Forgot your password?
typodupeerror
Security Software The Internet Linux

Is Linux as Secure as We'd Like to Think? 1091

Posted by Cliff
from the is-the-emperor-wearing-clothes dept.
man_of_mr_e asks: "With all the recent brouhaha about Blaster and Sobig, there's been a lot of talk about how poor Windows security is, especially compared to the Linux we all know and love. But is this really true? The website defacement archive at Zone-h shows that Linux accounts for 61% of the defacements in the last 24 hours (note, this figure changes, so it might be different when you view it). An analysis of the last few weeks of their archive shows a similar percentage of exploited Linux systems. Note also that the 'Unknown' category is rather high, and certainly contains at least some Linux systems, further increasing the percentage. Why is this? Are we just deluding ourselves about our own security? Could there be a Linux 'Blaster' just waiting to happen?" While "defacements" don't necessarily mean "root level break-in", sometimes getting your foot in the door is enough. If this happens, wouldn't Linux then be just as exploitable as Windows? Are there other reasons why the likelihood of a "Sobig" or an "ILUVYOU" would be lower for Linux than Windows?
This discussion has been archived. No new comments can be posted.

Is Linux as Secure as We'd Like to Think?

Comments Filter:
  • by Brento (26177) * <brentoNO@SPAMbrentozar.com> on Monday August 25, 2003 @05:11PM (#6788366) Homepage
    First, the user base for Linux is inherently more systems-savvy and internet-knowledgable than the Windows user base: it comes back to the old Linux-on-the-desktop argument. As long as you've got less systems-savvy users on a particular operating system, it will be more vulnerable to attack. As a result, people with more tech knowledge tend to also run a more secure system - just like my lawyer friends know not to let the cops search your car.

    Anti-establishment psychology also comes into play: for example, you don't see anti-business graffiti on your local coffee shop, you see it at Starbucks. When people want to make a statement about animal cruelty and food, they often picket at McDonald's - not the local Mom & Pop restaurant. Why? Because it's perceived as cool to go after the big business. Writing a Linux virus isn't nearly as cool as taking down Microsoft. The recent viruses attacked Windows Update for a reason: to make a statement. Calling Linux secure because people love DDOS'ing Microsoft is faulty logic.
    • by Anonymous Coward on Monday August 25, 2003 @05:13PM (#6788394)
      Maybe skilled users make the difference, but not in and of itself. Otherwise we would expect to see heaps of security problems/viruses with Mac OSX boxes.
      • by xenoandroid (696729) on Monday August 25, 2003 @06:41PM (#6789317) Homepage
        I think your underestimating the inteligence of some Mac users, sure there are some dimwits out there (they exist on many OSes), but they were at least smart enough to not use Windows for something they can do easily on another OS. From what I've seen, there is a lot less common sense in the Windows community than there is for other less widely distributed OSes. Many will download and run anything in their email no matter how many times they hear "Don't download strange attachments and run them".
        • by missing000 (602285) on Monday August 25, 2003 @09:20PM (#6790512)
          According to netcraft the percentage of sites running Apache is 63.72%. [netcraft.com]

          If you consider that the windows version of apache is rather insignificant, I would assume that the total linux web server installations are in line with this number.

          Therefore, one must conclude that the predominate cause of web site defacements is negligence, not the opperating system one chooses. After all, technically competent sites such as the one you are reading now almost never get hacked.
        • by reallocate (142797) on Monday August 25, 2003 @09:22PM (#6790526)
          You're both equating intelligence with knowledge of a specific computer system. That's completely bogus and more than a little techno-elitist. It's a bit like arguing that backyard mechanics are more intelligent than Linux geeks because they fix their own cars.

          What someone does or does not know is not a sign of intelligence. It is simply a sign of what they know.

          One would expect Linux users to be more system savvy than Windows or Mac users because a Linux distribution typically takes some study to configure and to put on the Net.

          If/when Linux becomes a significant part of the shrinkwrapped desktop market, the need for self-study to make it usable will diminish (otherwise no one but geeks will use it).
    • by 511pf (685691) on Monday August 25, 2003 @05:21PM (#6788492)
      People don't go after big business because it's "cool." People go after big business because it's visible. It gets their message across to more people. Big business is also a target because any change in business practices has a wide effect. If McDonalds increases their food safety standards, the change has a real effect on national food safety because of McD's sheer mass. In addition, other fast food chains will follow suit to avoid bad publicity. Going after McDonalds isn't "cool." It's effective.
    • by Dog and Pony (521538) on Monday August 25, 2003 @05:29PM (#6788602)
      the user base for Linux is inherently more systems-savvy and internet-knowledgable than the Windows user base

      Or so they would like to think...

      I'm not so sure. There are lots of those savvy and knowledgable people on Windows, just as there are lots of "k3wl, I'm so 1337 d00d, because I run Linux and not M$ Winblows" amateurs out there.

      I think you'll find the average Linux user to know a bit more about computers yes, but to make the assumption that Linux users are "inherently" more secure users is just begging for trouble.

      And furthermore, lots and lots of Linux users are most likely too confident because they are so savvy and knowledgable. Hubris is dangerous on any platform.

      Of course, since we all want to feel special and look down on some other group and be "better" than them, that is not what people want to hear around here.
      • It's those communist dual-booters that we have to worry about.
      • by KrispyKringle (672903) on Monday August 25, 2003 @05:46PM (#6788765)
        You make a good point; one of the explanations I've seen for statistics similar to those the article posting cites (61% of defaced machines being Linux) is that when an amateur wants to set up a personal website on his cable modem, he doesn't usually install IIS. He installs Linux and Apache. When he wants a really basic comment board or CMS, he uses PHP-Nuke. For his e-mail server, he uses Sendmail.

        Yes, I've ran into hobbyists running IIS for fun--by which I mean I discovered his CodeRed infected box on my network--but the cost of a Windows Server license is prohibitive of amateur use, even if plenty of people just pirate it. So in the end, the inexperienced users with no time to spend securing their boxes turn to RedHat with Apache and Sendmail. Which isn't necessarily a bad thing. If I had to choose between Linux or Windows for which to leave alone without regular maintanance, the choice is pretty clear.

        • by OldHawk777 (19923) * <adelovantNO@SPAMverizon.net> on Monday August 25, 2003 @06:21PM (#6789104) Journal
          Is that 61% a stat-lie?

          If there are significant more Apache websites compared to MS-Win websites on the internet, and the numerical coefficients of the variables used in the equations were not weighted appropriately, then a condition (of at least) co-variation was not taken into account ... the interpretation of 61% is in error.
          Also, novice websites (Apache, MS-Win, ...) are frequently defaceable. I believe, due to the obvious (cost for a Linux+Apache+Skill+Daring) already stated by others, means that the most easily defaced website are in fact probably "Linux+Apache", but also the best most secure website because of the open-community+collaboration+... implies (for me) "Linux+Apache" makes the best websites for business and government.

          So, I suspect stat-lie. However, I ain't done any major data crunching with FORTRAN and arrays in almost as many years as serious code.

          OldHawk777

          Reality is a self-induced hallucination.
      • In addition (Score:4, Insightful)

        by phorm (591458) on Monday August 25, 2003 @06:21PM (#6789095) Journal
        I'm not so sure. There are lots of those savvy and knowledgable people on Windows, just as there are lots of "k3wl, I'm so 1337 d00d, because I run Linux and not M$ Winblows" amateurs out there

        These same users are the ones who end up configuring their webserver with passwords such as "god" or "admin." A secure O/S is fine and dandy, but it doesn't help all that much against the same general stupidity that afflicts windows and linux users alike. How many servers are defaced because they're either very behind on security, or simply easy to get into?

        Not only that, but we have a lot of people who don't know as much about security as we would like. I personally don't know as much as I'd like. How many admins who know how to configure httpd.conf for apache are good at plugging with iptables?

        At work, any sensitive online-based sites are restricted to a certain port, and allowed only from local addresses. Yes, by IP-spoofing they could avoid that, but at least it's an extra level of security. How many people bother with this? A lot can be done at the firewalling level, before any attack even gets near your daemons...
    • by Art Tatum (6890) on Monday August 25, 2003 @05:37PM (#6788675)
      I think it's a little more than just being savvy. One problem is that an awful lot of Windows users have very screwed up ideas of how their computers are supposed to function.

      For instance, they don't think having to type in a password to run Setup.exe is even remotely reasonable. Their view of the computer is: "if I want to do something with my machine, I should be able to just do it. Don't put anything in my way." And if they were forced to take precautions, their password would end up being something like 'a'. And a regular schedule of changing passwords? Forget it.

      Another example, a little more relevant to this case: people want their email for sending dirty pictures, HTML joke pages, funny Flash or Shockwave animations, Active X games, etc. They'd be bored to tears if they had secure email. And they'd be pissed off at anybody who was responsible for it. Have any of you guys ever taken heat for banning popular but incredibly insecure software at your site? Or spyware.

      And it's astounding how many supposedly intelligent people (programmers) who have you in their address books end up sending you virii because they were stupid enough to continue clicking on emails about 'Hot pics' or those 'Snow White and the Seven Dwarves' emails. Sheesh.

      All this is not to say that Microsoft doesn't have some basic architectural issues--they do. But the unreasonable demands and silly behavior of many users more or less prevents them from changing any of it. And when they do change it, people ignore it for the sake of convenience. It's been possible to run as an unpriveliged user for a long time with Windows. And it's not difficult to do. But guess how many people actually do that.

      • by Politburo (640618) on Monday August 25, 2003 @06:05PM (#6788935)
        Oh blah blah blah. This is the same old tired shit of "Windows user = stupid, Linux user = smrt". The reason Windows users have these misperceptions (yes, that's what they are) is because that is simply what they are used to. In Win9x, 3.1, and DOS, there were pretty much no passwords. To suddenly think that millions of people will overnight realize that passwords need to be commonplace for security is asking way too much. We are currently in a growing period in computers, and the worms around now are the growing pains. If people that are knowledgeable about computers acted nicer towards Joe User and explained the rationale behind passwords, and not running as root/admin, instead of being l33t and condescending, you might see a little more positive response.
    • by The Tyro (247333) on Monday August 25, 2003 @05:45PM (#6788750)
      That's an excellent first post.

      I think you are about half right about the first point... how many really clueless users do you know that run linux? To run linux, a person has to get over the "activation energy" of actually getting it installed. This goes beyond just having a pretty GUI installer rather than some text-based option... it's actually knowing how to answer the questions the installer asks: How many joe-sixpack guys even know what an IP address is? Or know their primary and secondary DNS server addresses? If some well-meaning geek has installed a linux system for their grandma, they probably set up IPtables and killed all the unnecessary services... that's a HUGE security advantage right from the start. It's amazing what a clueful install can do.

      But onto your second point. I think it has more to do with the variety of linux users/systems rather than their iconoclastic attitudes (though the latter probably breeds the former, so in a way, you could be right). As a medical professional, I'd compare it to a genetically heterogeneous population. In a MS-centric environment, there's only so many ways to skin a cat... Win2K, WinXP, et al. That lack of variability has administration advantages, but that sword cuts both ways. Common systems are easily administered, but just as easily cracked if they share a common vulnerability.

      In nature, genetic variability is your friend... keeps an entire population from being wiped out by a plague. The Cystic Fibrosis gene is a defect, but saved some people from death during the cholera epidemics of the middle ages, and the gene has stayed in the northern european population ever since.

      Variation on systems is FAR more prevelant in the linux world. Different kernel versions, different daemon versions, different firewalls, different configs (chroot, etc). Add that to a tech-savvy population, and a successful linux worm becomes a serious challenge.

      It's really apples and oranges to compare linux and MS environments.
    • by I_redwolf (51890) on Monday August 25, 2003 @05:46PM (#6788766) Homepage Journal
      Ugh.. this is so inherently based on faulty logic itself that it's beyond the scope of a comment to explain but I will try.

      Unix and Unix like systems are based on a simple and easy concept when it comes to security. That is, if you don't have what is known as "root" you don't get to do any damage to system resource files.

      Windows operates on an everyone is root notion, allowing anyone to make changes to system resource files. Not only that but because of the way Windows is designed where everything is mashed together, when one card falls so does the whole deck.

      Unix and Unix-like systems operate on one tool for one job and with inventions like the pipe and IPC ta whole host of new functionality becomes capable just by passing output of one program to the next.

      That's as simple as I can possibly explain it. I'm not saying Linux is the most secure thing since sliced bread, I'm simply stating the facts, and the fact is that Unix and Unix-Like systems tend to be more secure because they were DESIGNED that way. Windows was not designed with security in mind and the fact is that it is less secure.

      All the other linux virus writing is less because windows is so prevelant hippy bullshit I'll save for PHB's. If you really believe that I've got an SCO license to sell you too.
    • by Malc (1751) on Monday August 25, 2003 @05:51PM (#6788814)
      Rubbish. My employer bought a company that was deployed on RedHat 7.0. We are a MSFT only shop. Let me tell you, those RedHat servers were in worse condition than our Win2K boxes. The servers have been exploited as spam relays (very old formmail) amongst other things. It's pretty bad when a software engineer (me) has to come in and get a server running properly due to the incompetence of the IT staff. They had all kinds of stuff installed that should never have been there. They never cleaned things up. Based on that, I would say there are probably other Linux boxes out there administered by idiots.
  • by Anonymous Coward on Monday August 25, 2003 @05:11PM (#6788371)
    Personally I have all my end-users sign on as root. So far so good
    • by deranged unix nut (20524) on Monday August 25, 2003 @05:37PM (#6788680) Homepage
      ..sigh..

      I wish this were so funny. The last two VARs that a business I know of has gotten accounting systems from have configured the systems so that all of the users did log in as root.
      • by swb (14022) on Monday August 25, 2003 @06:58PM (#6789460)
        I wish this were so funny. The last two VARs that a business I know of has gotten accounting systems from have configured the systems so that all of the users did log in as root.

        If you've ever installed systems (of any kind) for small businesses (~50 people), you'd know why this was such a temptation and often a functional necessity.

        Many of them have no full-time technical staff. The typical scenerio is a "operations manager" who spends most of their time dealing with production issues; a "back office" person (who's usually the consumer of the system, often the head financial person); and then whoever ends up being the technial liason, which in my experience is whatever office flunky can get WebShots installed the best or who has the copier repair phone number.

        It's sad, but I've done a ton of installs where basically everyone who uses the system is root/wheel/administrator and there are no permissions. If I'm lucky and can figure out there's no one to even reliably change tapes before the equipment is set up, I have it do alternate full backups on different physical disks; I figure it's better than a burned up tape.

        It keeps you in business, but it kind of sucks, since it's apparent that nobody really gives a shit...
    • by johnlcallaway (165670) on Monday August 25, 2003 @05:57PM (#6788862)
      Wanna hear something sad?? I have Unix developers who want root access because when they type 'find / malloc.c', it returns too many 'permission denied' messages. I tried to explain that if they tack on '2>/dev/null' onto the end, the errors messages would go away and they would still find their file.

      Their response?? That's too much work.

      It doesn't make any difference how tech-savy someone is. Secure systems by their nature prevent access to features. If the perception is that it takes longer to get something done because of the security, people want security turned off.

      That's part of the reason why M$ so insecure, Bill Gate$ has made it too easy to use. My fiancee runs her XP laptop without any login, just turn it on and there you are. So much for security. I gave up trying to explain to her why she needs to login to use it. The standard answer is it takes too much time.

      I guess getting to email and solitare quickly are more important than making sure all the personal data she has on it is safe.
  • by tlacicer (515153) * on Monday August 25, 2003 @05:11PM (#6788372)
    I think website defacement and Linux security are 2 different issues all together. From my own experience any website that I have had defaced on me was because I failed to update 3rd party OSS packages. This had nothing to do with the security of of the operating system or the web server for that matter. It was only a security hole in one php script. This security hole was identified and patched rather quickly but I failed to apply the patch in a timely matter. But the rest of my websites were fine along with the rest of the services running on that box.

    My opinion is that there are a lot of free / cheap web hosts out there running OSS and a lot of people publishing web pages and message boards using scripts that someone else wrote and not updating them.

    I would like to see a comparison on the types web pages that were defaced and what was actually done, I bet most of them had nothing to do with operating system the website was running on.
    • by BrynM (217883) * on Monday August 25, 2003 @05:27PM (#6788584) Homepage Journal
      I think website defacement and Linux security are 2 different issues all together.
      Exactly! People tend to trust website "packages", like PHP-Nuke [phpnuke.org] or site building applications a little too much. They tend to assume that someone has already fixed whatever security holes may be in it. When I installed PHP-Nuke (yes, I actually use it) I went through the PHP code with a fine toothed comb before I opened the site to the public. I found lots of potential SQL injection, external file call and global variable exploits that needed fixing. Since these sites usually end up being run on Linux and Apache, Linux and Apache get blamed when the site is defaced, when the actual weakness that led to the defacement was in the PHP/HTML pages themselves.

      I don't expect everyone to know how to clean up security for a PHP site, but if they decide to use what they don't understand bad things will happen. If you know a novice that wants a site, start them out with some static HTML rather than let them use whatever code strikes their whim as "neat", "shiny" or "cool". Explain to them that they are learning how to eventually do the "shiny" stuff, but they need to learn how to use it safely first.

      • by donutz (195717) on Monday August 25, 2003 @06:09PM (#6788975) Homepage Journal
        When I installed PHP-Nuke (yes, I actually use it) I went through the PHP code with a fine toothed comb before I opened the site to the public. I found lots of potential SQL injection, external file call and global variable exploits that needed fixing.

        So just out of curiosity, did you submit your changes to the PHPNuke folks? Or just fix it for yourself? Seems it would be a kind thing (good for your karma, and not just the /. kind) to submit security fixes, if you know they exist.

        Care to comment on where you made some of your fixes in the code, so that if you didn't report them yourself, then someone else can make those fixes public?

        Thanks!
        • by BrynM (217883) * on Monday August 25, 2003 @06:54PM (#6789431) Homepage Journal
          I'm working submitting the fixes I've created actually. I've only recently (in the last two months) started the site, so it's still in-process - code submissions and all.

          It all came about because I am building a module for Nuke. I started looking at the code and decided to do some house cleaning. Most of the fixes I implemented are already in the public (look around at Nuke Forums [nukeforums.com] or search for "php nuke exploit"), so I'm betting that Francisco Burzi (the creator of Nuke) is working on implementing them for the next version if they aren't already in. He's been good about including fixes as problems are found.

          Most of the exploits are simple SQL injection exploits, which affect all PHP/SQL code and not just Nuke. Let's say you want to query user data from a MySQL table named USERS with the USERID as the criteria:

          ?php mysql_query("select * from USERS where USERID=5"); ?
          This will work great for one user, but to make the code portable, you'll need to use a variable for the USERID, so it becomes:
          ?php mysql_query("select * from USERS where USERID=$USERVAR"); ?
          When the variable is passed by an online form it will look like this:
          http://foo.yoursite.com/file.php?USERVAR=5
          Because PHP doesn't keep strict varaible types, $USERID could contain the number 5 just as easily as it can contain the string "foo". Since the variable is at the end of the SQL query, we can append SQL to the end of our URL like:
          http://foo.yoursite.com/file.php?USERVAR=5%20or% 201=1
          As a result, PHP will hand MySQL a query that says "select * from users where USERID=5 or 1=1" (remember that %20 is an URL encoded space). Since 1 will always equal 1, MySQL will dump every record in the table instead of just the one with a USERID of 5. The way to fix this is simple. Before your line of PHP with the query, just do a simple
          ?php $USERVAR=intval($USERVAR); ?
          Since our exploit relies on $USERVAR being interpreted as a string, it will fail as PHP intval() will discard everything in the variable from the first encountered non-integer onward. Thus malicious value of "5 or 1=1" becomes the number 5 again. There are a lot of places where this needs to be fixed and I haven't found them all yet. I'm working on a list that I plan to give to Francisco rather than have him try to keep track of me telling him about many individual ones and lose something along the way. Many nuke users have already fixed these themselves as well. There are other checks that need to be done for string variables, but I've already veered way too far offtopic.

          I would be quite the selfish bastard to only fix the security holes for my use and no one else's. I'm glad you asked though. It never hurts to remind OSS users of their responsibilities should they touch the code. ;)

      • by Pinky (738) on Monday August 25, 2003 @06:17PM (#6789038) Homepage
        That is dangerous! There could be a hidden or obfuscated loophole. I, for one, never run any code that hasen't been written by myself while under polygraph examination. I keep my website running in a concrete block under the ocean and I keep all the clocks in my appartment running at different times, just in case my future self came back in time to try to sabotage my project. Every one should do it.

        When I introduce someone to coding I chop off their hands and then hide them to be sure they won't code anything. New users think I'm paranoid and arrogent but I don't want any one of the mindless rabble to come and get me in middle of the night when the KGB hacks their site. :-)
    • by commodoresloat (172735) on Monday August 25, 2003 @05:30PM (#6788604)
      From my own experience any website that I have had defaced on me was because I failed to update 3rd party OSS packages. This had nothing to do with the security of of the operating system or the web server for that matter. It was only a security hole in one php script.

      I think one could say the same about Windows, no? It has nothing to do with the security of the OS if hackers find vulnerabilities in a commonly used application (e.g. Outlook).

      • by rebelcool (247749) on Monday August 25, 2003 @05:37PM (#6788678)
        I develop alot of backend web apps and its surprisingly easy for an enterprising individual to pass bad data through forms, and if the app doesn't check the incoming data properly, and simply assumes its coming from a legit source, you're going to have bad behaviors.

        There was a story on kuro5hin a few months ago about this, where a guy figured out a way to enter his own price for a product on an electronics website and was ordering hardware for less than what the page said it cost. And got away with it. This kind of hole is scarily prevalent i've found, as alot of backend developers are very lazy and inexperienced people.

        I think this is whats meant by 'applications' security. The box itself may be locked down well, but its taking advantage of the open services in ways the developers never intended.

      • by Some Dumbass... (192298) on Monday August 25, 2003 @08:12PM (#6790034)
        From my own experience any website that I have had defaced on me was because I failed to update 3rd party OSS packages. This had nothing to do with the security of of the operating system or the web server for that matter. It was only a security hole in one php script.

        I think one could say the same about Windows, no? It has nothing to do with the security of the OS if hackers find vulnerabilities in a commonly used application (e.g. Outlook).


        To take this one step further, you could probably make the even more general argument that almost nothing really tells you which OS is more secure. Rather, break-ins involving a particular piece of code only tell you that the particular piece of code is insecure. You could argue that website defacements really measure the security of webservers, other web-related packages (PHP, shopping cart programs, and the like) and perhaps the security of other servers on the system, all depending on what exactly was used to break in to the system. Technically, even the security of other systems on the same network could play a factor (e.g. if someone roots the mail server and the root user has the same password on both the mail and web servers).

        A big part of the difficulty here comes in splitting out applications from OS. Internet Explorer, Outlook and Media Player 9 are all technically applications, but I'm not sure that any of them can be properly "removed" from newer versions of Windows, at least not by your "average joe". Likewise in the Linux world, while it is rather clear that video games and the like are applications and thus separate (though some people insist on counting them in their Linux "vulnerability" lists anyway :) it gets harder when dealing with programs like SSH or LPD. SSH is third-party, but it's in such common use and is by far the preferred terminal server on Linux, so it seems as though it should count as part of the OS. Likewise, although LPD has sort of been replaced by CUPS, it's still in common enough use, and supplies a sufficiently basic function (printing), that many people count it as part of the OS. Yet I personally am not running either LPR or the SSH server and still have a perfectly functional Linux box, so they're hardly required parts of the OS.

        Needless to say, comparing the security of OSes based on the number of times their applications are compromised is awfully hard to justify. If you include applications with the OS, then you beg the question: "which apps"? If you don't include applications with the OS, then in many cases one OS has much greater functionality and thus more opportunities to be compromised, so the comparison still seems unfair (having an always-on RPC server does provide functionality, you must admit).

        Frankly, I'm starting to think that this argument should just go away. Nobody seems to agree on what constitutes Windows and Linux. Without even those basic ground rules, how in the world can we have an intelligent argument about the relative security of Windows and Linux (and MacOS, and *BSD, and...)?
    • by PetWolverine (638111) on Monday August 25, 2003 @05:36PM (#6788667) Journal
      Similarly, though, most MS worms and viruses exploit not holes in the operating system, but holes in various common programs that are Windows-specific. Blaster is an exception, but SoBig and Slammer are excellent examples--one exploits Outlook and the stupidity of many users, while the other exploits a small hole in Microsoft's SQL server. Neither, strictly speaking, exploit flaws in Windows itself. Even Blaster exploits a flaw in a network service that at least shouldn't be part of the OS, at least by the *nix OS-design paradigm.

      When determining how secure an operating system is, it is essential to take into account the security of all the various programs people will run on it. Linux itself is very secure, but mostly because it doesn't do anything; all the potentially dangerous work is left to other programs, which often screw it up. Take a look at sendmail, for instance, and try to tell me it's more secure than a Microsoft product. Looking at security from this perspective, Linux isn't really an operating system, but rather the whole *nix category should be considered (in many ways) one OS.

      When determining the security of a particular system, not only does the specific implementation of *nix become relevant, but the programs you run remain relevant--only now it really is the programs you run, not the programs that are available. Obviously the next root exploit in sendmail won't affect me if I'm running postfix. If I instead write my own mail server (just to keep the same example), it might be very secure through obscurity, but (since I'm a sysadmin, not a programmer) it won't be very fundamentally secure.

      Basically, security is a lot more complicated than simply "Windows sux0r5." Bad programming and bad configuration can make any operating system insecure, and assessing the security of a particular system is quite a different thing from assessing the security of an OS in general.
  • weakest link (Score:3, Insightful)

    by macragge (413964) on Monday August 25, 2003 @05:12PM (#6788376)
    A system is only as secure as its most insecure user / service.
  • by mrdlcastle (254009) * on Monday August 25, 2003 @05:13PM (#6788387)
    I think we are correct in saying that Linux is more secure than Windows. When we are talking about just the operating system, then we can safely say that it is more secure.
    Of course as we add applications to any system that system becomes more vunerable.

    It's just that Windows starts off vunerable and gets worse as we add more apps (ie, Web server, ftp server, etc.).

  • by rsborg (111459) on Monday August 25, 2003 @05:14PM (#6788404) Homepage
    I think this article is way off base. Anyone can put an poorly secured box on the net. The big difference between Linux and Win32 is that Win32 is "broken as designed" and that won't change unless Microsoft changes it.

    btw, if you want to secure your linux box against viruses, etc... you at least have the option to recompile the distro.

  • scewed results? (Score:5, Insightful)

    by iamkrinkle (585605) on Monday August 25, 2003 @05:14PM (#6788405)
    Does this take into account the # of linux servers vs. windows servers? If there are significantly less windows servers, then this isn't all that significant. If there are less windows servers, but just as many break ins as linux, then windows is still more insecure despite the fact that they have the same number. they have more per machine. i hope that made sense =)
  • The Only... (Score:5, Insightful)

    by strateego (598207) on Monday August 25, 2003 @05:14PM (#6788407)
    The only real way to secure a computer is to pull the power plug out of the wall. If you spent time mantaining your computer, keeping it up to date, and you know what you are doing their is little chance that you will have major problems. Anybody who puts a linux system on their network and doesn't update it is likly to have their system exploited.
  • email viruses (Score:3, Insightful)

    by geeber (520231) on Monday August 25, 2003 @05:14PM (#6788408)
    Email viruses like Sobig are aimed at desktop users. Since most of the desktop users run Windows, it makes sense that most of the viruses would be targeted at them and not Linux users.
  • by Anonvmous Coward (589068) on Monday August 25, 2003 @05:15PM (#6788420)
    Species of Windows Programmer: Human
    Species of Linux Programmer : Human

    Chances of human error making it into the code: Equal

    Doesn't matter if you're using Linux or Windows, you must be vigilant. You cannot completely secure against a creative human. Instead of debating this shit, how about learning from Microsoft's mistakes and making sure Linux grows from it?
  • by Outland Traveller (12138) on Monday August 25, 2003 @05:16PM (#6788429)
    Looks like some of that "defacement" is happening close to home.

    view-source:http://www.zone-h.org/

    DB connection failed ().
  • by RealityProphet (625675) on Monday August 25, 2003 @05:16PM (#6788438)
    Are there other reasons why the likelihood of a "Sobig" or an "ILUVYOU" would [be] lower for Linux than Windows?

    Absolutely not! These are not viruses that exploit bugs in code. These are socially engineered programs designed to get the user to run them.

    You can't make the argument that the "average intelligence of the linux user" is higher than joe-sixpack's because if we are talking about linux-in-the-mainstream, then the "average linux user" will be joe-sixpack! Also, you probably can't talk about the fact that it isn't as mind-numbingly easy to run a scipt in linux as it is in windows, since those arguments contribute to why linux isn't mainstream in the first place!

    • by Gherald (682277) on Monday August 25, 2003 @05:29PM (#6788601) Journal
      > These are socially engineered programs designed to get the user to run them.

      Re: Approved

      Please log in as root to accept this offer...
  • by bartyboy (99076) on Monday August 25, 2003 @05:17PM (#6788441)
    Or your admin makes it.

    I used to run an old distro (RH 5.1) for the longest time (it had everything I needed) and it was full of security holes after doing the install. But disable some services, update some packages and presto - you're ok to go.

    It's the same thing with Windows - check out the services turned on by default after installing Win 2k. Half of them will never be used by a home user.

    So patch your box, remove unnecessary services and you should be alright. If you know what you're doing, you'll be ok.
    • check out the services turned on by default after installing Win 2k

      That's the problem. Most people running Windows XP or Windows 2K wouldn't know a service if it bit them. That's why these worms wreak havoc. Linux has a smaller installed base and it's generally made up of more technical users. Thus, much of the problems that could show up under Linux are minimized because the people running it know what they are doing.
  • by rantenki (66616) on Monday August 25, 2003 @05:17PM (#6788450)
    I just install a vanilla Redhat on all my boxes. They get rooted within a few days, and the hax0rs take care of the security updates for me. Course, I can't log in as root anymore, but hey... that's a feature.
  • How I see it... (Score:4, Insightful)

    by rosewood (99925) <rosewood.chat@ru> on Monday August 25, 2003 @05:18PM (#6788453) Homepage Journal
    When I say that Linux is more secure then windows, I see it on many levels.

    For an end user its obvious since in windows you are always the admin (even in winxp where you can finally really change the power of the user, a lot of shit doesnt work right unless you are the admin). This basic security difference is HUGE.

    Then there is the whole open source vs closed source security. I Truely beleive in that. It only makes sense that it is going to be more secure in the long term. This doesn't mean exploits don't exist - its just Im prone to beleive that there is someone using an unknown windows exploit as we speak to do something bad and it might be YEARS before that one is ever found (history backs me up on this one) but yet if there is something as blatent as the RPC exploit in OSS, we tend to see fixes for rather quickly (again history backs me up here).

    Don't confuse the idea of inherint security with stupid users and sysadmins or even part time sys admins that aren't paid enough / don't work enough hours to keep a handful of servers updated across town.
    • Re:How I see it... (Score:4, Interesting)

      by mikolas (223480) on Monday August 25, 2003 @05:54PM (#6788840) Homepage
      "For an end user its obvious since in windows you are always the admin (even in winxp where you can finally really change the power of the user, a lot of shit doesnt work right unless you are the admin). This basic security difference is HUGE."

      Well if you just for one second assume that a Windows user is as competent as a Linux user, this sentence just does not make any sense. I haven't been running as administrator on Windows since NT4. I know how to use "Run as a different user" just as well that I can write sudo in Linux so there really is no need ever to log in with too much privileges on Windows. And as a technologically advanced user you also know your policies and such so you can harden all the other accounts in the system just the same way you might do it using Unix-like operating systems. It's even easier to do fine grained security hardening on Windows given you know how to administer your box.

      And, when it comes to the RPC exploit, you just don't remember what happened with OpenSSH some time ago? A fix was available for quite some time and even then a huge amount of computers got cracked. If Linux was as popular as Windows, there might easily have been about the same number of "infections" as there were with Blaster.

      To assume one system is more secure than some other just because it's different is simply stupid. Security consists of many different aspects and the underlying OS is just one of them.
  • by defile (1059) on Monday August 25, 2003 @05:18PM (#6788454) Homepage Journal

    Are there other reasons why the likelihood of a "Sobig" or an "ILUVYOU" would lower for Linux than Windows?

    Anyone can write a worm that leverages a security hole in a default service of a default Red Hat Linux install. Or Windows XP Home Edition.

    However, it takes considerably more skill to be able to write a worm that can target vulnerable services across multiple distributions of Linux, multiple versions of each distribution, etc.

    As long as Linux evilware continues to exploit C program unchecked boundaries, a single universal worm that can effective exploit every potentially vulnerable Linux system remains highly unlikely.

  • How about this? (Score:5, Insightful)

    by wadeb (147504) on Monday August 25, 2003 @05:18PM (#6788462) Homepage
    Linux is less vulnerable because there are fewer identically configured machines on the internet.

    One of the things about Windows is that there are so many copies out there that are all configured the exact same way, if a flaw is found in anything you have an instant worm possibility.

    With Linux there are so many distributions, each with their own initial configurations and setup types that a worm would be hard pressed to find a common exploit.

    Not that the internet hasn't been shut down by a UNIX worm in the past, that is... :)
  • It's easy (Score:5, Funny)

    by brooks_talley (86840) <brooks@@@frnk...com> on Monday August 25, 2003 @05:18PM (#6788465) Journal
    Windows web defacements are the fault of a crappy, inherently insecure operating system from a criminal monopoly.

    Linux defacements are the fault of stupid admins who can't be bothered to install the latest patches, or who are too incompetent to install the OS and configure it for security.

    I thought everyone knew that.

    Cheers
    -b
  • Just my 2c... (Score:5, Interesting)

    by dark-br (473115) on Monday August 25, 2003 @05:19PM (#6788469) Homepage
    I've seen people on Windows machines probed and hacked while they were online on IRC, in real time. Any passably competent cracker should be able to take control of a Windows box in short order. And Microsoft is well known for being slack on security matters. Always has been. And VB and the other tripe they've grafted on to their products multiplies the possibility for hacks by an order of magnitude.

    Yes, there are Linux hacks, though far fewer than Windows hacks. And I see the buffer overflow vulnerabilities and such that come out weekly for Linux software. Many of those vulnerabilities are theoretical, found by a perusal of source code and never actually taken advantage of. And the Open Source community fixes these _far_ faster than Microsoft will ever fix theirs.

    Oddly, some of the foremost security guys (Bruce Schneier, for example) state very explicitly that Open Source software is far better security-wise than any closed source software (read Windows). And they explain the reasons in great detail. And there are several people on this list who deal with both OSes on security matters on a day to day basis, and I'm pretty sure they'll attest that Linux security is much stronger than Windows.

    If nothing else, a Linux user can determine and control open ports, running services, and create firewalling rules. Windows users think a port is something a ship pulls into, and a firewall is something in their cars.

    • Re:Just my 2c... (Score:5, Insightful)

      by BrynM (217883) * on Monday August 25, 2003 @05:37PM (#6788672) Homepage Journal
      .And I see the buffer overflow vulnerabilities and such that come out weekly for Linux software. Many of those vulnerabilities are theoretical, found by a perusal of source code and never actually taken advantage of.
      You bring up an interesting point. I bet we'll never see Microsoft patch a theoretical exploit. They seem to see patching as a reactionary process rather than as bug tracking. "If it aint bad PR, then don't fix it." - Too bad that attitude still leaves it "broke".
  • Social Engineering (Score:5, Interesting)

    by Ieshan (409693) <ieshan.gmail@com> on Monday August 25, 2003 @05:20PM (#6788484) Homepage Journal
    Modern viruses work by two major routes:

    A) Exploits
    B) Social Engineering

    Exploits are hard to stop without patches. Get enough unpatched systems, and your virus spreads. There are a lot of guilty linux users here, I'm sure: people download software all the time without checking it's security. People run software daily without bothering to check for updates. It happens.

    Social engineering, however, is by far the most widely used virus tactic. It's easier to fool a user than to fool a well-secured computer, says this adage. The basic premise fails under linux: it's really, really hard to get someone to run malicious code that you want them to run. Most linux users are above-average on the computer-tech-savvy curve - I would say that the mean computing knowledge for an average linux-desktop user is above the 90% mark on a curve of all computer users.

    This means linux users don't do stupid things as readily. The subject line RE: DOWNLOAD MY NEW SCREENSAVER with the attached .tar.gz isn't likely to fool many people. I have a hard time believing that most SoBig victims are those who know what Bayesian filtering is; actually, I have a hard time believing that most SoBig victims know what Inbox means.

    Furthermore, it's tough to write code that will run without a hitch on everyone's system, as there's so few distro standards. Also, as email virii work, with linux being a small desktop percentage, it's tough to get emails into the boxes of most Linux users.

    Last but not least: There are few people who want to see Linux die. The rivalry doesn't work in both directions. There are thousands of anti-MS'ers, but a sad few anti-Linux'ers (SCO not included. =P). What would the protests be? "Hey, assholes! Keep your free operating systems off of our clean hardware! You're ruining good pentium chips by corrupting them with something non-proprietary!" etc.

    Just a few points. I'm sure there are better ones.
  • by Sevn (12012) on Monday August 25, 2003 @05:20PM (#6788486) Homepage Journal
    I do contract work. A HUGE bulk of it lately has been doing security audits on companys running old redhat, old plesk, or both that have been hacked by shit brazilian hacker groups like "Hidden Wrestle" and "Securinos". They hang out on irc.brasnet.org all day looking for webhosts using old plesk and old redhat. It's an awesome excuse to migrate people to FreeBSD and webmin. I've done quite a lot of that lately. They freak when they see the cost of the latest plesk and enterprise redhat. It makes selling them on FreeBSD and webmin/horde/squirrelmail/usermin/virtualmin/etc. very easy. So as long as people insist on installing 2 year old redhat and plesk 2.5 and never updating it, I'll have plenty of work removing eggdrop and psybnc from machines, and migrating people to FreeBSD. I'm starting to look at BMW's again.
  • Defacement != Hack (Score:4, Interesting)

    by RT Alec (608475) * <alec@FORTRANslas ... m minus language> on Monday August 25, 2003 @05:21PM (#6788501) Homepage Journal

    At least, not always

    IMHO, the single greatest threat to having a site defaced is the use of insecure protocols for publishing. Let me be more specific: FTP. Most web development tools use FTP for their "publish" feature (e.g. Dreamweaver, just to pick on them). Securing FTP is a nightmare, with all the ports randomly popping up and so forth. You have to dumb down a firewall quite a bit, and having it tunnel over SSH only partialy secures it (and you still have to deal with the firewall woes).

    So, an employee goes home at night, and updates his company's web site over her cable modem connection, and the 12 year old down the block running a sniffer captures the user ID and password. She then passes this information on in a chat room, and viola! The site is defaced shortly thereafter. It does not matter what OS the site is on.

    Having said that, some systems are more prone to social engineering. If the server goes down due to numerous patches being applied (and the requisite reboots), a web developer might get used to the IS department resetting her password and thus more suceptable to that phone call asking for the login info. But my point is, web site defacements do not necessarily indicate the security of the OS. It is a combination of protocols used (how about only allowing SFTP?), policies, and implementation by knowledgeable admins. Unix (Linux, BSD, etc.) admins tend to be better at implementation and policy development then their Windows brethren, perhaps that is the causal connection.

  • by Brahmastra (685988) on Monday August 25, 2003 @05:21PM (#6788506)
    The OS is only as secure as the user. If a lame Linux user does everything as root, he's going to be more vulnerable than someone using Windows 2000 with a firewall. If a lame Windows administrator doesn't have a decent firewall and keeps all kinds of ports open, he's going to get hit too. It's about users knowing what they are using. But I have to say that a default Windows installation does appear to be less secure than most default Linux installations.
  • by dwheeler (321049) on Monday August 25, 2003 @05:22PM (#6788509) Homepage Journal
    The arguments are all far more complicated.

    An unmaintained system is almost always more vulnerable than a maintained system, no matter what they are. Also, I don't know how secure you'd like to think GNU/Linux distributions are - they're made by humans who make mistakes.

    But the recent attacks certainly give evidence for th e Linux crowd. XP comes with multiple open ports by default, by default doesn't enable a firewall, and its mail reader by default runs arbitrary programs sent by attackers when clicked. Typical Linux distributions have no open ports by default, use a firewall, and don't stupidly trust attackers to send them "nice" programs when clicked.

    The notion that Linux systems are immune is fundamentally wrong. Linux systems do make design choices that make them rather resistant. But it's all more complicated than "X is always more secure".

  • Numbers! (Score:3, Insightful)

    by Quasar1999 (520073) on Monday August 25, 2003 @05:23PM (#6788523) Journal
    Hey, if I told you that one in every two Ferrari F-40's explode for no reason, but only 1 in every 1000 Honda Civics explode for no reason, which explosions are going to be more noticed?Obviously Honda, as there are more of them on the road... so...

    Linux may or may not be as bad for security, but when Windows gets exploited, it's felt... and it's felt HUGE!
    • Re:Numbers! (Score:5, Funny)

      by Brento (26177) * <brentoNO@SPAMbrentozar.com> on Monday August 25, 2003 @05:27PM (#6788575) Homepage
      Hey, if I told you that one in every two Ferrari F-40's explode for no reason, but only 1 in every 1000 Honda Civics explode for no reason, which explosions are going to be more noticed?

      The Ferraris, because nobody important drives a Civic.

      Knock off balding middle-aged, filthy rich tycoon, and that'll get more press than offing a bunch of morons who put rear spoilers on front-wheel-drive cars.

      But I digress...
  • Linux worms (Score:3, Interesting)

    by ZorbaTHut (126196) on Monday August 25, 2003 @05:26PM (#6788560) Homepage
    I've actually gotten irritated enough with "Linux is more secure than anything!" zealots that I've considered writing a Linux worm. I seriously doubt it would be hard. Go find some old security advisories for Apache, SSL, and anything else you want. Hook together a Linux-killer worm that tries all of the exploits, installs a rootkit on the compromised system, and sets that one up to probe. If you wanted to be really evil, you could code it to start doing subtle damage after a week - wiping random passwords, deleting random files in user's directories, and so forth. After a few months it could start causing kernel panics if you wanted.

    Would it work? Of course it would work. For all the "Linux is secure!" talk going on, what they really mean is "Linux is secure if it's patched up to the most recent versions" (curiously enough, this is the same as Windows). I'll bet you cold hard cash that there are plenty of old unmodified Redhat 5.0 systems out there. How many root exploits have been found in the last few years? How many holes have there been in Apache, SSL, Samba, any other program that's installed by default?

    Nobody's done it yet - but that doesn't mean it's not possible.

    The only reason I haven't written the worm is because, in the end, I'd cause a whole lot of financial problems and headaches for a lot of people who didn't deserve it. I'd love to prove Linux doesn't have intrinsic perfect security, but I don't want to actually do damage to prove it.

    But just wait - someone's going to do this someday. In fact, for all you know, somebody already *has* - they've just programmed it to be unbelievably stealthy and only target systems that the admin hasn't logged onto in months.

    Go on - prove it's impossible. I dare you.
  • Linux Security (Score:5, Insightful)

    by FsG (648587) on Monday August 25, 2003 @05:26PM (#6788566)
    Linux isn't secure; it's securable, and if you simply throw a default RedHat install onto the web, then you're missing the whole point and effectively negating all of the security potential that Linux has to offer.

    Both Linux and Windows must first be properly patched and locked down; the differences between the two are:
    1. Linux's security model, when properly used, makes it harder for an intruder to go from "foot in the door" to "root access."
    2. In the case of Linux, you won't have a whole new set of remote root exploits that need patching 6 hours later.

  • by miketang16 (585602) on Monday August 25, 2003 @05:28PM (#6788589) Journal
    Personally, I think Linux will always be more secure as long as Windows doesn't implement users and groups correctly. In XP, the default login is Administrator, which allows for access to EVERY single file on the system. The installation doesn't tell you this either, it just uses it if you setup only one account. With Linux, even if someone were to break your user password, or exploit their way into a user account, they can't do nearly as much damage as in Windows. Of course if they get the root password, you're just as screwed, but at least there's a barrier of protection between levels.
  • by nuintari (47926) on Monday August 25, 2003 @05:29PM (#6788595) Homepage
    Linux itself, and any OS can be very secure, in the hands of a competant admin. Its when you get a moron in command that the integrity of the system goes down the pooper. Even OpenBSD can get owned if a moron is running the show.

    And remember: Website defacements are often a level above owning the actual server, PHP Nuke has an awful track record, with new holes found all the time, and other site management software is vulnerable as well. Crois site scriptingm, cgi exploits may allow a level fo access to a site, or even compromise a user level account, but in the hands of a skilled admin, this is nothing compared to a fully suvccessful root exploit, and can eb dealt with.

    And fo course, no matter how good you arem, if you allow remote root ssh conenctions, and your password is "demiguru" for every account you have anywhere, well then, your just a dumbass. Yeah Nick, I am talking about you.
  • I'd say yes (Score:4, Insightful)

    by FooBarWidget (556006) on Monday August 25, 2003 @05:30PM (#6788612)
    I say Linux is *overall* more secure than Windows. Not because of the of then number of exploits, but the *attitude*.

    Let's face it: nothing is 100% secure. As long as software is made by humans, there *will* be security vulnerabilities.
    So, what matters is how you deal with bugs and vulnerability. The open source community is much better at this than Microsoft. Security patches are often released in a few days *and* peer reviewed. Those patches break a lot less things than MS patches because they're peer reviewed.

    Also, no Linux email client supports automatic execution of executable code. This already eliminates most of the viruses today that are made by script kiddies. And you have to manually save the attachment to disk and add the execute bit. This is a lot of work for Joe Average.
    Of course it's still possible to get a virus, but the point is that the overall chance is lower.

    So yes, I'd say Linux and open source is overall more secure than Microsoft. Security is not measured by the number of exploits alone!
  • Law of averages (Score:5, Insightful)

    by Schnapple (262314) <tomkidd@viatexas.cPERIODom minus punct> on Monday August 25, 2003 @05:32PM (#6788628) Homepage
    Are there other reasons why the likelihood of a "Sobig" or an "ILUVYOU" would be lower for Linux than Windows?
    Because there's fewer of you (not myself a Linux user) and as a result the law of averages says it's less likely that it will happen. And let's be honest - smarter people run Linux. They're not smart because of Linux per se, but people who run Linux know what they're doing, usually. Lots of Windows users don't know what they're doing (think parents and grandparent types).

    But if Dell shipped 95% Red Hat boxen, you'd see a lot more Linux worms show up. Maybe not as many as Windows, but still...

    • by exp(pi*sqrt(163)) (613870) on Monday August 25, 2003 @06:21PM (#6789102) Journal
      Why do so many organisms reproduce sexually? They're shuffling their genes around meaning that each generation has variety. If a virus attacks chances are some members of any generation will have the genes required for surviving it. What is fatal is to have a monoculture. If the wrong virus hits everything is wiped out.

      Here's the important point: given any organism there's a virus that'll defeat it. So the strategy is to ensure that your offspring have variety.

      Unfortunately what we have in the computing world is something of a monoculture. Everyone (OK, I exaggerate, but only slightly) runs Windows and everyone is at risk from the same viruses. And when those viruses hit everyone is taken out.

      If people valued security, and chose an OS with a smaller user base as a strategy to deal with security, we'd have that variety and we'd all be much better off.

      It's funny. When A says "I use Linux and don't get any viruses" and B repsonds "that's because so few people use Linux" B is failing to see that that's actually a perfectly good reason to choose Linux.

  • by pavel_pod (626544) on Monday August 25, 2003 @05:33PM (#6788640)
    It really is the COMBINATION of factors:
    * number one reason is probably that most user desktops are windows;
    * an average linux user is a lot more technically savvy than an average windows user, and is much more likely to understand the importance of applying patches [my non-technically oriented friends ALWAYS IGNORE those "updates are ready for installation" messages];
    * as a lot of posters have mentioned, Linux systems can be made more secure (open source, security-minded design, ...) -- if you know how;
    * I'd guess people who create these things might use MS hatred as an excuse;
    * there is greater diversity among linux software, whereas most people use outlook/msie on windows; (maybe to a lesser extent,) same is true for OS versions; this makes it easier to target MS.
    * (Probably more that can be added here.)
  • by pere (23710) on Monday August 25, 2003 @05:38PM (#6788684)
    "I love you" and "soBig" both happened because too many people are using Windows, not because Windows in itself are insecure.

    Any homogenous system will always be voulnerable to these kind of attacks.

    The problem with any homogenous system (ecological, social or digital) - even if it might be very effective and streamlined when it works - when one of the units fails: all fails.

    The key to building resistant systems, is making them heterogenous. Nature has figured that out millions of years ago. The key to securing a species survival is variance.

    The same goes for computer systems. When 90 % of the computers are running Windows, Office, Outlook, viruses like ILoveYou and soBig have disastrous effects. (The fact that there are several versions of Windows, with different SPs installed, is making it a lot harder to write effective viruses).

    My biggest fear is that Microsoft will end up with a susbscription system, and automatical updates. This could lead to a totally homogenous computer park... it is bound to be disastrous..

  • by jd (1658) <{moc.oohay} {ta} {kapimi}> on Monday August 25, 2003 @05:40PM (#6788709) Homepage Journal
    ...unless IBM is willing to spend a great deal more than a few tens of thousands of dollars...


    The only way to know how many exploits and holes there are in Linux is to find them and fix them. (Fixing is important, as code changes at point X can impact the code at point Y. Thus, as one hole is closed, another could potentially be opened.)


    To do this with every single hole in every component in a standard Linux install - in short, to produce an A1-compliant desktop OS, with all the capabilities you'd typically want - would be a financial and logistical nightmare. I did a quick back-of-the-envelope calculation on what you'd need in manpower, just to keep up with the rapid development of the software.


    You're looking at a few million coders, and about the same number of Higher-Order Logic mathematicians. This translates to a cost of about a hundred billion dollars a year.


    Now, you can argue that this is to get an exact evaluation of Linux, and to produce a completely secure implementation. To get a rough estimate only (no actual improvements, just the figures), you are still probably looking at ten to a hundred times the amount IBM spent on their certification.


    Any estimates that anyone can reasonably afford are going to be impossibly inaccurate, and swayed by the mood of the day.

  • by kfg (145172) on Monday August 25, 2003 @05:42PM (#6788728)
    So the first step is to get used to that idea.

    Beyond that is an optimally configured Linux system more secure than an optimally secured Windows system?

    Yes, I think so, that's one of the reasons I use Linux. But let me ask you this, how many optimally configured systems do you think there really are? For that matter how sure are you that your system is optimally configured? If you have to spend even a couple seconds thinking about that question think about average bloke.

    There's a social flaw in the system as well, which thus effects all systems no matter what operating system they're running.

    To secure your home you call in an expert. A locksmith, perhaps an alarm systems expert as well. Virtually everybody does this. It's so ingrained that it's considered a no brainer. You'd have to be an idiot not to have proper locks on your doors and windows, right? If your security is ever breached ( say someone steals your keys) you can't get to the phone fast enough to have the locksmith come over and change all the locks.

    How often have you had a pro come over and check the "locks" on your OS? Do you even know anyone who can do this? Can you look one up in the Yellow Pages?

    Why not?

    If you are such an expert yourself how many systems have you, outside of your "job" bothered to secure for people? Are you too snippy and think that "lusers" just shouldn't be allowed to operate computers? Maybe you're a part of the problem. Help be the cure.

    I've just given you an entreprenurial niche on a silver platter. Why not take a nibble?

    KFG
  • by Above (100351) on Monday August 25, 2003 @05:51PM (#6788813)

    There are really two different problems when it comes to securing against worms and the like, and for the moment I think Linux (and any Unix) has an advantage in both areas, although it's probably not as big as many people think.

    First you have to look at what a rogue program can do once in the system. For this the entry vector is unimportant. With most Unix like systems the default is for the user to not have full privilages (eg, not be root), and thus the rogue program cannot make full use of the system. That doesn't mean it can't complete it's mission, but it does make several things much harder:

    • Hiding from the user / administrator. Almost all rogue programs try to hide. When a user only has disk permissions to their own area, and not to the entire machine there are fewer places to hide. Also due to differences in the system it's more routine for users and administrators to be presented with system data (eg, ps output) and it's easier for the administrator to collect data about programs running (ps, accounting, lsof, netstat). I know, you're going to say all that can be done on windows. The problem is windows goes to great pains to make the average user, and the average administrator not know that.
    • Automatic execution. To better hide rogue programs often don't want to run all the time. Again, by design most users can't edit startup files, or couldn't append a wrapper around a standard system program on a Unix like box. Indeed, many users have no programs installed in areas they can write to. Windows on the other hand allows users to add TSR's and edit all the applications, allowing a Rogue program to hide almost anywhere.
    • Built in defense mechanisms. Almost all Unix flavors come with some defense standard now. Mostly in the form of nightly scripts checking for SUID programs and the like. Some are more fancy, some less, but at least there is some attempt out of the box to notify the user / administrator of a problem.

    The main issue is, most of the operating system differences don't mean much, as it's the applications that are the holes. From the simple password in a URL, to a complex buffer overflow attack applications are very often the vector into the system. Here you have to separate the cultural differences from the application differences.

    Cultural: Many Unix users still used text based mail clients in xterms, and even when they don't the GUI's were designed to more closely mimic the behavior of those interfaces. Attachments are evil, when run are generally carefully handed to a program as data. In windows virtually all mail programs are graphical. Many users demand them to implement things like javascript that auto-execute, many of them will happily run a foreign attachment with little more coaxing than a mouse click. At the end of the day these differences require user education. That may be helped by a transparent OS, but it's still a user education difference.

    Application Differences: Windows (Microsoft) encourages developers to build tightly coupled applications. Look no further than OLE. That ability to embed excel in your word doc and have it just pop up over the UI requires a tightly coupled API for program to program interaction, generally exposing full interfaces. Rogue programs can exploit this, often not needing to know what application is in use, but rather just the API. Unix developers / enviornments generally encourage a loosely coupled behavior. Programs provide some command line / pipe oriented service and handle all their own details internally. You need only look as far as printing to see this quite well, as windows pushes driver bits into the application to change behavior, while unix makes it all happen with a "system()" command running a new program.

    At the end of the day, I believe the following statements are all true:

    • Windows is targeted because it is the dominate platform, and rogue programs generally want to have the highest chance of suc
  • Simple probability (Score:5, Informative)

    by noda132 (531521) on Monday August 25, 2003 @06:22PM (#6789119) Homepage

    There are some stats [netcraft.com] (look for the pretty pie charts) which can help explain the percentage, along with a few key thoughts and speculations:

    • Most web sites run Linux.
    • Linux boxes cause so little fuss it's easy to forget they're there (for better or for worse, most distributions, especially older ones, are very content to leave you alone). I've never run across a Windows server that didn't ask for personal attention at least once every hundred days.
    • Website defacement is often a direct act, not a simple script which happens to take down a site. All operating systems being equal, a cracker would pick sites at random and crack them; Linux would get cracked more than any operating system, assuming the cracker is great.
    • In any operating system, the security is only as tight as the administrator makes it. Well-secured servers are VERY hard to come by.
    • A website defacement is not a remote root. It could be a simple cross-site scripting bug in some CGI/PHP/Perl code, which is not the fault of the operating system.
  • Worm potential (Score:4, Informative)

    by MeanMF (631837) * on Monday August 25, 2003 @08:08PM (#6790009) Homepage
    Are there other reasons why the likelihood of a "Sobig" or an "ILUVYOU" would be lower for Linux than Windows?

    I think the biggest reason that something like Sobig is unlikely is that there are so few Linux machines on the Internet as compared to Windows machines, and since a majority of Linux installations are on servers an awful lot of them are behind firewalls. Worms like this spread by seeking out more systems to infect. If 95% of the systems are running Windows, a worm can spread a lot faster than if it is looking for a fraction of that other 5%. A similar worm on Linux would take a _lot_ longer to spread and would give us more time to react and put a stop to it.
  • Linux or Apache? (Score:5, Insightful)

    by AstroDrabb (534369) on Monday August 25, 2003 @08:47PM (#6790297)
    How can you make a statement on Linux security based on Apace? If Apache is hacked it has nothing to do with Linux. It is just an application that is completely unrelated to Linux. Saying Linux is insecure because of the last Apaceh/OpenSSL hole would be the same as saying FreeBSD or OpenBSD are insecure because someone broke in through Apache. Apache is a whole lot more secure then IIS, though it still had some problems. While it may make sense to complain about MS security problems because IIS is one of their products, it is silly to say Linux is insecure because of Apache. I do think security under Linux needs to constantly be watched, it is very easy to get a big head, become lazy and sloppy and get all kinds of holes. Thanks to efforts like SE Linux by the NSA, Linux will keep getting more and more secure.
  • No Contest (Score:5, Interesting)

    by gutbucket (658815) on Monday August 25, 2003 @09:16PM (#6790476)
    The only security parrallels between Windows and Linux is the susceptibility to lazy users. If you don't patch... you're dead in the water and you deserve it. Linux, windows, whatever.

    That's where the similarities end. Linux is inherently more organic, configurable, stable and open. Windows has an upper limit on the config bashing you can do and the efficacy of doing so.

    If I, with my Linux box have a vulnerabiltiy that that vendor, or code monkey who wrote the thing, doesn't have a patch for... not a problem. I can do any one of a thousand things to make my linux system either more secure or less susceptible including looking for alternative programs that do the same thing. From the kernel to userland... I have control. It's more work, perhaps, but so is police work.

    Windows. Please. I'm at their mercy. Their patches. Their schedule. Their patches to their patches. Bah!

    Look at it this way: Windows is a prefab house. It comes in one flavor. Once shape. and one color. It is architected (sic) in the hopes of being able to withstand a wide range of climates.

    Linux, or any of the unixen, can be a tent you use to climb Everest. Or a mansion in Palm Beach. Or a Hotel in Monaco. Or a skyscraper in NYC. Whatever you want. It's up to you and how hard you are willing to work.

  • by borgheron (172546) on Monday August 25, 2003 @11:53PM (#6791273) Homepage Journal
    To say otherwise would be a lie.

    Windows has a great deal of exposure. Therefore more people hack it. Windows also was not designed to be secure. This is apparent in some of the things you see in it every single day, like how a single Window's box handles multiple users (not cleanly in my opinion).

    GNU/Linux was designed to be secure, but doesn't have as much exposure although it is doubling pretty much every 12-18 months. If this moore's law like trend, let's call it Greg's Law ;), keeps up then I predict we will see more security vulnerabilities showing up in GNU/Linux as time progresses.

    The assertion that less worms implies more secure is a logical fallacy to begin with. If no one is writing worms for your OS (that is not to say no one is *using* it... lots of people are including myself) then any security issue you've got won't be apparent.

    GJC
  • by kris (824) <kris-slashdot@koehntopp.de> on Tuesday August 26, 2003 @01:39AM (#6791713) Homepage
    If you want to discuss the success probability of a worm, there are three aspects here which need coverage: First is the actual quality of the implementation of the operating system. Second is the concepts behind that implementation. Third is the density of the system population.

    The quality of the implementation in Linux is highly variable, depending on what part of the system you are looking. There are parts of Linux that are of an extremely high implementation quality such as the kernel, the Apache web server or other active and well researched projects. There are other parts of only medium quality such as for example the popular PHP language.

    And there is a lot of stuff that is of actually pretty low quality, badly researched and incredibly crappily written from a security point of view. Common PHP applications such as PHP Nuke, TikiWiki or other "CMS" style applications belong into that category. Getting web server privileges through one of these using a pathname exploit, badly written uploads or other commonly known classes of security problems is usually a piece of cake. From that you need to find a local root exploit to own the machine. That's a little harder to do than a simple web exploit, but also nowhere near impossible.

    Also, current PHP coding techniques do little to minimize the amount of such code being written and to encourage clean coding. Brings us directly to the concepts section: There is no equivalent of ASP.NET type infrastructure and tools in the PHP world. Window may have bugs, but in this particular instance they may be in an area where PHP for example has not even code to show...

    When you are discussing security concepts, Windows often is on par or even surpasses common Linux systems. Windows failure is too often in the area of implementation, or it fails to leverage and deploy the concepts it implements. That's why Windows passes US and European securty evaluations, but does not feel "more secure" in day to day use. For example, Windows had Access Control Lists as part of NTFS since the very first 3.0 days.

    Only with the advent of Windows 2000 Microsoft started shipping Windows with halfway decent defaults, though. Also, getting to see and check the ACLs of a directory hierarchy with onboard tools is laughably complicated to what Unix presents (namely, a moderately complex security system with ugo/rwx and ACLs tacked on for that special cases, and "ls -l" to mass check an entire directory with a single command).

    Windows also has superior concepts regarding impersonation (instead of SUID), RAID as part of the default operating system way before the actual Unices had it, a PKI and a directory service as part of the default operating system shipment (and code that actually uses that, by default, unlike Unix, where you have to jump though hoops to get your mail server, samba server, your different logins and your client applications to use such a service if you had one by default) and serveral other things that look nice in the book.

    Unfortunately, all of this is of little use against worm style attacks. Here the conceptually bad parts of Windows reign: Treating data as code and in some cases even automatically execute data that has been recognized as code (HTML mail with Javascript, Office macros, HTML with Javascript that is being executed when entering directories) is the major attack vector. Also, badly designed and protected desktop IPC, allowing for the shatter attack and other legacy sins make the Windows desktop a primary target for worms and viruses. None of the above security mechanisms help protecting against this style of attacks, which is why Windows looks good on paper, but not on your desktop.

    Also, unfortunately, the Windows population in your average company is dense enough and homogenous enough to allow for wildfire type effects when the attack is spreading over the network.

    Linux has similar vulnerabilities as Windows has, but we do not see them at the moment, because even if there were a worm that could uti
  • by Jeppe Salvesen (101622) on Tuesday August 26, 2003 @02:39AM (#6791884)
    Frankly, the fact that certain distros charge money for using their automatic update system shows that we've got a way to go! After all, when you put the stuff out there and continue to put it out there, you've got a responsiblity of making sure your software is not endangering the integrity of the internet.

    Here's a wishlist:
    1. Automated updates by default - the likelihood of a break-in is greater than breakage because of updates.
    2. Better firewall configuration tools. Maybe a standard interface for having servers request
    3. Better monitoring systems - not just as emails to root, but something better.

    And completely unrelated, making a secure-coding class mandatory wherever coding is taught.
  • UNIX virii/worms (Score:4, Interesting)

    by hackerm (148340) on Tuesday August 26, 2003 @03:01AM (#6791936)
    One comment you often hear from Linux/UNIX people is that their systems can't get infected because all code executes in userspace and cannot do any harm to the system. You can just kill the process/delete the file and all is good again. And if people execute unknown code as root, they have themselves to blame.

    But many UNIX worms/virii don't rely on code being executed as root. They spread using security holes such as buffer overflows, and doesn't need anyone to click on an attachment or execute an unknown binary.

    I don't have the links to back it up, but wasn't the first worm ever a UNIX worm, written by a kid whose father was in the security business and told him about security holes in UNIX systems?

    I don't think that the OS decides whether a system is secure or not. Sure, it is a factor, but sloppy administrators and developers are to blame as well.

Recent investments will yield a slight profit.

Working...