Linux Is #1 Hacker Target

Similar to this thread posted in June: Linux: More Vulnerable Than Windows?, a recent report says that the Linux operating system(s) are successfully hacked more than any other.

mi2g has been tracking data since 1995. Their database contains information on over 280,000 attacks. Based on their data, Linux led the pack during the month of August with 67% of the successful attacks being against Linux servers.

Of course, that doesn't change the fact that the world is scrambling and jumping through hoops to patch Microsoft vulnerabilities and stop the proliferation of threats such as Sobig and MSBlast. I guess the #1 target of virus / worm authors is still Microsoft.

For more details you can see this article on globetechnology.com: Linux is favourite hacker target: Study

Rather proves the point that *nix supporters believe that their OS is more secure than Windows. If you are going for home users then, sure Windows is more vulnerable, but only because 99% of home users run Windows, and have no idea what security means.
But there are massive security loopholes in most versions of *nix as well.

If you are going for the professional/business environment, then it does not matter whether you run *nix or Windows. You are still relying on your sysadmin to keep your system protected, and apply patches as appropriate.

But isn't this a skewed report in that there are hundreds of variations of Linux and really only one Windows (so to speak in that only Microsoft makes windows)?

Quote:

---

But isn't this a skewed report in that there are hundreds of variations of Linux and really only one Windows (so to speak in that only Microsoft makes windows)?

---

Yes and no.

It might be more apples to apples to break down the Linux versions and state specifically WHICH incarnation of Linux is most vulnerable or how that rates against Microsoft.

However, wouldn't you then also need to break down Windows into its flavors? You would need to know specifically which versions of Windows- 98, Me, 2000, NT, XP, etc.- rather than lumping all of Microsoft together.

And, just like there are different Linux kernels and versions, you would further need to break it down and say that Windows 2000 Pro is vulnerable x% of the time, but Windows 2000 Pro SP2 is only vulnerable x% and Windows 2000 Pro SP4 is vulnerable even less than that or something. In other words, the service packs sort of parallel or represent the kernel updates and should be considered separately. My Windows 2000 Pro SP4 system is significantly more secure than the base Windows 2000 Pro.

Plus, in the article D.K. Matai of mi2g makes the statement that it has as much or more to do with vulnerable 3rd party applications (sendmail, pine, apache, etc) that run on Linux as it does with the actual Linux kernel or OS. So, those are fairly generic across Linux platforms.

I think that the bottom line is, was and always will be that no operating system or application is "secure by default". It comes down to the owner / administrator having the intelligence and initiative to understand the vulnerabilities and keep current with maintaining patches and securing their system / environment.

So they are including 3rd party applications with it and not Linux solely versus Windows only and not the apps? Also, 51% of the attacks going against Linux isn't as huge as it seems. To me, what is more telling is the response by readers (both Windows and Linux readers): how the stats are derived would be interesting.

Quote:

---

Originally posted here by tonybradley
I think that the bottom line is, was and always will be that no operating system or application is "secure by default". It comes down to the owner / administrator having the intelligence and initiative to understand the vulnerabilities and keep current with maintaining patches and securing their system / environment.

---

Oh. I think that goes without saying. Looking at results of other surveys seems to indicate that admins are overworked (not a new theme) and either cannot or do not keep up-to-date. So pointing the finger at the technology doesn't solve the problem that remains: no matter what OS you use, unless you are on your toes you will be broken into at some point (and even if you do remain on your toes you still might be broken into).

True- you bring up very good points. Statistics by their very nature tend to serve the purpose of the author and can be spun to make whatever statement you want to make.

I think this quote raises very good issues with these stats:

Quote:

---

Perhaps 95 per cent of all the servers that mi2g "monitors" are Linux? Or perhaps the Windows servers being reported are their customers whereas the Linux ones are reported publicly or via some other source.

---

Without knowing the details of how many total servers they monitor or what the makeup is its hard to determine the validity of their numbers.

On a similar note- its only "valid" if their sampling is significantly large enough and if their OS percentages match the overall percentage of those OS's around the globe.

Quote:

---

Statistics by their very nature tend to serve the purpose of the author and can be spun to make whatever statement you want to make.

---

I read the linked article and I am somewhat disappointed by the lack of details on how the statistics are collected. My main question is what does this group define as an attack? Many breaches in security don't end up being malicous. Someone may break-in and just snoop around, not damaging anything. Would this sort of "attack" be reported or just patched up and kept quiet.

It really all comes down to the system administrator I guess. There is no clear cut answer to which system is more secure, and personally I don't think their ever will be.

Hello,
I noticed that...

"Microsoft Windows servers belonging to governments, however, were the most attacked (51.4 per cent) followed by Linux (14.3 per cent) in August."

If Linux is being hit more than MS servers, and goverments seem to be more likey to use MS over Linux yet if my memery serves me right, MS went to a Linux server for its Hot Mail account. It's not the OS but what's on the OS. As Ms Mittens says,

"no matter what OS you use, unless you are on your toes you will be broken into at some point (and even if you do remain on your toes you still might be broken into)."

There will always be a need for security.

Freddy

if you want see chinese linux.
you can login www.linuxeden.com

A few things:

Quote:

---

You are still relying on your sysadmin to keep your system protected

---

If this is the case, you're already lost. You should be relying on good IS policy and procedures to protect your system. The system administrators are incidental.

Quote:

---

So they are including 3rd party applications with it and not Linux solely versus Windows only and not the apps?

---

Of course, Linux is just the kernel, obviously you can't remotely target a kernel. (without going through something else like a 3rd party service and everything else involved) Services like sendmail, apache, and bind are considered standard to linux and ship with nearly every version.

Quote:

---

But isn't this a skewed report in that there are hundreds of variations of Linux and really only one Windows

---

There are really only five types of Linux:
[list=1][*]Linux standard (anything that comes in a box or is not spcified below)[*]Pitbull LX (the addition of DBAC and network flags and the existance of the SA, SO, and ISSO users represent an architectual difference)[*]Trusted Linux (This HP research project uses more traditional MAC via the Bell-LaPadula model as well as the SA and SO accounts seperate this system)[*]SE-Linux (the flask architecture with its RBAC and destruction of the root user differing from the previos two systems set this research project apart)[*]Not Otherwise Specified (this includes Linuces altered to work in fundamentally differing ways. Oddly this section isn't as common as you may think and in my career I have only seen a handful of these systems.)[/list=1]

Of these, two (Pitbull LX and NOS) are quite rare, two (Trusted Linux and SE-Linux) are still just research projects. Not only that, but if you wanted you could clump Pitbull LX, Trusted Linux, and SE-Linux into one group as well (Trusted-ish operating systems). Differences besides those I've listed fall in the packaged software, installation process, default configuration criteria... none of which should be weighed when comparing security.
Windows on the other hand has two distinct flavors: Windows Single User Edition (SUE) which includes Win95, Win98, and WinMe. Additionally the NT line which includes NT4, 2000, XP, and 2003. These two lines are sharpyly different with regard to security in that the WinSUE line has no security at all. (it can't even seperate subjects and objects) Frequently these reports are skewed against Windows because the lump SUE and NT together (as do most computer people) under the justification that all Linuces/Unices are lumped together as well.

Quote:

---

MS went to a Linux server for its Hot Mail account

---

Not sure where you pulled this. Hotmail used to be a FreeBSD front end with Solaris back end, Microsoft gradually switched the front end to Win2k and is in the process of switching over the back end.

catch

Quote:

---

Originally posted here by catch

If this is the case, you're already lost. You should be relying on good IS policy and procedures to protect your system. The system administrators are incidental.

---

Ummm... Isn't that like relying on just the administrator? Shouldn't the idea of whole security be layers of security that include the technology, good IS/Security Policy, educated users, and support and leadership from management (as in management actually doing what's in the IS/Sec policy)?

Not at all, my point is different than the one you are making.

The point is that the security of a system should not be based upon the actions of any given employee, they should be based on a well formed foundation of ideals and practices. (which you more or less restated as layered security)
People tend to over state the roles of ibdividuals within the IS structure.

catch

I think you are completely missing the point here, as most sysadmins know what is going to screw their system(s) - and believe me most sysadmins do try their best to protect the systems they love (sorry - perhaps a bit over the top there).

I've been in meetings with higher managment when I have recommended a certain course of action, and been backed by my manager. The thing is, nobody else in the room has a f***ing clue what you are taking about. They would rather stick to company procedures, than look at what is happening in the real world.

Thankfully, I won the argument in this instance and prevented Blaster from getting out of control.

mi2g is better as a source of humor than information. That study is far from scientific and not worth much more than the paper it is written on. http://vmyths.com/resource.cfm?id=64&page=1 shows the kind of crap they spew.

Quote:

---

They would rather stick to company procedures, than look at what is happening in the real world.

---

This just means that your company needs to develop some better policies. System administrators, like programmers in a well defined organization really are not paid to think, they are paid to follow procedure and to do the tasks put on their lap. I know that many programmers/admins out there are not going to like that comment, but you should review the Carnigie Mellon maturity models if you don't want to take my word for it. ;) Add in security concepts like need to know, seperation of duties, and role rotation and it really becomes clear.

Quote:

---

mi2g is better as a source of humor than information. That study is far from scientific and not worth much more than the paper it is written on.

---

Regardless of your personal on the organization or the subject matter at hand the study points out a very serious issue with Linux. That issue is the complete lack of a Trusted Facility Manual for Linux. This leaves organizations with no quantitative definition of due care and or best practices. This means companies have even more work to do when establishing security guidelines and procedures and consequently they frequently are just not done. (Remember not only would you need to write them yourself, but you'd need to write them in a manner that your underwriters/insurers would agree with.)


catch

Catch
Sorry about that, I've been working two jobs and looking for a new place. Not mush sleep as of late.

Freddy.

I don't think it's true, this is like that : most of the viruses made for windows users but the number of hacking to Linux servers / Microsoft servers is the same.
but a good hacker can hack both... :-)

MsMittens-

Quote:

---

So they are including 3rd party applications with it and not Linux solely versus Windows only and not the apps? Also, 51% of the attacks going against Linux isn't as huge as it seems. To me, what is more telling is the response by readers (both Windows and Linux readers): how the stats are derived would be interesting.

---

The data that was gathered was using real life situations. How many linux or windows systems sit out on the internet running just the base OS load? Not very many. Also given that most linux variants are loaded with a standard distribution that in many cases includes the vulnerable software is the main point that the article is trying to raise. If a windows system was successfully attacked via a vulnerability in Domino server, the attack would count against MS, not Novell. The report is meant to show the number of attacks occuring against real-world systems, running real-world software. It is not meant to be taken as an MS is better than linux type article.

The one thing that nobody has mentioned is the market share that MS has and the fact that even with an exponentially larger installed base of systems, MS still has less systems attacked via this method of reporting than linux. I think this shows a major push that Linux was trying to use to gain market share that in reality is not true. Which is that the OS itself is not more secure. I know of several web admins that have switched to linux because they thought they would be more secure systems to run. In a few of the cases the administrators did not have the skills that they needed to properly run a linux server, so the end result is a less secure system.

It should also be noted that in most cases this is only telling you about web defacements. If somebody broke into a SQL server running on Win2k, it wouldn't make it into this set of stats as that is not something you can just email to a web defacement archive and be able to verify. So the article would be more properly named "Linux more popular target amongst script kiddies."

Another thing no one has mentioned is that NT retains its logs after a full system compromise, Linux does not. (that pesky failure to segregate admins and operators keeps biting them in the ass) So a much larger percentage of successful Linux compromises go undetected. (this is where open source is very bad because it becomes a trivial matter to trojan the kernel, the compiler, and the IDS system.)

catch

PS. Some further reading for you all:

This article discusses RedHat's (SUSE has gone after the same objective) intent to seek CC CAPP-EAL2 evaluation. This means that the best they could get linux configured and document was EAL2 (because they can submit anything they want, just so long as that configuration is known.)
http://www.redhat.com/solutions/part...s_oracle5.html

This is a paper by Dr. Jonathan Shapiro (of the EROS project) slapping around Windows 2000 for its CC CAPP-EAL4 evaluation saying how ineffective it is. (I completely agree.)
http://eros.cs.jhu.edu/~shap/NT-EAL4.html

However, if the CAPP-EAL4 is weak... what does that make CAPP-EAL2?
With regard to security it means complete and utter garbage, CAPP-EAL4 is at least ok for single level environments and its microkernel architecture allows it to be extended quite easily (such as Argus' Protector)
As Linux becomes more and more common, you will see continually more and more successful compromises against it because it is an inferior system. Consider this remark from Dr. Shapiro:

"Security isn't something that a large group can do well. It is something achieved by small groups of experts. Adding more programmers and more features makes things worse rather than better. Microsoft has been adding features demanded by their customers for a very long time."
How many people have their hand in Linux? And at least MS has a central point of control.

Catch, I know i'm a newbie and your a jr. member, but I have read some of your postings and have to ask one thing? Did Linux beat you as a child? You seem so negative about the OS, if microsoft is your thing then fine. But you seem to bad mouth linux whenever the chance arises? Just an observation.


DeafLamb

deaflamb- atleast he backs up his thoughts and opinions with logical arguments and data. I for one have found the information that catch has provided here over the last couple of days to be rather informative. He obviously is able to focus on security standards in his job/sparetime much more than I am, and I find it very interesting to see how linux stacks up against the procedures and processes of organizations such as ISO.

ps.- Being a junior member here at AO means very little other than you haven't posted a lot of messages.

Why can't someone post facts about a system being inferior without everyone thinking it is something personal?

Hahaha no no... truth be told I actually have two Linux system. (RH 6.2) I however know what they are and know their capabilities and I find it disturbing how many people go into Linux with their eyes completely closed just because some 1337 kids online said it was cool and it is always popular to root for the underdog.

You will notice that I don't post opinions about Linux ("it blows" etc) I merely cite facts about it. In this thread I noted it's EAL2 rating, that is a fact. I noted its lack of a TFM, another fact, I mentioned its failure to seperate admins and operators another fact, etc, etc. these are things that people need to know if you would like to have an educated opinion on Linux's abilities.

Also, note that in my last post I said "slapping around Windows 2000 for its CC CAPP-EAL4 evaluation saying how ineffective it is. (I completely agree.)" Where is the love for MS?

catch

Catch. Point well taken. I didn't mean to offend. Your posts are very informative and interesting to read. I was just wondering if you had some sort of bad experience with Linux in order to turn you drastically away from the OS. In regards to your statements on what Linux is lacking, I believe that is one of the greatest things about Linux. Sometimes "isn't less more?" In the grand scheme of things we are only dealing with 1's and 0's. The less things that can go wrong the better.

DeafLamb

The idea of less is more is a very important one in secure computing, however when the major thing it is lacking is assurance... well that is no good at all. Also, structure is important, Linux uses a monolithic kernel and NT uses a microkernel, this means at the most core level, NT has "less." The basic rule with computers is to work in a funnel design. Very little low level code, ideally even a finite state machine at the lowest level and broader and broader as you go up, this allows the greatest functionality nearer the user and greatest assurance nearest the base of the system.

Again my comments about Linux come from the point that it is arguably the worst multi-user system that has found any market (the possible exception being OpenBSD, but it is still relatively obscure.)

catch