is much larger. Given the number of these servers which are not appropriately managed, there are a lot more systems compromised. If you don't keep your system up to date and watch the security posture of your system, it's going to eventually get hacked, I don't care what OS you run.

You see, I'm not claiming Linux is perfect, obviously it has had issues. I'm claiming that Windows has been playing catch up on security issues. Obviously they have made great strides. You want to claim windows is better... Ok, if that's what you can manage correctly, it's better for you. IMHO Linux is better, both historically (which even you cannot argue with apparently) and currently remains better. Your mileage may vary, past performance is no guarantee of future performance, and all such fine print you are accustom to reading..

Re: Hmmm

[AaronLS]

Mostly valid points. None of them invalidate the parent's point. If there is a significant infection of malware, then it is newsworthy. What factors led to the infection don't make it unnewsworthy.

"These[server systems] are easier to lock down, since there are no users downloading cool stuff and bringing in malware." Your comparing desktop usage to server usage. Regardless of Linux or Windows the same issues are there for each usage scenario.

-Desktop: If there is a vulnerability in a Linux or Windows desktop, the usage pattern of users is going to be a pathway onto the machine for malware. These days you could probably take any average user since most are unfamiliar with desktops, stick them with a desktop of any OS flavor, and they will in both cases go to a browser and do things that put the system at risk. These days they implement similar levels of security. Many flavors of both prompt you to escalate an process to root/admin privilage, so each are vulnerable to users unwisely escalating software of questionable sources.

-Server: If there is a vulnerability in a server, regardless of OS, "a remote exploit is required to bring down a server system". This doesn't invalidate the parent's point.

Parent's point is that it is newsworthy because many naive individuals in the Linux community likes to purport that Linux is somehow invulnerable to such exploits. When I say "many naive" I don't mean to say all Linux users are naive, just that there are a fair share who don't understand that Linux and software running on Linux has the same potential to harbor undiscovered vulnerabilities as any other competing OS/software.

This means they make blanket statements about how this or that security problem effecting Windows isn't a concern for Linux. They don't know about clarifying criteria that Linux is more secure under the circumstances that you maintain updates and properly administer WAN facing interfaces.

The result is you have individuals running unmaintained Linux servers because they think they are more secure, but which require significantly more attention than similar Windows counterparts. So you have two factors working against the security of Linux, misinformation, and ease of maintenance.

Even in situation where you have a capable staff who understand the importance of maintaining updates. If you have updates that are fragile and require lots of testing, require alot of babysitting to apply, or are in other ways difficult to automate in a reliable way, then you are going to occasionally create situations for admins where their manpower isn't enough to get to those updates immediately. That's not to imply that Windows updates don't sometimes break things and require testing, but I would say they are easier to automate overall and more reliable. Probably due to the fact there are far fewer flavors of Windows, so updates which do have issues are quickly hotfixed. When I've had updates on Linux fail, sometimes there is a good bit of manual work to back them out, fix whatever went wrong, and re apply them.

I am not trying to say Windows is better than Linux, as I am not trying to do a compelte comparison of the two, but simply pointing out that this article highlights some of the factors that contribute to the formation of such an infection. Certainly Windows has some of these same issues as well and we've seen infections that targeted machines that weren't up to date. However, I think Windows has done a better job at least with the automatic updates to address this kind of problem. It certainly isn't always perfect, but its pretty good.

Re:Hmmm

[Anonymous Coward]

Unless you (or the distribution you use) configures it, Linux is 100% secure from network attacks when installed. Why? Because the network card driver won't be loaded and the network adapter will be unconfigured and ZERO services will be running.

Yes and this rock that I have here is equally functional and equally secure.

Re:Hmmm

[exomondo]

They haven't required it, but if you're going to be downloading and installing things from dubious sources and browsing the web then yes it is advisable no matter what platform you are on. Just like there is avast!, bitdefender, AVG, Kaspersky, Trend Micro, Norton, McAfee, etc... for Android, which is Linux.

Re:Hmmm

[Blakey Rat]

IMHO Linux is better, both historically (which even you cannot argue with apparently)

I'm making no argument one way or the other. I'm saying that's completely irrelevant.

and currently remains better.

Right, but based on what? Just your humble opinion? Do you have any evidence whatsoever? Have you even used recent versions of Windows Server?

Because your extreme ignorance of it tells me you have not, and as a result your humble opinion isn't worth jack.

Re:Hmmm

[grcumb]

No, unmaintained web servers getting attacked and turned into bots is not news. This problem is not even specific to Linux systems. Any server that isn't patched with latest security fixes for the OS and applications is at risk regardless of the OS used.

The biggest difference we see between proprietary and FOSS systems is that the lack of maintenance in proprietary systems is often the fault of the vendor. In short, there's no way to keep a service or application patched, because there are no patches forthcoming.

Lack of maintenance by the sysadmin is a more common source of insecurity on Linux systems. The patches are often (not always, but often) there, but they do have to be applied by someone.

Re:Hmmm

[bobbied]

I think you are trollin now..

I have decades experience with both windows and Linux and just happened to finish up an Windows Server 2008 R2 install for a customer delivery yesterday. No, I've not had the opportunity to play with Windows Server 2012 yet, but it's likely in my future.

Of course, all this "My Experience is better than yours" bluster amounts to nothing more than arguments about who has the biggest...... If you don't like what my 20+ years of experience says, feel free to ignore me. When you get into trouble, let me know, I'll help you when you are willing to listen. So get of my lawn, until you can talk nice to the old guy... ;)

Re:Hmmm

[bobbied]

Please stop repeating that, it stopped being true as of 10 years ago since Windows ME was the last OS based on DOS/Win 3.1.1 code.

XP, Vista, 7 and 8 are all based on the Windows NT family which was developed with security in mind and separate user accounts etc.

Ok, I'll stop. Just one more question... Where do you think the designers of NT came up with that idea? Hmmmmm? Wouldn't have been Unix now would it?

OK, OK, I'll stop rubbing it in that Microsoft has spent the last decade working on their security... Just stop debating at my assertion that Windows starts less secure and needs to have stuff added to it for security reasons....

Re:Hmmm

[OutOnARock]

Ok, I'll stop. Just one more question... Where do you think the designers of NT came up with that idea? Hmmmmm? Wouldn't have been Unix now would it?

DEC VAX?

Re:Hmmm

[mystikkman]

Where do you think the designers of NT came up with that idea? Hmmmmm? Wouldn't have been Unix now would it?

Wrong again, it was designed by someone who quite hated Unix.
en.wikipedia.org/wiki/Dave_Cutler
http://www.theverge.com/gaming...
Windows NT's primary inspiration was VMS.
http://en.wikipedia.org/wiki/O...

Windows NT did not start less secure.

Re: Hmmm

[Anonymous Coward]

You idiot, go correct your facts.

Re:Hmmm

[MikeBabcock]

The source has nothing to do with it, but yes, any one unpatched OS can be at risk just like any other ... if improperly configured.

I'm quite certain with a properly configured SELinux configuration even unpatched Apache would survive however.

Re:Hmmm

[MikeBabcock]

Its just miseducation on your part to think that OpenSSL is part of Linux. It may ship with a given Linux distribution, or it may not. Its a library used by third party software, some of which may or may not be part of the problem.

Most vulnerable systems have disabled SELinux, disabled other security features and are running fast and loose with their user permissions.

Re:Hmmm

[Gr8Apes]

The point of comparison should be between the server OSes. So, do you really think Linux on the server is more secure than Windows Server 2012R2 ?

Yes.

Re:Hmmm

[bobbied]

So NT came from VMS, no argument there, but where did VMS come from? Unix on the PDP-11.

Now this is before my time, but I seem to recall that Unix was developed for the PDP-11 as an effort to allow a common OS across multiple hardware platforms way back in 1969. Just so happens that Digital PDP-11 was the predecessor of the Digital VAX-11780 for which the initial VMS version was written for. VMS was initially released in 1977 (a full 7 years after Unix). Unix leads to VMS, which leads to NT.. So, when the primary developer of NT jumped ship at Digital and boarded the USS Microsoft he brought along his hate for all things VMS, but adopted many of the security concepts of VMS, which adopted them from Unix. Well Unix and the equivalent of the NSA's recommendations for things like ACL's and audit trails.

So, despite your scorn, I am right on the idea that multi-user came to Windows from Unix.

Windows NT can off the distribution media much less secure, not necessarily because the kernel was ill-conceived or implemented, but because it had to be "Windows" and had to work with existing network infrastructure which was already fielded. Infrastructure which was full of huge holes and required services that exposed the boxes to exploits we would consider atrocities today. But that's what Microsoft had to do to keep it's customer base buying their software. Once security became an issue they started to shore up things, but they've been hampered by the "it has to work with what's out there" requirement, so we where forced to live with the stupid security of Windows for decades.

Was NT as secure as Unix? Maybe the kernel was, but NT certainly was not more secure in the normally fielded form. We've come a long way since 1981, but because of it's legacy install base, Windows has lagged in being secure.

Re:Hmmm

[bobbied]

Ok, I'll stop. Just one more question... Where do you think the designers of NT came up with that idea? Hmmmmm? Wouldn't have been Unix now would it? DEC VAX?

The progression goes like this..

1. Unix was developed on the Digital Equipment Corp PDP-11 hardware in about 1970. Unix started as a multi-user system that supported memory segment protection between user processes and kernel space.

2. VMS followed on the next generation of DEC hardware the VAX-11780, which made it's appearance in the late 1970's. This system introduced Virtual Memory spaces for user processes. (Thus it's name Virtual Memory System) VMS was not first in being muti-user, commercially that was Unix.

3. Windows NT arrived in the late 80's, and not surprisingly ran on DEC VAX hardware as well as x86 based systems, as the chief engineer of NT came out of the VMS development team at DEC.

So NT got this idea from VMS which got it from Unix....

Re:Hmmm

[mystikkman]

Linux had and has a string of security issues, including things like this.

http://theinvisiblethings.blog...

Try doing that on a Terminal Server.

What multiuser security again?

Re:Hmmm

[bobbied]

I don't run X on any "server" system I manage. Not for this reason, but for the general security concept that you don't run stuff you don't use. Good luck turning off the GUI on your windows box...

However, if you did have X running, it's only going to accept X client connections from the local machine (unless you've opened it up further). This means that any attack vector though X will have to be launched from the local box. Which means that the attacker will have to compromise the local box in some other way.

X should only be run by systems doing "desktop" duty, which if you are comparing apples to apples means you have to compare this to a Windows desktop OS. If you let somebody into your Windows desktop box, they can launch stuff that compromises your system too.

So, Nice try, not a problem that is unique to Unix/Linux when you look at similarly configured Windows systems.

Re:Hmmm

[Anonymous Coward]

Now I *KNOW* you haven't used any of the Windows Servers released in the past 5 years. Don't want the GUI? Don't install it!

Re:Hmmm

[Anonymous Coward]

Yes; I was there Digital's ULTRIX was "going to run everything anywhere" and save the wurld.

Re: Hmmm

[Anonymous Coward]

Well, it's for a good cause... TFS did mention DDOS against the entertainment industry. Good news is news worth getting infected.
FTFY

Re:Hmmm

[mystikkman]

What about multiuser systems that are used as remote desktops? What about privilege separation? Why should a user logged into a machine be able to read keystrokes of all the others even though they're a normal user and not root? That doesn't happen with Windows.

Re:Hmmm

[bobbied]

You are mixing modes and comparing apples to oranges here.

If you are using a Linux box as a remote desktop server, you don't run the X server on the box in question, it runs on the machine that has the user's display. The "issue" in question is about applications that share the same X server, which in this case, each user has their own. However, this is rarely done anymore. If you have a LInux desktop running X, you don't usually run your applications on another box anyway, it runs locally, so you never open up the XHOST restriction and nobody can connect.

The privilege separation issue is a valid complaint, but again, I don't manage my servers using a GUI in the first place so I don't have X running, much less loaded so I don't have to worry about this issue. If you insist on running X, don't use it to administrate the box and you don't have this issue.

So, though my security practice, I avoid this issue. But we are talking ONE issue now which has long been known and easily avoided. There has been a raft of issues with Windows which where not so easy to avoid, detect and eliminate. Ever wonder why they picked the [CTL][ALT][DEL] key sequence in Windows NT? Think about it... Windows has the same kinds of issues, you just don't want to think about it. Ever Since TSR's where introduced in DOS, you've had this problem.

Re:Hmmm

[benjymouse]

I don't run X on any "server" system I manage. Not for this reason, but for the general security concept that you don't run stuff you don't use. Good luck turning off the GUI on your windows box...

Didn't you say that you just finished off setting up a Windows Server 2008R2? And you do not know about Server Core? I sense much deceit here. (IOW: I don't believe you).

However, if you did have X running, it's only going to accept X client connections from the local machine (unless you've opened it up further). This means that any attack vector though X will have to be launched from the local box. Which means that the attacker will have to compromise the local box in some other way.

Goes to show your grasp of this security thingy. There's this security principle called isolation:

Windows has been dealing with so-called shatter attacks where rogue processes sent messages remotely controlling windows belonging to other processes. Up until Windows Vista, Windows only isolated processes belonging to different users. With Vista and MIC (Mandatory Integrity Control), processes were prohibited from sending such messages to windows of higher-integrity processes.

X based Linux distros have absolutely zero isolation. Do you have any idea how serious this is? If there is a memory corruption bug in Firefox and the process is taken over (FF does not have sandboxing), it can install a keyboard hook in X and read every single keystroke entered into any windows. That includes a terminal windows, and worse, even if you sudo to root user, the keyboard hook read every single keystroke including the sudo password.

If that's a superior security model than I have a tower in Paris you may want to invest in.

Re:Hmmm

[benjymouse]

But we are talking ONE issue now which has long been known and easily avoided.

No, we are talking an issue that is the result of an inadequate security model that is incapable of securing anything but files.

Windows NT was designed with access control in place for files, devices, mailslots, pipes (named and anonymous), jobs, processes, threads, events, keyed events, event pairs, mutexes, semaphores, shared memory sections, I/O completion ports, LPC ports, waitable timers, access tokens, volumes, window stations, desktops, network shares, services, registry keys, printers, Active Directory objects, and so on. Yes Active Directory objects are in that list, because the model was designed to be extensible

We are talking you claiming that an operating system which cannot even pass the Orange Book requirements without severe redesign by NSA is more secure out of the box than an operating system which has met those requirements from day 1.

Ever wonder why they picked the [CTL][ALT][DEL] key sequence in Windows NT? Think about it... Windows has the same kinds of issues, you just don't want to think about it

The secure attention sequence is guaranteed to be non-hookable by software on the box. The reason for that is added security (that Linux lacks), not a remediation of lacking isolation. Yes, Windows has had similar (but far from as severe) problems with shatter attacks. And there's learning for you in how it was handled:

After UAC was introduced with Windows Vista it was made illegal for lower-integrity processes to send messages (or hook keyboard etc) of higher-integrity processes - even if they were running as the same user. Combined with the fact that IE ran as low-integrity it was made exceedingly difficult for an attacker to hook the kayboard or remote control other windows, even if he compromised the IE process.

However, trojan malware that users were tricked into installing as normal-integrity processes could still hook the keyboard. With Windows 7 Microsoft added to the protection: No longer can an equal-level (integrity level) process hook another process' window or keyboard. To accomodate accessibility tools which frequently need to do that, Microsoft allowed a slightly *higher* integrity level *if* and only if a certain manifest requires it and the files has been digitally signed.

The point of this is that both enhancements were achieved through the already extensible security model. Integrity levels were simply assigned SIDs. If the low-integrity SID is in your process token you are a low-integrity process.

You can *never* extend the simplistic Linux security model like this. It is forever limited to user identities. A process under Linux does not have a token - it has an effective user. It was designed with the faulty assumption that a process in all aspects could represent the user who started it. Proper tokens recognize that processes may have fewer rights, or even more rights than the user who launched it.

You have uttered unbased claims through this entire thread. Now it's time to tell the world how - specifically - the Linux mode is inherently more secure than the Windows model.

Tech details ?

[Anonymous Coward]

A link to get a white paper needing a registration is even worse than linking to a paywall

Re:Tech details ?

[Anonymous Coward]

"Malicious actors may use infected Linux systems to launch DDoS attacks against the entertainment industry and other verticals. "

The article writer didn't even include a link where you could download the software and install it.

I wana DDoS the entertainment industry too!

hmmm....

[Anonymous Coward]

Well if they just had installed Linux.... Oh, damn.

Re:hmmm....

[Megane]

They should have installed Gentoo!

Re:hmmm....

[war4peace]

...Or they should gave gentoo'd their installations.

Re:hmmm....

[mrmagos]

They should have installed Gentoo!

In hopes that the 'malicious actors' would get tired of waiting for the required binaries to be built and give up?

Re:hmmm....

[bobbied]

Well if they just had installed Linux.... Oh, damn.

Perhaps they should apply security patches too or perhaps actually TRY to configure their servers in a secure way? No, no other OS's have issues with this.

Re:hmmm....

[Anonymous Coward]

Except Windows...

Re:hmmm....

[danomac]

No, they'd give up waiting for portage to sort out dependencies. It reminds me of Windows XP before Microsoft patched it to not take 45 minutes to search for updates.

Re:hmmm....

[Anonymous Coward]

>Except Windows...

No, no: wait till Tuesday.

must me false

[Anonymous Coward]

everyone knows only windows can get infected

Re:must me false

[Anonymous Coward]

It is a little ironic that if this happened to Windows, many would say its the OS's fault and no surprise because unpatched Windows systems have vulnerabilities. Yet, when it happens to Linux systems, its probably the admins fault for having old unpatched systems out there.

Re:must me false

[bobbied]

Yes, but there is a logical reason for this.

Linux and Windows approach security in totally different ways. When you load a Linux kernel, it's secure, it starts that way. When you load windows, it's NOT secure, you have to load other stuff to make it secure.

So, if you have a Linux box that get's hacked, the admin really is a lot more responsible for this. He/she left the hole open for the attacker to get in. Sure, there are times when we don't know the hole exists, but the admin loaded the software.

Windows boxes? They come out of the install process wide open with a whole raft of dangerous services turned on. Not to mention they are starting from the security posture of Windows 3.1 and have been trying to put up defenses since. They have made a lot of progress, but it's still harder to shore up a bad design then it is to loosen up a secure design.

Re:must me false

[Anonymous Coward]

...When you load a Linux kernel, it's secure, it starts that way....

This isn't really true, most Linux configs for services aren't horrible, but they're far from good, SSH server, MySQL, and dozens of others I could name will come with pretty unsafe configs. This is why separate, optional packages that automatically harden these services exist. It approaches dangerous misinformation to claim Linux is secure out of the box, really any Linux distro set up to do useful work is probably not.

Is it as bad as Windows update hell? No, not really, but if you don't know what you're doing bad things can happen.

Re:must me false

[Opportunist]

This used to be true, it's by far no longer the case.

It's the ancient battle of usability vs. security. The most secure system is by design also the least usable one. And that's where the two systems came from. Windows was once "usability trumps security, no matter what". Linux was the exact opposite. Hence the reputation of Linux that you need to have a masters in CS to boot the damn thing, and for a network connection nothing less than a doctorate will do.

Various distributions now made it all a bit easier while at the same time Windows tightened security quite a bit (I mean, look back at Win95 and tell me they didn't...). The are approaching each other... if they haven't met already in the middle between the two extremes.

Re:must me false

[mystikkman]

Windows boxes? They come out of the install process wide open with a whole raft of dangerous services turned on.

Can you list what dangerous services are turned on by default on a Windows Server install? If you don't it's a pretty sign that you have no clue about what you're talking about and last used Windows about 15 years ago.

Re:must me false

[nabsltd]

Can you list what dangerous services are turned on by default on a Windows Server install?

"Server" is set to automatic and shouldn't be required at all unless you want to share files to another machine, and is the historic point of access for most exploits.

"Remote Desktop Services" is set to manual but seems to get started by some other service in a default install.

"WebClient" is set to manual but seems to get started by some other service in a default install, and is dangerous because it allows any program to upload/download files via a "trusted" mechanism, even if the program itself isn't really trustworthy.

I'm sure there are a lot more, but all of my machines have had useless startup services disabled, so I'd have to do a completely fresh install to check for sure.

Re:must me false

[Anonymous Coward]

I didn't know MySQL ran in the kernel these days? The GP said that the Linux kernel is secure by default and the Windows kernel needs security adding to it - that's largely true.

And yes, if you don't know what you are doing bad things happen. The same applies to most things in life.

Re:must me false

[benjymouse]

Yes, but there is a logical reason for this.

Linux and Windows approach security in totally different ways. When you load a Linux kernel, it's secure, it starts that way. When you load windows, it's NOT secure, you have to load other stuff to make it secure.

Sorry, but that is BS. When you load Linux it comes up with a security model through which there has already (by design) been punched a big hole: SUID. When you load Windows it comes up with a security model which has no need for such a massive hole. Countless otherwise benign bug has been turned into total system compromise bugs because of SUID.

Under Windows, all kernel objects types are securable with security descriptors. Linux was designed with only file system permissions. Processes did not have security descriptors, and such objects need to be mapped to files and filepermissions used to (inadequately) describe access permissions.

Windows services run in a separate session - interprocess communication is severely restricted. A process in another session cannot break through to e.g. the desktop, i.e. a daemon/background service cannot interact with the desktop. There is no such isolation in Linux unless you run SELinux. In Windows it is the default.

Most Windows services run under service hardening. Even custom sites you set up will by default run under service hardening. Under service hardening an ad-hoc identity is implicitly created for the service/website and this identity has no permissions whatsoever by default. It has to be granted any access permission it needs. You'd have to run SELinux or apparmor with a significant amount of configuration to achieve the same level of isolation under Linux. Under Windows it is default and straightforward.

Windows has mandatory DEP, much stronger ASLR, stack and heap encryption/checksumming and several other mitigation technologies not found in Linux. On by default.

Windows boxes? They come out of the install process wide open with a whole raft of dangerous services turned on. Not to mention they are starting from the security posture of Windows 3.1

What century do you live in? Since Windows Server 2008 (!) only the minimal set of services are turned on, and *no* network facing services until you configure them.

Re:must me false

[Anonymous Coward]

GP is probably referring to network services.

By default, a new Windows 7 install has listening ports on UDP and TCP. I believe you can stop this by disabling "File and Printer Sharing for Microsoft Networks" - or by installing a firewall.

In Debian, there are no listening network services unless you intentionally install them.

Re:must me false

[bobbied]

What century do you live in? Since Windows Server 2008 (!) only the minimal set of services are turned on, and *no* network facing services until you configure them.

Let me see, last time I loaded Windows 8 pro, there was a raft of services turned on for me by default. Windows "Server" variants may be a bit more locked down, but they too come with open security holes I'm sure.

Linux on the other hand, has nothing by default. Yes the distribution may turn on some services, but most come pretty much bare bones, and have for decades. Linux distributions targeted at "servers" generally come w/o any services even installed by default. If you go to "desktop" installs, where Windows 8 Pro lives, Linux comes out of the normal distribution much more locked down and secure. I still cannot believe that the DEFAULT behavior of a Windows box is to have the main user be an Administrator. Linux is not like this, and most desktop distributions today don't allow you to login as root.

So do you get the difference yet?

Re:must me false

[Anonymous Coward]

It's not secure out of the box because the setup installations don't offer a way to create a standard and administrative account. MS should of had a small tutorial during the installation explaining the difference between user accounts to teach average joe how to keep their systems secure, but, as usual MS does inform their customers about these features and it's the reason why customers were so damn confused about windows 8 when it first came out.

Windows is great to use and can be made very damn secure but MS are complete fucking assholes when it comes to giving people options or informing them on important features because all corporations have a track record of fucking their customers up.

Re:must me false

[Anonymous Coward]

Except that WebClient is only used while operating Internet Explorer so it actually doesn't create any remote exploits. Of course since Internet Explorer is installed by default and cannot be removed completely you're left with a pretty big security vulnerability should anyone use it as a workstation, except this is a server so you shouldn't be using a browser on it in the first place.

You left off Windows Remote Management Interface which is a nasty one. Remote Desktop Services regardless of service status is closed by the firewall by default. The act of enabling it merely opens the firewall.

Windows isn't nearly as bad as it used to be. It has its attack vectors just like any other system, at least they try to use encrypted communication protocals as opposed to OS X that prefer plaintext by default. Linux and Windows both try to use encrypted protocols for cifs by default so they appear to have met in the middle there.

Re:must me false

[Anonymous Coward]

SUID is not inherently insecure.

There are only a few utilities that actually need it - passwd, su, sudo, mount/umount (if allowing user mounts), at, chrontab, newgrp...

Distributions in their effort to make things easier tend to add unneccessary ones with desktops: fusermount, umount, chsh, chfn, things like dbus helper stuff...

Allowing USERS to create suid files is insecure.

Re:must me false

[benjymouse]

Let me see, last time I loaded Windows 8 pro, there was a raft of services turned on for me by default.

Windows 8, Windows 7 and even Windows Vista comes up and asks you if you *want* to turn on services. If you answer no, it will not have any network ports listening. Get it yet? That's the *desktop user* targeted operating systems.

Windows Server comes by default with NO network services turned on by default, and NO listening ports. Get it yet?

Linux *desktop user* targeted distros do turn on network services. Get it yet?

Yes the distribution may turn on some services

Yes, indeed. Get it yet?

Linux distributions targeted at "servers" generally come w/o any services even installed by default.

Yes. Just like the Windows Server versions. Get it?

If you go to "desktop" installs, where Windows 8 Pro lives, Linux comes out of the normal distribution much more locked down and secure

Nope. Linux lacks many, many of the security features in Windows 8. In distros using apparmor it only protects some of the daemons. Windows 8 comes with Mandatory Integrity Control built-in sandboxing.

Windows 8 supports multiple (and simultaneous) network firewall profiles which are automatically selected based on where you are: On a corporate network SMB services may be available, on a public network without a trusted domain controller it selects the public (locked down) profile. Linux does not.

I still cannot believe that the DEFAULT behavior of a Windows box is to have the main user be an Administrator

Good you do not believe it, because it is false. This is one of the hardest things for Linux fanatics to understand: Windows has tokens and with UAC even if you do log in with an account with administrative rights, the token will not have administrative rights. This means that the processes started by the shell will not have administrative rights. Get it yet?

Linux is not like this, and most desktop distributions today don't allow you to login as root.

No, but they do allow you to elevate to root as effective user - using sudo or other SUID utilities, which is a blatant violating of one of the most fundamental security principles: Least privilege.

In Linux you elevate to the highest, unrestricted and all-powerfull user just to change your own password??? Have you any idea how f* up that is?

Get it yet?

Re:must me false

[Anonymous Coward]

meant to say MS does "NOT" inform their customers.

Re:must me false

[bobbied]

No, you don't yet but arguing with you doesn't pay the bills... Have a nice day..

Re:must me false

[avgjoe62]

And yes, if you don't know what you are doing bad things happen.

Reminds me of my wedding night...

Re:must me false

[Anonymous Coward]

How is sudo less secure than UAC? The former asks for a password while the later asks for "Ok" to be clicked...

Also, jumping from restricted admin to full admin isn't all that difficult in Windows. For a user, it is odd, but for a program... its straight forward elevation of privileges.

Finally, the ecosystem in Windows is still geared toward running as Admin. Many apps still need this level of access to function properly.

Re:must me false

[Blakey Rat]

Windows 8 isn't a server. You're comparing apples to oranges, and being intellectually dishonest, and you know it.

The truth is: you haven't used Windows Server 2008, you haven't used Windows Server 2012, and you (obviously from your grandparent post) have absolutely NO idea what you are talking about when it comes to Windows Server security.

And instead of just admitting as much and bowing-out gracefully, you pull the "hahaha you are wrong but it's a waste of time to argue with you!" card. Disgusting.

Re:must me false

[Anonymous Coward]

Out of the box Ubuntu comes with a ton of services turned on by default, it relies on the firewall to keep things cordoned off from the rest of the world. This is the exact same approach modern Windows takes.

There is also the reality that not all services in Windows even have network access, that is the column all the way on the right. Local System is only ever granted network access when it is part of a domain at which time it uses ipsec and kerberos by default.

Server variants are indeed much more locked down as well, especially if you do a core install at which point you're back to what a "minimal server" install on a typical CentOS or Ubuntu setup.

You can feel free to argue Linux is more secure, in a lot of ways I agree, in some ways I don't, Apache with Tomcat is much harder to secure properly than IIS 7.5 or better found in modern Windows Servers, CIFS on Linux vs Windows is pretty much the same defaulting to encrypted protocols, now we could talk about mySQL versus MS SQL in terms of default security that is embarrassing for the Linux community. Yes indeed it can be secured but it sure does take a bit of work. We can talk about Asterisk versus Lync, Linux wins there.

So what can you conclude from all of this? That Linux is good at some things while Windows and Microsoft are good at others? That they are both good at some things? It really doesn't have to be one or the other these days. Use the right tool for the job and you'll have a smooth fairly secure environment.

Re: must me false

[Anonymous Coward]

Out of the box, Ubuntu doesn't have any services turned on nor has a firewall configured. You talk shite.

Re:must me false

[bobbied]

I just finished loading a Windows 2008 server running IIS yesterday, but I guess that means I don't have any experience with Windows... Hate to bust your assumptions here.

If I had to rate my Windows vrs Linux experience, I am much more comfortable with Unix variants than Windows, but I have decades of install, configuration and management experience on both. I may not be a Linux Guru but I can manage Linux systems on par with most. I am not as comfortable with Windows but I've literally installed and configured hundreds of machines starting with Windows 3.1.1 all the way though the current offerings in very strict and secure environments. I still find Linux easier to keep secure and much easier to understand than all the hokey GUI interfaces that so abound in Windows and only really prevent you from seeing what's really going on.

Now on one point, you are correct. I've not had any time with Windows server 2012, which is likely to disqualify me in your eyes I guess. But I'm making more of an historical argument, more of a a how it's designed argument. Windows developers have been struggling for years to sore up security in their products, security that existed from day one in Linux. You cannot change history. Which is the argument I'm making.

Re:must me false

[Blakey Rat]

I just finished loading a Windows 2008 server running IIS yesterday,

Before you selected the web server role, how many ports did it have open?

Just as a reminder, you yourself said:

When you load windows, it's NOT secure, you have to load other stuff to make it secure.

Windows boxes? They come out of the install process wide open with a whole raft of dangerous services turned on.

If that's true, and if you have recent experience of it, you should have no trouble at all telling me what part of your initial Windows Server 2008 install was insecure. Which dangerous services were turned on? You did this just yesterday, this should be a breeze.

Look. I don't believe you. Nobody who works with Windows Server would say the OS is descended from Windows 3.1. It's not possible for that combination of expertise and ignorance to co-exist. You're lying to me about setting up a Windows Server. I'm not buying what you're selling, buddy.

Re:must me false

[Anonymous Coward]

As someone who does this for a living, you are a fucking moron.

Re:must me false

[bobbied]

Look. I don't believe you. Nobody who works with Windows Server would say the OS is descended from Windows 3.1. It's not possible for that combination of expertise and ignorance to co-exist. You're lying to me about setting up a Windows Server. I'm not buying what you're selling, buddy.

So now we have "Windows" isn't "Windows" argument? Look, Microsoft has kept the basic features of "windows" including how the user interface operates all the way though from 3.1.1. They have brought along a lot of baggage in the process. People, users, administrators expect that the next version will work much like the current one. I remember the jump to NT, what a mess. But Microsoft had no choice but to break a lot of expected behavior though the years, many times for security reasons, but they bring a lot of the baggage along and are forced into compromises in security in the effort to keep their user base. They couldn't just make the changes they needed to, or a lot of folks would have bailed to Linux, which had the security, and wasn't in need of change.

What we really have is a disagreement on the security posture of Windows vrs Linux. My opinion is that Windows is not as secure "All things being equal" and I point to it's past history. You want to say it is the same level of security... I personally don't see how that's possible. The minimum install set of CentOS literally does NOTHING, has only one user and has nearly zero risk because there is nothing it can do until you load software on it. Windows comes with multiple users created and a whole raft of services loaded and ready to start that is risky (even if it is not running by default). Seems that a default windows install is more risky to me on it's face.

But I forget... I don't know anything about windows in your world because I don't agree with you... So we are down to comparing our credentials and seeing who has the right to win the argument on experience. Such debates are as useful as arguments about the size on one's manhood being bigger than the next guy.... No, I'm not sticking around while you pull your pants down... 8|=

Re:must me false

[Anonymous Coward]

No, you don't yet but arguing with you doesn't pay the bills...

Based on your incredible lack of knowledge of servers if you're in the business of administering systems you wont be paying the bills for much longer. The reality is you only gave up when you realized your point was inarguable.

Re:must me false

[mystikkman]

So now we have "Windows" isn't "Windows" argument? Look, Microsoft has kept the basic features of "windows" including how the user interface operates all the way though from 3.1.1. They have brought along a lot of baggage in the process. People, users, administrators expect that the next version will work much like the current one. I remember the jump to NT, what a mess. But Microsoft had no choice but to break a lot of expected behavior though the years, many times for security reasons, but they bring a lot of the baggage along and are forced into compromises in security in the effort to keep their user base. They couldn't just make the changes they needed to, or a lot of folks would have bailed to Linux, which had the security, and wasn't in need of change.

Yes, "Windows XP" wasn't the next version of the "Windows ME" codebase and doesn't have it.

Similar UI != same code base
just like
React OS != Windows XP

Server OS != Desktop OS

Server use cases and audience != Desktop use cases and audience

Compare CentOS with Windows Server.

If you want a further locked down machine and featureless default install, there's Windows Server Core.

http://msdn.microsoft.com/en-u...

Compare Ubuntu(not Ubuntu Server) with Windows 8.

It's like me complaining that Linux comes with Amazon ads preinstalled and uploads search keywords to Canonical(like it does in Ubuntu) while Windows comes with a heavily restricted browser that doesn't even run JavaScript or download files without a lot of tweaking(Windows Server).

Get it?

Re:must me false

[MikeBabcock]

SUID? Which programs are running setuid by default on a Linux box? Most Linux systems also ship by default with SELinux enabled.

My only complaint on a modern Linux distro is that SSHD often allows remote root logins by default.

Re:must me false

[MikeBabcock]

Any user can change their own password without root. Just fyi.

Re:must me false

[Anonymous Coward]

So now we have "Windows" isn't "Windows" argument?

Yes, and it is perfectly valid. You don't seem to have the cognitive ability to process the simple fact that just because they share the name does not mean they are the same.

Look, Microsoft has kept the basic features of "windows" including how the user interface operates all the way though from 3.1.1.

Wrong, unless you are simply talking about basic UI functionality that is equal across virtually all operating systems. But again, your simple mind only sees one element and assumes that everything underneath must be the same too.

They have brought along a lot of baggage in the process.

For example? Oh right you deliberately are not specific because you don't know, you assume because you lack knowledge and are only able to identify superficial visual similarities.

I remember the jump to NT, what a mess. But Microsoft had no choice but to break a lot of expected behavior though the years, many times for security reasons

They employed a whole new kernel and security model with NT, drawn from experience of developers on VMS.

but they bring a lot of the baggage along

Again specifically what?

and are forced into compromises in security in the effort to keep their user base.

For example?

What we really have is a disagreement on the security posture of Windows vrs Linux. My opinion is that Windows is not as secure "All things being equal" and I point to it's past history.

Which is why you are wrong. I could just as easily say Linux fails to do portability properly due to its history of being specific to the i386 architecture, but that isn't relevant just as you pointing to the history of Windows where the code in those versions and the security model were abandoned well over a decade ago.

The minimum install set of CentOS literally does NOTHING, has only one user and has nearly zero risk because there is nothing it can do until you load software on it.

Right it's as useful for computing as a bag of rocks, so the fact that it is secure is irrelevant because you can't do anything with it.

But I forget... I don't know anything about windows in your world because I don't agree with you...

No, the reason is you can't actually back any of your points with facts. Your arguments are baseless, we know it and you know it. If they were valid arguments you would have provided specifics and facts rather than conjecture and history of long gone code and systems.

Re:must me false

[Anonymous Coward]

Yeah, I get it: http://cvedetails.com/top-50-vendor-cvssscore-distribution.php

Damn, I think it just grew 3 inches.

Re:must me false

[_merlin]

No they can't. They invoke a SUID binary that always runs as root to do the password change. That means an exploit in the SUID password change tool could potentially do anything the root user has permission to do.

Re:must me false

[Anonymous Coward]

Nope. Parent is a liar. Linux comes with a crapload of security beyond mere authentication. There is User/Group/Other permissions (at a user level), but you can also have ACLs (Access Control Lists), because former windows people wanted it. Then there is the execute privelige bits that Linux uses (and windows doesn't) that only allows programs to run in restricted memory areas so that you can't easily blow the stack and arbitrarily execute compromised code. Security Enhanced Linux was developed by the NSA (and is available), allowing for compartemental security. Any idiot saying "linux only has..." when talking about security is an idiot. Next there is the IPtables and its follow on that allow stateful packet inspection/restriction of the entire network interface. There is more. Pluggable Authentication Modules allow/restrict applications at a kernel level for both the user and applications. Oh, and as the parent managed to figure out, there is also group/user/all security permissions on a file by file basis.

Re:must me false

[Anonymous Coward]

yeah but ssh is not turned on by default and you have to read and preferably understand the (well commented and documented) config before you enable it so there is no threat that the config should somehow "sneak by" the user. the way you make it sound it's just setup and running like that. it's not setup and it's the admin's responsibility, that's the point. With great power comes great responsibilty. If you don't want to learn and be responsible, then by all means, stick with the slaveware!

Re:must me false

[sweepdev]

How about 'Remote Registry'? Until about Windows 7, it was enabled by default... Now it looks like it's set as manual startup.

Re:must me false

[mystikkman]

Windows 7 is not Windows Server

Re:must me false

[Anonymous Coward]

This used to be true, it's by far no longer the case.

It's the ancient battle of usability vs. security. The most secure system is by design also the least usable one. And that's where the two systems came from. Windows was once "usability trumps security, no matter what". Linux was the exact opposite. Hence the reputation of Linux that you need to have a masters in CS to boot the damn thing, and for a network connection nothing less than a doctorate will do.

Various distributions now made it all a bit easier while at the same time Windows tightened security quite a bit (I mean, look back at Win95 and tell me they didn't...). The are approaching each other... if they haven't met already in the middle between the two extremes.

And so comes systemd..

Re:must me false

[bobbied]

You do understand that it takes ROOT to set the SUID bit on a file right? This is why you will find all SUID programs set to read only and owned by an administrative user (such as root). It is why you instruct your sysadmin staff to NEVER SUID anything w/o good reason and permission and It is also why you scan systems for SUID binaries and scripts regularly so you can find and remove such nonsense as SUID security holes.

Further, you NEVER let anybody change "passwd" and if they do, you NEVER let it run SUID. And if you find any unexplained SUID stuff on your box, you pull the plug on everything and start looking for where the break in happened because you've been compromised and your whole network is suspect. But you'd do the same thing in the windows world if someone managed to get your administrator's password, because it's the same thing.

Re:must me false

[benjymouse]

You do understand that it takes ROOT to set the SUID bit on a file right?

You do understand what the SUID bit does when the file is owned by ROOT, right? When you run such a file, you elevate to root just to change the password. That is *vastly* more power than you need, and it is a serious danger: Just a simple bug like a buffer overflow can cause total system compromise when it allows the attacker to execute as root.

This is why you will find all SUID programs set to read only and owned by an administrative user (such as root). It is why you instruct your sysadmin staff to NEVER SUID anything w/o good reason and permission and It is also why you scan systems for SUID binaries and scripts regularly so you can find and remove such nonsense as SUID security holes.

Yes, it is because the interent danger in SUID root utilities. Now imagine a security model that does not need anything like SUID.

And if you find any unexplained SUID stuff on your box, you pull the plug on everything and start looking for where the break in happened because you've been compromised and your whole network is suspect.

Yes, but how do you audit the "explained" SUID stuff? How do a security auditor really know what a user can do, which resources (files, etc) a specific user can access, when he is allowed execute access to SUID utilities like sudo, passwd and the likes? He may think he knows what the utility does by it's name, but how does he know *what else* it can do?

What do you think of a security model where you will have to compile all utilities from audited sources, with audited compilers to make sure that users cannot access resources they are not supposed to.

See, that's the difference between a security model that protects resources and one that tries to restrict access to utilities that can manipulate every resource on the system: You cannot effectively audit such a system.

So?

[Anonymous Coward]

Who says that I mind if my computer gets used to attack the RIAA?

Hahahahahahaha

[Anonymous Coward]

After all these years of neckbeard fanbois telling me they don't get viruses, here's proof that linux too is vulnerable! Finally I can link to this article whenever I hear this bogus claim hahahaha. Because we all know in reality linux doesn't have many viruses because only less than 1% market share!

Re:Hahahahahahaha

[SQLGuru]

Not a Linux apologist (Windows pays my bills), but in defense of Linux, these were programs running on Linux that had exploits. Of course, many of the exploits in Windows are through programs running on Windows and not the OS itself.......but Linux fanboys wouldn't be as quick to point that out.

Re:Hahahahahahaha

[armanox]

If you notice, this doesn't effect desktop Linux users. Only servers.

Re:Hahahahahahaha

[Anon-Admin]

It was not a virus, it was an exploit of server software that was unpatched.

Re:Hahahahahahaha

[rogoshen1]

insert joke about there being no linux desktops, and the eventual "year of linux on the desktop" ?

Re:Hahahahahahaha

[future assassin]

Wasn't Internet Explorer so tied into early windows versions that it was considered part of the OS itself since mare mortals couldn't just uninstall it till a few years ago?

Re:Hahahahahahaha

[Ravaldy]

Are you still bitter about that because I'm pretty sure most people got over that pretty quickly.

Re:Hahahahahahaha

[Ravaldy]

LOL!!!

Re:Hahahahahahaha

[future assassin]

Don't get so rattled when people point out the obvious. As for bitter, sorry haven't been bitter since 2005 when windows Vista was replaced with Linux Mint and OpenSuse.

Re:Hahahahahahaha

[war4peace]

What, none of all 5 of them?

Now seriously, if you want to develop malware, you'd first think of "how many potential victims would I have?".
Also... a Linux box is a Linux box. The difference between "server" and "desktop" lies in which software it runs, period. One could become the other just by installing something or enabling something.

Question for you: if I have a Linux server and install KDE on it, or X - would you name it a "Desktop"? Or is it still a server? Or both? I'm confused.

Re:Hahahahahahaha

[future assassin]

But Netcraft confirms 47% market share http://news.netcraft.com/archi...

Re:Hahahahahahaha

[future assassin]

What, none of all 5 of them?

Now seriously, if you want to develop malware, you'd first think of "how many potential victims would I have?".
Also... a Linux box is a Linux box. The difference between "server" and "desktop" lies in which software it runs, period. One could become the other just by installing something or enabling something.

Question for you: if I have a Linux server and install KDE on it, or X - would you name it a "Desktop"? Or is it still a server? Or both? I'm confused.

You poor guy you. Please refer to those using Windows Server with GUI option for an opinion on that.

Re:Hahahahahahaha

[Anonymous Coward]

After all these years of neckbeard fanbois telling me they don't get viruses, here's proof that linux too is vulnerable! Finally I can link to this article whenever I hear this bogus claim hahahaha. Because we all know in reality linux doesn't have many viruses because only less than 1% market share!

You should at least read and understand what you link.
1st it is no virus.
2nd the vulnerable software isn't the system.
3rd the software with its exploits can be run without modifications under windows.

The payload needs to be different as windows has no iptables. That doesn't mean the same vector isn't used to deploy other stuff on windows.

Re:Hahahahahahaha

[future assassin]

Nice getting modded down by windows guy to hide the truth. I feel special. This feels better than getting moded +5.

Re:Hahahahahahaha

[Ravaldy]

Ahh, so you are bitter.

Re:Hahahahahahaha

[jbengt]

well, Netscape didn't get over it quickly.

Re:Hahahahahahaha

[Anonymous Coward]

Still can't uninstall it...

Remember, a simple font spec used by IE bricked systems just last month.

Re:Hahahahahahaha

[Ravaldy]

True. But we are over them now.

I remember how unstable that software was. I remember cursing at their software daily.

Re:Hahahahahahaha

[benjymouse]

Wasn't Internet Explorer so tied into early windows versions that it was considered part of the OS itself since mare mortals couldn't just uninstall it till a few years ago?

No.

The OS and Internet Explorer shared (and I believe still does) rendering components. Which means that some of the control panel views especially in XP was rendered using the Trident rendering engine - not IE. IE *also* used the Trident rendering engine.

There is also a difference between the kernel and the core OS. Components can belong to what is considered the core OS (with the GUI rendering parts) without being executed in kernel space.

But it makes great FUD.

Re:Hahahahahahaha

[benjymouse]

If you notice, this doesn't effect desktop Linux users. Only servers.

Great. Nothing to worry about then. And here I was concerned that somebody would build a botnet of powerful, high-bandwidth computers. Silly me.

Re:Hahahahahahaha

[benjymouse]

It was not a virus, it was an exploit of server software that was unpatched.

And the privilege escalation?

Re:Hahahahahahaha

[armanox]

If you read the summary, it clearly says the vector of attack was web servers (such as Apache Tomcat). Most desktops are not running a web server - thus not vulnerable.

Re:Hahahahahahaha

[Anonymous Coward]

You may be surprised to see how many Java applications embed a tomcat server in them for some of their components, thus potentially running many unsupervised web servers on desktops.

Re:Hahahahahahaha

[exomondo]

Wasn't Internet Explorer so tied into early windows versions that it was considered part of the OS itself since mare mortals couldn't just uninstall it till a few years ago?

No, they shared components. The operating system provided the rendering engine and many first and third party applications took advantage of that (including Internet Explorer) so - while you could remove IE (you could even just delete the executable) or use any other browser - removing it in its entirety including the shared components would break a lot of other applications.

Re:Hahahahahahaha

[Anonymous Coward]

Care to compare that with a real UNIX OS? Linux based OSes are for hobbyists, enthusiasts, corporations shouldn't ever have touched it.

They shouldn't be running Windows Servers either, but that's besides the point.

Give me Solaris over Windows / Linux / AIX / HPUX any day of the week.

Re:Hahahahahahaha

[Anonymous Coward]

Bitter for Ballmer and Nadya.

Re:Hahahahahahaha

[danomac]

Question for you: if I have a Linux server and install KDE on it, or X - would you name it a "Desktop"? Or is it still a server? Or both? I'm confused.

How about a sertop? Or deskver?

Strange...

[Anonymous Coward]

How is Ballmer responsible for this?

Re:Strange...

[Anonymous Coward]

Obviously, M$ engages in child sacrifice. Pray to the Holy Stallman for redemption.

To remove this...

[VGPowerlord]

So, to remove this do I just have to do this?
sudo rm -r /sbin/iptables

Re:To remove this...

[qbast]

Sure, or even simpler:
sudo rm -r /

It has advantage of removing all viruses.

Re:To remove this...

[spire3661]

Dont be that guy.

Re:To remove this...

[SmSlDoo]

There is actually a space before sbin, best to use the -f flag to be sure you really get rid of it.

Re:To remove this...

[Anonymous Coward]

hmm...
# sudo
results in command not found. Must be doing something wrong as a Linux admin...

Re:To remove this...

[Anonymous Coward]

Yep. Just replace it with pf, and you'll be golden.

Re:To remove this...

[bill_mcgonigle]

sudo rm -r /
It has advantage of removing all viruses.

Just the ones alphabetically before /lib*/libc+

Watch out - those crazy virus writers will start statically linking!

Re:To remove this...

[NotSanguine]

Sure, or even simpler: sudo rm -r / It has advantage of removing all viruses.

Actually, you really should use the 'f' parameter as well, or else the viruses might ask you if you really want to delete it. As in 'rm -rf /'

Oh, and you're welcome!

Re:To remove this...

[VGPowerlord]

Last time I tried that it gave me some error. Something about needing --no-preserve-root

Re:To remove this...

[Sun]

You really should look up how Unix does its stuff. In particular, how the page cache works, and how inode ref-counting work.

The short answer is that you are wrong. Everything is erased.

Of course, this is, strictly speaking, false also. Some things are on read only file systems, or on pseudo file systems that do not allow erasing (such as /proc). Those, as well as the path leading there, will not be erased. Everything else, however, is gone by the time "rm" finishes.

Shachar

"Unmaintained web servers"

[Anonymous Coward]

How do these exist?

Re:"Unmaintained web servers"

[Anonymous Coward]

They were set up by windows admins are the demands of there boss. Take the defaults and stick it online. Job done!

Advisory location ...

[CaptainDork]

Is this it?

what?

[Anonymous Coward]

> may use infected Linux systems to launch DDoS attacks against the entertainment industry...

WHERE IS THE DOWNLOAD LINK?

Re:what?

[Barsteward]

yep, i'm sure most people would do it as a matter of principle especially to the RIAA etc

Re:what?

[NotSanguine]

> may use infected Linux systems to launch DDoS attacks against the entertainment industry...

WHERE IS THE DOWNLOAD LINK?

It's behind a registration form so that the fine folks at Prolexic can get your PII for marketing purposes. One of the *many* benefits is that once you register, nice folks from Prolexic will send you emails and maybe even call you on the phone to let you know about all the wonderful products and services you can buy from them.

So many vendors just report this kind of stuff to CERT so it gets assigned a stupid CVE number and all the details are then available without the consumer of information giving up any PII that can be used to sell them stuff. Stupid vendors!

Prolexic is using a real vulnerability to enhance their contacts DB and increase the surface area of their sales efforts. Disgusting.

Re:what?

[Anonymous Coward]

Prolexic is using a real vulnerability to enhance their contacts DB and increase the surface area of their sales efforts. Disgusting.

This is why the Internet invented things like 10 Minute Mail

Re:what?

[NotSanguine]

Prolexic is using a real vulnerability to enhance their contacts DB and increase the surface area of their sales efforts. Disgusting.

This is why the Internet invented things like 10 Minute Mail

Thanks for sharing the link. It's much appreciated. But that doesn't change the fact that the fine folks at Prolexic are acting like douchebags. Which was my point.

iptables malware

[myoparo]

Oh yes, I am familiar with this iptables malware. I once had a machine running using ipchains, but iptables somehow made its way on to my machine and pretty much just killed ipchains functionality. I could not get it working again no matter how hard I tried. In case it modified my kernel, I even downloaded the latest from kernel.org (2.4.x) and compiled a new one, but to no avail.

I gave up and went to Windows.

Well, duh.

[Anonymous Coward]

Attackers have used the Linux vulnerabilities on unmaintained servers to gain access, escalate privileges to allow remote control of the machine, and then drop malicious code into the system and run it. As a result, a system could then be controlled remotely as part of a DDoS botnet.

"Other verticals"?

[Anonymous Coward]

What the hell is a vertical?

Re:"Other verticals"?

[TechyImmigrant]

What the hell is a vertical?

It's perpendicular to horizontals.

Re:"Other verticals"?

[just_another_sean]

Companies within the same industry. As in Telecom, Healthcare, Financial Services, etc. In this case Entertainment is the vertical so I imagine targets are record companies, production companies, studios, maybe the **AA's.

Re:"Other verticals"?

[Anonymous Coward]

What the hell is a vertical?

It's perpendicular to horizontals.

The OP clearly knows what vertical is, and is asking about the "other verticals".

The other verticals are parallel to the original vertical.

HTH

Re:"Other verticals"?

[war4peace]

A vertical is your daily dick at 20 when you wake up.
A horizontal is your weekly dick at 50 (if you're lucky) when you wake up.
A reversed vertical is your dick at 70 (if you're lucky enough to be alive) at all times.

Re:"Other verticals"?

[DickBreath]

Did you mean weakly instead of weekly?

Re:"Other verticals"?

[TechyImmigrant]

Phew! At least they're not congruent.

Re:"Other verticals"?

[Anonymous Coward]

I for one wake up before standing up.

CVEs?

[Rob Riggs]

CVEs or it doesn't exist.

Any /. article that talks about security vulnerabilities or exploits and does not reference the relevant CVEs in the summary is a worthless piece of shit.

Re:CVEs?

[Anonymous Coward]

SOMEONE IS WRONG ON THE INTERNET, I MUST CORRRRRRRECC...
Point if this is the botnet side and the indicators of compromise.

The question I hear more often at $DAYJOB whenever one of these pops up is: "Are we affected?", which more often than not can be answered with some introspection (you know your patching practices), rather than looking at the current patch level. This applies to 90% of the companies.

Why do you care about the CVEs? Just fucking patch it. Unsure if that fixes it? Patch it again. HD leds are blinking in a funny way that makes you think you're affected? PATCH IT HARDER.

Re:CVEs?

[NotSanguine]

SOMEONE IS WRONG ON THE INTERNET, I MUST CORRRRRRRECC... Point if this is the botnet side and the indicators of compromise.

The question I hear more often at $DAYJOB whenever one of these pops up is: "Are we affected?", which more often than not can be answered with some introspection (you know your patching practices), rather than looking at the current patch level. This applies to 90% of the companies.

Why do you care about the CVEs? Just fucking patch it. Unsure if that fixes it? Patch it again. HD leds are blinking in a funny way that makes you think you're affected? PATCH IT HARDER.

Absolutely. Because there's never an issue that can't be fixed by patching. No one ever has an insecure/incorrect configuration. Please send me your resume so I can file it with the other "never hire this moron" resumes. Thanks.

misread: this is not an iptables vulnerability !

[Anonymous Coward]

This infection seems to come through apache tomcat (java servlet/JSP) and/or apache Struts/Elasticsearch (java MVC framework/ java search lib).

It has a proper name according to This guy.

This threat is known as the infection of .IptabLex and .IptabLes ELF #DDoS backdoor trojan (malware).

JAVA

[HornyBastard]

From TFA.
"Attackers have exploited Linux servers that run unpatched versions of Apache Struts and Tomcat with vulnerabilities"

Apache Struts, Tomcat, and elasticsearch (mentioned in the summary) are all written in java.
To me, that indicates a JAVA vulnerability, not a Linux vulnerability.

Re:JAVA

[Vellmont]

To me, that indicates a JAVA vulnerability, not a Linux vulnerability.

Right. Just like Nigerian 419 scams are conducted in English, so English is a vulnerability.

Re:JAVA

[Anonymous Coward]

While your statement is true, it won't fly because of all the people here calling Flash, Adobe Reader, and Java vulnerabilities problems with Windows. Let's agree that until those aren't called "Windows vulnerabilities" on slashdot, that we will call these Linux vulnerabilities.

Re:JAVA

[Anonymous Coward]

To me, that indicates a JAVA vulnerability, not a Linux vulnerability.

Right. Just like Nigerian 419 scams are conducted in English, so English is a vulnerability.

That's like calling jscript javascript.

Re:JAVA

[bill_mcgonigle]

> To me, that indicates a JAVA vulnerability, not a Linux vulnerability.

Right. Just like Nigerian 419 scams are conducted in English, so English is a vulnerability.

Interesting parallel - both 419 and this vulnerability stem from people who fail to utilize the absolute minimum of self-protection mechanisms.

And the attackers in both cases deliberately exploit these low-hanging fruits of incompetence. It's a good economic strategy - why pick the high fruit when you don't have to?

Of course, our worries stem from the fact that at some point all the low hanging fruit (or slow antelope if you'd rather) are gone.

Re:JAVA

[Anonymous Coward]

> Right. Just like Nigerian 419 scams are conducted in English, so English is a vulnerability.

Not Java the language. Java the culture it is. What I call the "Java disease", which can be seen, of course in other places too, but is really endemic in the Java world: throwing together more and more components, themselves ever more complex, without really understanding what's in there.

Re:JAVA

[mystikkman]

The applications you mention are all Open Source, which people on here keep insisting are secure.

Re:JAVA

[robmv]

Should a Linux kernel privilege scalation bugs be called a C vulnerability? no, those are bugs on code that use a particular language. If you say that the bug was found on the embeeed XML parser or any other library that is part of the Java Runtime, I would say yes, but this time no

Re:JAVA

[smartr]

Nope... A vulnerability in a library is not a vulnerability in the underlying programming language. Just because the JRE *is* an execution environment, does not mean that the execution environment being run by a malicious user is a vulnerability in the JRE. That's like saying, there's a vulnerability in C, because Flash is written in C and there's a Flash vulnerability. The point is there is a **critical** vulnerability in older versions of the Struts library, which is used to escalate privileges to the JRE. Once you have rights to the JRE, you can copy files and have the JRE execute system commands using the rights given to it by the OS which should not be a root user(honestly, if they wrote the payload in Java this step would not be needed, a server environment is entirely capable of performing DDoS attacks). Also, I'm calling BS on this exploiting a known Tomcat vulnerability. There are no known "critical" vulnerabilities in any version of Tomcat :
http://tomcat.apache.org/secur...
http://tomcat.apache.org/secur...
http://tomcat.apache.org/secur... ...
Basically, people need to patch Struts 2 because of this fucker:
http://struts.apache.org/relea...
which was fixed in July 2013:
http://struts.apache.org/downl...

Re:JAVA

[Anonymous Coward]

I present... Atmosphere:
https://github.com/Atmosphere/...

Check that commit log. This is the most popular library for async/push notifications for Java web applications. It's got tonnes of issues - but the commit log is somewhat telling.

Re:JAVA

[Anonymous Coward]

It targets older versions of Struts - the vulnerabilities are patched in anything post 2013. The tomcat thing seems like crap to me. Can't comment on ElasticSearch, but why is that thing open to the internet anyway?

Re:JAVA

[c0d3g33k]

The applications you mention are all Open Source, which people on here keep insisting are secure.

Nope. This is a varied community, so people here believe lots of things, but probably not as many believe this simplistic view as you think.

FLOSS applications have the *potential* to be more secure than proprietary/closed source. They also have the potential to become more secure over time if the community/contributors have more resources available to fix security problems than a proprietary vendor. Most importantly, FLOSS applications can be scanned by anyone for bugs and security problems, and fixed by anyone. Those activities are limited for proprietary code to those who have access to it and allowed (by privilege or managerial decree) to fix it or even publicise that there's a problem in the first place.

Depending on the situation (skillset of the development team, size of the team, interest in maintaining and fixing the code), this can either lead to a particular piece of FLOSS or proprietary code being more secure. *In general*, it seems that FLOSS code tends to be more secure because greater resources can be brought to bear, particularly over time as proprietary vendors stop supporting code for older products and move their teams on to something new (gotta keep paying the bills). In some cases that doesn't hold true and proprietary code is more secure.

Re:JAVA

[HiThere]

More to the point, they use particular packages written in that language.

A Linux kernel privlege escalation bug is a Linux bug. It's only a C bug if it depends on a violation the the C language standard. C misfeatures aren't bugs, but they sure make be cautious when I use it. In particular, one C misfeature is that it's impossible to check the length of an array at run time. In any lengthy piece of code I get quite paranoid about that. But if I make a mistake it's a bug in my code. In C it's only a misfeature.

Similar these things appear to be, e.g., a bug in Struts. (I'm not a user of same, it's conceivably only a misfeature in Struts, and a bug in some program that uses it.)

So I agree, it doesn't appear to be a bug in Java. Or in Linux. But one could argue that there are design errors.

Re:JAVA

[IamTheRealMike]

Do you know what the vulns are? Tomcat has a list of vulnerabilities on their website but they're all DoS attacks or information disclosure. It's pretty hard to write a Java app that can actually be completely taken over via the network, although I've seen one or two spectacularly dumb web server designs that allowed it anyway (e.g. url parameter names were treated as arbitrary paths through the entire apps object heirarchy using reflection, letting anyone modify any global variable by just doing a GET - no language can save you from this kind of idiocy).

Re:JAVA

[Anonymous Coward]

Figures that some asshole like you would show up and try to skew the argument based either a horrendous lack of knowledge or a scumbag fucking FUD machine.

Re:JAVA

[styrotech]

Apache Struts, Tomcat, and elasticsearch (mentioned in the summary) are all written in java.
To me, that indicates a JAVA vulnerability, not a Linux vulnerability.

Or more likely a bug in an Apache Commons library they all use.

eg Struts is from Apache, Tomcat is from Apache, Elasticsearch is based on Lucene which is also from Apache.

Re:JAVA

[Anonymous Coward]

Based on your logic these are Apache bugs, affecting Struts, Tomcat and Elasticsearch, all of which happen to be written in Java and run on linux, Windows, OSX, you-name-it. The uploaded payloads just happen to be linux executables that get run from the /boot directory, but they could just as easily be Windows or OSX executables.

Re:JAVA

[MikeBabcock]

The problem is that you can never assure yourself that closed source software is secure. You can trust or insure but you can't assure.

Assurance requires access to the source code.

Re:JAVA

[exomondo]

Assurance requires access to the source code.

It requires a lot more than that! You have access to the source code so can you (or anybody for that matter) assure me that Linux is secure? Or Harmony? Or Apache Web Server? Or anything at all?

Re:JAVA

[ignavus]

Apache Struts, Tomcat, and elasticsearch (mentioned in the summary) are all written in java.

To me, that indicates a JAVA vulnerability, not a Linux vulnerability.

"Write once, exploit everywhere."

Re:JAVA

[Anonymous Coward]

Nobody ever said floss wouldn't need patching or fixing. Nobody with enough brain for due diligence, anyway.

Re:JAVA

[Anonymous Coward]

>The problem is that you can never assure yourself that closed source software is secure.

The problem is that you can never assure yourself that software is secure.

Fixed that for you, noob.

Never, ever assume your sw is secure; keep checking, watch for user idiocy, and keep patching.

Re:JAVA

[Anonymous Coward]

I had a linux machine hacked and the only public service was ssh

They use any remote vulnerability they can

Java strikes again...

[Anonymous Coward]

Once again, every component compromised was a piece of Java software. When will people learn that running a JVM is the most insecure thing you can do on any system?

SPOILER ALERT

[Anonymous Coward]

That is the summary and contains the link to the full advisory.

Spoiler Alert:

Bash commands

Two bash commands from PLXsert are designed to clean a system infected with the ELF IptabLes binary. After running these commands, system administrators are advised to reboot the system and run a thorough system inspection.

sudo find / -type f -name '.*ptabLe*' -exec rm -f {} ';'
ps -axu | awk '/\.IptabLe/ {print $2}' | sudo xargs kill -9

If your running systemd, your protected.

[Anonymous Coward]

Don't worry. If your running systemd you should be protected because the hackers probably can figure out how to create their own systemd script or where to place there hooks in the systemd chain.

[Unit]
Description=Graphical Interface
Documentation=man:systemd.special(7)
Requires=multi-user.target
After=multi-user.target
Conflicts=rescue.target
Wants=display-manager.service
AllowIsolate=yes

Does it come before multi-user.target, After multi-user.target, What does it want? Display-manager.service? Certainly the can document it, and we know that it will require a multi-user.target of some sort. systemd is a far worst virus that this thing iptabLex thing will ever be. However, if that virus infects something in systemd, good luck finding it in that redirect maze.

Can someone show me how to respawn a getty using systemd? That seems like that would be important to know.

Think of the Childr...Hollywoods

[Krazy Kanuck]

"... may use infected Linux systems to launch DDoS attacks against the entertainment industry... " Seriously? That's our worry? or whom you are trying to scare?

Re:Think of the Childr...Hollywoods

[war4peace]

Are porn sites part of "entertainment industry"? If so, this is a serious threat and it needs dealt with ASAP.

Re:Think of the Childr...Hollywoods

[Anonymous Coward]

4chan is part of the entertainment industry. I wouldn't want it to be DDoSd either.

IE was part of the OS. M$ said so.

[Kludge]

Not only was it virtually impossible to get rid of, MS in several cases argued that it was an integral part of the OS and therefore it could not be removed and replaced with any other browser.

What Every Server Needs

[Anonymous Coward]

Every server needs a dead operator's switch.

not compromised server, honeypot

[dltaylor]

If the administrator deliberately activates software known to make a system (Linux, Windows, ...) vulnerable to compromise, that is NOT a compromised server, it is a honeypot. If you make a honeypot, you must mitigate any damage it may cause outside your domain.

Sue the admins of those systems into getting a job compatible with their IT skills (probably involving a toilet brush).

My Gentoo never got hacked!

[SimonXXX]

It's still compiling...

Easier to lockdown? Bullshit!

[Anonymous Coward]

Simpler to lockdown desktops since you don't leave services/daemons running as "listeners" that *may* have security issues (like webservers for example, or database engines).

WTF? More Bullshit?? Ok

[Anonymous Coward]

Is SeLinux turned on & 'to the max' by default in all Linux distros? No. Why's SeLinux even THERE in the 1st place then too?? Answer = Linux is *NOT* fully security-hardened from the get-go, despite your b.s. to that effect...

* How the HELL you got a +5 for your b.s. utterly astounds...

(Especially the CRAP about Win3.x being anything *remotely* like Windows NT-based OS' from MS onwards - not even REMOTELY the same other than the interface/shell in Windows NT 3.x/3.5x & Win3.x... lol!)

APK

P.S.=> Lastly: *ANY* modern OS out there can be security-hardened, MORE - & yes - that includes Linux, hence my points on SeLinux above (as well as Windows - I know, I wrote the very FIRST online guides for doing it back in 1997 @ NTCompatible.com, which grew into these from circa 2006-2008 (got me PAID @ 1 spot online even, pretty cool) -> http://www.bing.com/search?q=%... )

... apk

Dude, no.

[luis_a_espinal]

From TFA. "Attackers have exploited Linux servers that run unpatched versions of Apache Struts and Tomcat with vulnerabilities" Apache Struts, Tomcat, and elasticsearch (mentioned in the summary) are all written in java. To me, that indicates a JAVA vulnerability, not a Linux vulnerability.

Uh, no. It would be Struts/Tomcat architectural vulnerabilities. Not various versions of the Java Runtime have/had vulnerabilities, but in these particular cases, the vulnerabilities were within the software systems, not on the language they were written or the runtime that hosted them.

Wow, who would have though

[HangingChad]

Attackers have used the Linux vulnerabilities on unmaintained servers to gain access, escalate privileges to allow remote control of the machine

Holy misleading headline, Batman! Any server that's not maintained is vulnerable, how is this news other than it's a Linux server botnet? OMG unpatched servers are vulnerable to hackers!

Re:IE was part of the OS. M$ said so.

[Anonymous Coward]

If you tried to remove the browser, any program that embedded the browser control wouldn't work, and a ton of business software did just that. I know a whole lot of cadd software (in 2014) STILL embeds the browser control for fonts and text editing and a lot used it for their help systems. It was also used in a lot of places in windows because it was available. Stripping it out would require replacement with something that had the same quirks/bugs/features etc. Technically removing it was possible, practically removing it would cause major pain for businesses.

software

[Anonymous Coward]

Software and security is nuanced and layered requiring thought and analysis. Commenting here is neither and there's certainly little thought.

Registeration required?

[Anonymous Coward]

Frankly I have to ask if that is even ethical, and while I realise computer security is a tough business, I expect a whole lot better attitude and behaviour from Akamai or an Akamai owned company.

It impedes the dissemination of critical information, which is primary goal of an advisory bulletin. Anything else is marketing, to and at the expense of those affected.

I understand that Akamai / Prolexic have invested their time and expertise into discovering / creating that information, and deserve recognition and acknowledgement for that effect, but the control and restriction of an security advisory is an ethical and moral decision, not a business decision.

In fact, given that it does appear to be marketing oriented, it may well have civil liability issues in some jurisdictions for failing to make the advisory more readily available. If this DDoS attack increases costs of any Akamai customers, there may well be a conflict of interest and/or breech of trust.

I expect better from CEO / co-founder Dr. Leighton, as I respect him and Akamai whom I have always found very professional.

Perl would reduce the incidence of these problems.

[Eravnrekaree]

This underlines an important point I made previously, that part of the problem here is C/C++ and its manual memory management. Ruby, Perl and Python eliminate a whole class of programming errors by doing memory management automatically, making it easier to develop secure applications. People laugh when you say the web browser should be written in Perl, as the web server should be, but its true. The result would be a safer, and even a faster system because a Perl program would lack as many memory leaks and therefore you would end up with less memory swapping as a result. So much for how much Slashdot people know about security, or good software design, that they would then that C/C++ is a good development environment for the web browser or web server, when it obviously is a source of huge numbers of vulnerabilities. People here must be totally inept or clueless to miss that Perl has automatic memory management, reference counting and automatic allocation that you eliminate hanging pointers and out of bound access errors.

Registration? Really..?

[Anonymous Coward]

So on the one hand we have asshats wanting to exploit your system and on the other we have asshats trying to opportunistially exploit this chance to dig for information about anyone wanting to know what's going on? Yeah, they obviously took the attack seriously... Screw 'em. They're both bad actors.

Re:Perl would reduce the incidence of these proble

[HiThere]

Since the problem appears to lie in Java libraries, I don't understand your argument at all.

Consider the source

[Dadoo]

I find it interesting that Akamai is complaining about server vulnerabilities, when something like 30% of all the alarms on our IPS are set off by hosts they control.

that's what happens when you outsource!

[jerryjnormandin]

Any operating system has security holes... unix/linux has less... and you take a security risk when you outsource or just hire newbies out of school. You need to hire people who have been at it a while, pay them what they are worth.. and hire newbies for the sr. system engineers to mentor. they get what they get. and java... well.. Oracle Sucks.. we all know that. You can code around it.. just code with security in mind, close all security holes. don't run external processes as a trusted user.

Malicious?

[CanEHdian]

Malicious actors may use infected Linux systems to launch DDoS attacks against the entertainment industry and other verticals

Whatever happened to "the enemy of my enemy is my friend"?

Yes, there's technical solutions like the upcoming Tor-like anonymized version of tribler that will try to route around the Copyright Crooks-induced Internet Censorship.

You say this like it's a bad thing ...

[Anonymous Coward]

A DDOS attack against the most prolific scumbags in the entertainment industry, eh? How can I get infected? I'd be DELIGHTED to participate!

Bad Reasoning

[Anonymous Coward]

I agree with the notion that C and C++ are dangerous security risks in the hands of most developers. They normally use raw arrays and raw pointers. The U.S. military (which NSA-GCHQ is part of), Chinese intelligence and the Russkie mafia really, really like this practice. They call it the "cyber war domain". Little coincidence that Bell Labs, a U.S.G. branch at that time, develop this stuff. They apparently had nightmares of millions of C64 and Amiga computers being used as soft-SIGABAs, which would have turned them blind, sigint-/comint-wise.

BUT, Perl is no ideal fix. Rather, its lack of type safety opens up lots of new exploit opportunities. It has been designed by an Ex-NSA contractor, Larry Wall.

And, you can do memory-safe languages/untimes very nicely WITHOUT Garbage Collection: Just use reference-counted memory management. You need to break pointer cycles yourself, though.

Professor Wirth of ETH Zürich had the basics of this technology done in the 80s. It was called PASCAL and ADA. Here is a slightly improved variant of this kind of language (includes some good features of C++ such as Destructors):

http://sourceforge.net/p/sappeurcompiler/code-0/HEAD/tree/

And yeah, quite prototypical, but it demonstrates what is possible outside the World Of C Pain. If you really want to use it, drop me an email and I will assist you into getting it running on you *nix platform or cygwin. I once even had it running on Windows. Not pretty, but effective.

Frank Gerlach
frankgerlach74@web.de
Württemberg
Germany

Probably

[Anonymous Coward]

Because they have rolled lots of unnecessary stuff right into the Windows Kernel: GUI rendering, font parsing (enabling some very nice drive-by exploits for browsers once) and a whole bunch of other nasty "design" decisions. Or should we call it "anti-patterns" ?

Only Win 8 has brought software stores (10 years after Linux) and Sandboxing is still the exception, not the rule. Compare that to Linux, where you have at least 2 major infrastructures (AppArmor and SE Linux). Plus you can build your own sandboxing using the the LSM API. Do you finally have this in Windows ???

Hi Redmond $hill

[Anonymous Coward]

Your sales argument is that "every monkey can operate a computer". They might be able to turn it on, but sure as hell a monkey will configure it insecurely. You NEED a CS degree to set up a secure computer. Linux or otherwise.

And yeah, Windows still is a shithole of insecurity. You folks still cannot break it to users that they need an admin and a normal account. Instead you do this UAC crapola.

So, go back under your rock and leave the adults alone.

That is Why

[Anonymous Coward]

...they elevated Guest print jobs to Admin rights in Windows ? So that StuxNet could do its work ?

We have AppArmor on Linux - it is rather simple and straightforward. Lock all the SW crappiles into their respective sandboxes.

Even better

[Anonymous Coward]

...take the time to create an AppArmor profile for your application. Then the maximum damage is limited to what you allowed in the AppArmor profile. User-based security actually is a quite shitty concept. What is the business of Acrobat Reader in reading my VHDL and my CATIA files ?

I once did it for firefox and it was a two-day effort. Firefox can be considered a complex program relative to AppArmor.

In other Words

[Anonymous Coward]

...Akamai got a big discount (for their Windows licenses) or a check from Microsoft under the condition that they badmouth the Linux OS, when the problem was actually one of some hipster library developers. The same problem would probably exist on Windows and MacOS, if you ran Struts on these platforms.

We have seen this pattern with various assortments of PHP shite like phpMyAdmin and those PHP-web-server consoles for the shell-illiterates of the "business world". Those who are not able to do their work via ssh+shell scripts.

Don't get me started on the PHP shite in general.

Yeah, nothing new in the Corrupt Western World of 2014.

Re:Perl would reduce the incidence of these proble

[david_thornley]

Well-written modern C++ does not have manual memory management.

Old News

[Anonymous Coward]

O, I only had Samba and a python app on the 1 server, no apache, tomcat or elastic.

Wrong (again)

[benjymouse]

The progression goes like this..

1. Unix was developed on the Digital Equipment Corp PDP-11 hardware in about 1970. Unix started as a multi-user system that supported memory segment protection between user processes and kernel space.

2. VMS followed on the next generation of DEC hardware the VAX-11780, which made it's appearance in the late 1970's. This system introduced Virtual Memory spaces for user processes. (Thus it's name Virtual Memory System) VMS was not first in being muti-user, commercially that was Unix.

3. Windows NT arrived in the late 80's, and not surprisingly ran on DEC VAX hardware as well as x86 based systems, as the chief engineer of NT came out of the VMS development team at DEC.

So NT got this idea from VMS which got it from Unix....

Unix was never implemented for PDP-11 by DEC. 3rd parties adapted several versions so that they could run on the PDP-11. A number of generations of "realtime" operating systems were developed by DEC for the PDP-11 and later the VAX-11 series.

Dave Cutler was on the teams for many of these OSes. Dave Cutler left for Microsoft to design Windows NT. Dave Cutler *never* implemented an OS for PDP-11 based on Unix. In fact, he *disliked* Unix.

And no, Unix did not invent access control. I sense that you need Unix to be some type of god-like hero. It is an operating system, and an aging one at that. Cool off.