Linux Exploits Top Windows

[bjf123]

For the first time ever, the number of Linux vulnerabilities, attacks, and exploits has exceeded that of Microsoft Windows according to U.K. security research firm and integrator MI2G. Here's the full article.Geek News Story

[GolfProRM]

The article makes a very good point... it doesn't matter what OS you're running if you don't know how to set it up and make it secure... That's about the only thing worth noting in the article though... Of course reading the pathetic comments at the end is pretty funny.. This article shows that EVERY OS has vulnerabilities, but with a little know-how, they can be fixed/blocked.

[quint]

For the first time ever, the number of Linux vulnerabilities, attacks, and exploits has exceeded that of Microsoft Windows according to U.K. security research firm and integrator MI2G.  Here's the full article.Geek News Story

Oh No!

[Marsden11]

Curiously, this news will come as a surprise to some people, but according to a report from the security experts at mi2g.com, open-source poster child Linux is losing the security fight--big time--to Windows Server. Yes, you read that right: In May 2003 alone, Linux-based corporate and government systems experienced 19,208 successful breaches worldwide, whereas similarly oriented Microsoft Windows Server systems suffered only 3801 breaches. During this time period, more than 75 percent of all server-based breaches occurred on Linux systems; Windows systems were responsible for just 15 percent of breaches. Furthermore, the reports says that Windows-based systems were far more resilient than Linux-based systems during the Iraq war months from March to May 2003, a time of increased hacking activity. mi2g, which has been tracking server attacks since 1995, now oversees a database that contains more than 220,000 individual attacks and more than 7000 hacker groups. So why are Linux servers more easily compromised? The security experts quote several primary reasons: First, most Linux servers are improperly configured and don't come with decent default security configurations. Second, the open-source community doesn't have a coherent "trustworthy computing" initiative. Third, Linux is a target because of its increasing popularity in the server world. In other words, everything I've been saying about Windows, Linux, and security not only is true but is evolving in a wonderfully predictable way. Shouldn't we stop all the bogus "Windows isn't secure" baloney when a far less secure competitor is just waiting to be compromised?Source: Wininfo Daily Update 6-6-03 gathered from this article published 6-2-03 from mi2g.com located here: linkage

[zox]

Marsden11, there is already topic in Linux forum but thanks for posting anyway

[Guest ThunderRiver]

With poor configured server, any OS is vulnerable. Linux is no exception.

[Riff]

This is really no surprise. Over the last couple of years linux has made huge gains in users. Huge. So it only makes sense that it will now start being focused on for security exploits. You get popular, you get put under a microscope. You also have to consider the amount of newer linux users who may not know how to secure their systems properly. One of the biggest security problems in Windows usually resides behind the keyboard, why should linux be any different.

[SonicDragon]

The article does make some good points, but i think people need to be careful when reading articles such as that.Say, just for example, that Linux has 1 hole/worm/virus etc. In a years time they have 3. Now their number of vunerabilities have tripled! But if microsoft had 8000 and went up to 8500, they gained a lot more viruses than linux, but their percentile is lower, so it looks as though they are doing better. I have read so many articles that talk about linux stuff tripleing, but forget the above scenario. Just to point things out :)Thanks for the article!

[Bruno]

Let´s not forget that on the server market Linux is much bigger than Microsoft !Also who guaranties the objectivety of this rapport . . . . who´s bread are they eating ?There is a big propaganda war going on, see all the other stories in several threads, who knows where the real truth is ? Bruno

[Marsden11]

I didn't wish to appear anti-Penguin so I thought it would fit under Security.

[Guest ThunderRiver]

Hehe I know.. I got my Red Hat box hacked about 1 and half years ago.. I know how it goes.

[Guest LilBambi]

No worries, Marsden11 ... This is a great place for the topic as it is security related.We may end up having to merge the two though.

[Guest LilBambi]

The MI2G report further detailed that most exploits were due to improperly secured machines running default configurations, or because inexperienced administrators could not properly support the Linux operating system.

OK, let me see, they say lots of folks migrated to Linux servers from Windows servers, so those that couldn't configure a Windows server also can't configure a Linux one and tipped it the other way ????Hey, I was jesting! LOL! Truthfully,

"Denial is the most predictable of all human emotions."- The Architect, The Matrix Reloaded

Better to learn to configure whatever servers we are using. And like anything else, be responsible for what we are in control of. ;)Lots of folks did migrate, and lots of folks are just learning Linux.The tide will turn again as they experience the problems and realize they need to apply the updates regardless of the OS they are using and configure their servers for security and not just expect them to work better because they can.I think the following quote says it quite well from the Geek.com article:

Here's a news flash: Linux can be secure, but it by no means is always secure. A default installation of most of the common distributions will result in a hacked system in practically no time. Overworked or inexperienced admins don't install patches in a timely manner, if at all. They leave vulnerable services running when they're not needed. They use weak passwords or fail to change them regularly. The list goes on and on.The funny thing is, the same can be said of Windows, at least most of the time. A stock install of Win2K will result in a hacked box about 5 minutes after it's scanned. Win2K3 is much better about this; just try portscanning a default install of Win2K3 and you'll see far fewer ports open by default (and IIS is not there by default).But if you take the time to properly secure a box--and Microsoft makes this pretty easy by supplying you with a list of how to do it--a Windows install is immensely secure. Over 70% of the Fortune 500 use IIS on NT and Win2K on a daily basis, handling billions of dollars of transactions, and they rarely, if ever, get hacked. Companies that expend the same amount of effort securing a Linux box will also have practically uncrackable boxes.Despite what Linux mavens may want to think, the ultimate utility and security of a server has very little to do with what OS you're running. It has much, much more to do with whom is running the server.Finding out how to secure a Linux box can be a more trying experience than simply going to Microsoft's TechNet and downloading a checklist, but documentation has always been Linux's weakest point. Now that Linux has fully entered the mainstream it's about time that this last weakness was eliminated. Reports like MI2G's will help spur this along. Zealots raving about the Emperor's new clothes will not.I challenge each and every one of you to think objectively on this subject instead of resorting to tired and outdated dogmas.

Well, stated. All the hype about Windows vulnerabilities got many administrators doing what they should.Now we need to do the same for those administering Linux servers.It's as simple as that.

[nlinecomputers]

I didn't wish to appear anti-Penguin so I thought it would fit under Security.

I might have believed that had you not also said this.

In other words, everything I've been saying about Windows, Linux, and security not only is true but is evolving in a wonderfully predictable way. Shouldn't we stop all the bogus "Windows isn't secure" baloney when a far less secure competitor is just waiting to be compromised?

That sounds like you think Linux is more insecure then Windows. I not sure that is correct. I think they both can be made very secure but it takes work by a properly informed sysadmin. Out of the box both servers are wide open. Windows 2003 appears better but it still needs some tweaking from what I have heard. I really have not used it much yet.

[Guest LilBambi]

So we all don't have to post to two Topics on the same subject to get a full picture here .... I have moved this to Security and Networking since this is more a Security and Networking topic than a Linux specific Topic.I left a link in All Things Linux so everyone can still find it :)This is a great topic.Please remember to keep the arguments aimed at the issues, not fellow SFNL Members. Thanks.

[GolfProRM]

IMO I think this one line says everything! Does it really matter which system has been hacked more often? Just shows the users' lack of knowledge ... has very, very little to do with the OS.

Despite what Linux mavens may want to think, the ultimate utility and security of a server has very little to do with what OS you're running. It has much, much more to do with whom is running the server.

[Guest LilBambi]

It is certainly one of the most important parts. ;)BTW: Love your new avatar ... doesn't creep me out like Lecter LOL!

[GolfProRM]

Ahh Fran, but that's the best part, It still is Lecter!

[Guest LilBambi]

Ryan,Oh, yes! You're right, but he is not wearing that awful muzzel! I thought I recognized the picture when I saw it....but couldn't place it.

[zox]

Well, they might be onto something.Check this article out:"why surprisingly Linux OS became more attackable than Windows OS"Article on Zone-H.

[Guest LilBambi]

Thanks zox, very good follow up apparently by the folks who have the most complete database on such matters. Here's a quote from the bottom of the article ... very interesting (the graph they are referring to is the second graph from the last 16 months and correlated the information:

The graph shows clearly that one of the most hit OS over the time was Windows (red line). The interesting fact is that since middle-January 2003 Windows became for some unknown reasons less attacked (and less attackable) than Linux.Zone-H identified the reason of this strange phenomenon in what Zone-H calls the “Slammerworm effect”.In fact the Slammer worm ha produced since December 2002 a spike in the Windows 2000 statistics. Since then, the Slammer worm threat has been so much covered by the media that companies started to patch at a speed never seen before. The result of this process is that Windows OS has instantly become less attractive for crackers.If we also consider that the number of the worldwide Windows installations is presumably higher than the Linux installation it means that a properly weighted analysis would reveal that the Linux “hacker attractiveness” would be even clearer.The graph generated from Zone-H databases is also showing other interesting aspects: the web cracking phenomenon is transforming more and more into a social problem very much related to political issues.The September 11th anniversary and the Iraq war have been the reason why the overall number of attacks has increased 500%, hitting this year an amount of targets never seen before. If anybody before was under evaluating the web-cracking events, these graphs and numbers should be the reason of paying more attention to these facts as they are more and more configuring a sociologic problem.

It's great to see short-term analysis to give a pointer to what's needed, but nothing beats longer term analysis to help to get to the bigger picture.There's always more than meets the eye in any given story....glad you helped provide one more angle on it zox.

[zox]

At your service m'am

[henderrob]

Heck, I have trouble hacking my own system