Slashdot Log In
Study Finds Windows More Secure Than Linux
Posted by
Zonk
on Thu Feb 17, 2005 12:05 PM
from the an-interesting-definition-of-secure dept.
from the an-interesting-definition-of-secure dept.
cfelde writes "A Windows Web server is more secure than a similarly set-up Linux server, according to a study presented yesterday by two Florida researchers." In addition to the Seattle Times article, there is also coverage on VNUnet. From the article: "The researchers, appearing at the RSA Conference of computer-security professionals, discussed the findings in an event, 'Security Showdown: Windows vs. Linux.' One of them, a Linux fan, runs an open-source server at home; the other is a Microsoft enthusiast. They wanted to cut through the near-religious arguments about which system is better from a security standpoint."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Another study (Score:5, Funny)
Knock Knock Joke (Score:5, Funny)
Who's there?
Knock Knock.
Who's there?
Knock Knock.
Who's there?
Knock Knock.
Who's there?
Knock Knock.
Who's there?
Knock Knock.
Who's there?
Knock Knock.
Who's there?
Phillip Glass
My 8 year old daughter, a great afficionado of knock knock jokes, didn't appreciate it.
Parent
Knocking music (Score:5, Funny)
Who's there?
Knock Knock.
Who's there?
nock Knock.K
Who's there?
ock Knock.Kn
Who's there?
ck Knock.Kno
Who's there?
kKnock. Knoc
Who's there?
Knock. Knock
Who's there?
Steve Reich
She probably wouldn't like that one any better.
Parent
Knock Knock Joke Revisted (Score:5, Funny)
Who's there?
Who's there?
Is anyone there?
Who's there?!
- John Cage
Is that too obscure?
Parent
Integrity? (Score:5, Informative)
Well, apparently this is the second time Microsoft has come out on top of a research project by Mr. Richard Ford [fit.edu].
http://www.virusbtn.com/magazine/articles/letters/ 2004/01_01.xml [virusbtn.com]
Apparently there was some question to the validity of an earlier project because it was sponsored by Microsoft.
However, I would like to note that both researchers seem very well educated, especially in computer security. And, additionally, they both note that a lot more could be done to lock down the Linux server.
A lot more could certainly be done... (Score:5, Insightful)
OpenBSD runs chroot() Apache. Does IIS have similar capability?
The chroot() patch was never taken up, but it would probably not be that difficult to install on Linux.
I would be disinclined to run any other way at this point.
Parent
Re:A lot more could certainly be done... (Score:5, Interesting)
Parent
Re:A lot more could certainly be done... (Score:5, Informative)
Of course, running anything chrooted usually requires making a list of subprocesses that the program calls, and linking them into the program's directory tree. You'd want to do this in this case, because web servers typically do invoke some subprocesses. Not always, of course; some web sites are completely static. In any case, this doesn't require any sort of patch; just a list of what files are needed in the chroot area.
So what's in the OpenBSD chroot patch? What sort of vulnerability existed without it?
Parent
Re:Integrity? (Score:5, Insightful)
Their criteria included the number of reported vulnerabilities and their severity, as well as the number of patches issued and days of risk -- the period from when a vulnerability is first reported to when a patch is issued.
I hoped for a deeper analysis, like the security model used or how it behaves in networks. But it just back to counting vulnerabilities.
--Nothing to see here, move on.
Parent
Re:Integrity? (Score:5, Insightful)
Another is that just counting vulnerabilities gives you a worst-case scenario. However, my practical experience suggests that if there aren't any script kiddie tools or viruses out there that take advantage of said vulnerability, your chances of getting compromised through it are exceedingly small.
I'd also like to see some weighting for the likelihood of an attack succeeding through a given vulnerability. I'm going to be a lot more scared of the exploit that works every time than I am the buffer-overflow that lets you run arbitrary code, but only works once in a blue moon.
Granted, these studies will never have that info; they aren't meant to mean anything, they are just mindcandy for the PHBs put together by industry pundits looking for a quick paycheck or some attention. If I were really looking for a security analysis or comparison that included an open source server that ran on x86 hardware, I would expect OpenBSD to be one of the operating systems tested.
Parent
Re:Integrity? (Score:5, Insightful)
Actually, this tells us most of what we need to know. If we want our system to be considered secure, the way to do it is: 1) Don't report vulnerabilities; 2) Don't issue security patches.
Linux pretty much has to lose a contest that is judged this way.
Parent
Re:Integrity? (Score:5, Insightful)
I challenge the assumption that Redhat vulnerabilities are equal to Microsoft vulnerabilities.
Given the history of malware, they clearly are not.
This study is nothing more than a more formalized version of a certain form of trolling once popular on COLA.
Parent
Re:Integrity? (Score:5, Insightful)
The correct answer is the one with the better administrator. You can have a Linux box locked down tight, and a Windows box wide open. You can also have the inverse. Probe around, and you will find boxes of all those flavors out there. It all depends on the competence of the guys running it. The competence of the administrator at running the system he is running has a much larger effect on overall security than which OS is chosen.
Parent
Re:More FUD (Score:5, Funny)
And, to the grandparent -- if you read your own link, the previous study was not sponsored by Microsoft.
Parent
The Real Truth... (Score:5, Insightful)
An OS is only as secure as it's admin is competent. This will NEVER change no matter what platform you are dealing with.
If you give some RedHat CDs to a complete goof off and have them install it on a system that is going to be directly exposed to the internet, that box is going to get rooted eventually. It might take longer to get rooted than a Windows box, but it will be cracked.
If you give Windows 2003 Server to a knowledgable admin, he will secure the box and make certain that the likelihood of it getting cracked is fairly low. He will know not to put the box on the internet until he's applied all SPs and critical updates. He will know to use an internal SUS or WUS to make sure that the box is updated without exposure to the internet.
If you give a complete moron who *thinks* he knows all about [insert platform] any installation media, you're going to have an insecure box.
It's been my experience that the best people to set up an internet exposed box using any OS are people who are most familiar with all OSes and have a good understanding of how to secure each one. It's not that hard to hit the main security points and still keep on top of all OSes. However, since egos aer so intrinsically tied to how secure a box is, people point the finger at the OS distributor. Sure, they are to blame in many cases, but the implementor is usually far more guilty of being lax. That's the hard truth and it cannot be refuted.
Parent
Re:The Real Truth... (Score:5, Insightful)
Windows isn't "just another OS"... it has the rather unique position of being on a substantial number of desktops in people's homes. In and of itself this is not a problem and requires no greater security, however, a significant percentage of _THOSE_ systems are also on the Internet. And of course, the problem is that most people are simply not qualified to do a respectable job of administering and securing their home computer. Which brings us to the point you mention. The security problem with Windows are primarily caused by the inescapable fact that most of its users *ARE* ignorant when it comes to security and the fact that MS chooses to continue to market its products at this demographic while at the same time ignoring security issues or sweeping them under the rug is why people may be inclined to blame the operating system or Microsoft for the problems.
Although, interesting enough, if Darwinism really works, Windows users may ultimately adapt to having to always struggle to keep their boxes secure, and perhaps even end up being better than most Unix gurus at home computer security. Time will tell.
Parent
Re:The Real Truth... (Score:5, Funny)
If anything, it works the opposite way, with people who don't care to get too deeply into computers and technical stuff having far more sex.
Parent
Re:The Real Truth... (Score:5, Insightful)
The primary questions include:
1) How *securable* is the OS?
2) How gracefully do services respond to failures?
Secondary questions (addressed in this study) include:
1) How secure is the OS *by default.*
2) What constitutes a typical setup?
Now, personally I don't care much about these secondary questions from a secure server perspective. Linux security is easier than Windows security, and Linux is more securable than Windows. A lot of this is because Windows depends on things like RPC which does not fail gracefully.
On the other hand, you can mitigate a lot of this risk by proper security practices. A skilled admin is going to be trying to balance usability and security and will do it well if given the approrpiate tools.
Again the quesition should be "how securable" rather than "how secure" for exactly the reason you mention.
Parent
Re:More FUD (Score:5, Insightful)
It is useful as an anecdotal example. Especially in the area of security, where real security tends to mean knowing a lot of very specific examples of how things can go wrong. Documenting how these guys could have inadvertently left holes open would be useful. Then we need several hundred more such paired tests, with a more extensive report listing all the ways that admins of both systems can get it wrong.
But concluding that, because two guys didn't get it right in a single test, therefore one of the systems is more or less secure than the other, shows little other than a total lack of understanding what security is all about.
That, or intentional FUD on the part of either or both.
I'd go with the lack of understanding. People are really good at generalizing from a single case with no statistical significance.
Parent
Re:More FUD (Score:5, Insightful)
That's a critical difference. So many people pour over the Apache source code that most vulnerabilities are discovered prior to when they actually become "in the wild" exploits. The same cannot be said about MS IIS. Worse, the odds are very good that many the IIS exploits were in the wild prior to when they were first publicly reported, while most of the Apache exploits were, in all likelihood, patched prior to the first exploit.
When viewed from that perspective, the Windows/IIS server was likely vulnerable to exploit for many, many more weeks than the Linux/Apache server. And that assumes that half the vulnerabilities are ever even reported. With a closed source product, there could be tons of security holes being subtly exploited by clever crackers every day and there would be no way to find out about it.
No, this article is pure and unadulterated FUD.
There are three kinds of lies: lies, damned lies, and statistics.
---Benjamin Disraeli
Parent
Re:More FUD (Score:5, Informative)
Having read TFA, the "study" consisted of counting security flaws for RH and Windows, and comparing how long it took to issue patches -- from the date of the vulnerability being announced. This is really shallow; we've seen lots of such studies and laughed at them. I note the spin put on this is "One of them, a Linux fan, runs an open-source server at home..." which makes it look like a Linux zealot has been hacked in his own home, while the happy Windows guy is unscathed. In fact, it was all hypothetical, there were no trials of real servers (none mentioned anyway), just "potential" vulnerabilities in default setups.
Parent
Once again, RTFA! (Score:5, Insightful)
From TFA:That sounds good. A real comparision of real services running on real servers.
But wait!They aren't real setups.
And it gets worse.Hmmmm, I wonder if they included the info from www.eeye.com http://www.eeye.com/html/research/advisories/AD20
So, a "study" that doesn't test any real world criteria is somehow valid?
Oh, it's not that the study is not valid, it's that pointing out the flaws in the study shows the groupthink on
And pointing out that perceived groupthink gets you mod'ed up as "insightful".
Parent
Re:More FUD (Score:5, Insightful)
Also, many OSS exploits are theoretical in nature... if a strcpy() passes an unchecked ptr and some coder sees this... whether or not that code could have been exploited... he fixes it and out goes the patch. Its a patch for something that may have never been even able to be taken advantage of. That would never happen in a commercial project. All this study shows is that these researchers define security as the ability to hide security problems as long as possible until a patch is ready and if the patch never gets ready, just never tell anyone about the problem. Following the two above stated rules would easily make any software company "secure" by their standards. As stated previously, their criteria was # of patches and time to release. Time to release is shortened by waiting until the patch is ready (which Microsoft does) and # of patches is shortened by simply not releasing non-major patches and just rolling them out with the next version. The criteria these guys used was meaningless and if anything shows that linux is doing something right if they are updating several times more programs with only twice the delay (which i really doubt is the true delay time). One other thing worth noting, the Ford guy has been paid by Microsoft several times to do studies and release them in favor of MS, I'd hardly call him a true linux fan. Maybe this time they just covered it up better... you wouldn't want to bite the hand that feeds you.
Regards,
Steve
Parent
These studies are pointless. Both can be secure (Score:5, Insightful)
A webserver needs port 80 and maybe 443 open. Any webserver can be secured.
Where's the news?
Re:These studies are pointless. Both can be secure (Score:5, Informative)
Parent
Newsflash... ONE Linux Fan.. (Score:5, Insightful)
A Linux enthusiast at the RSA Conference in San Francisco has reluctantly concluded that Microsoft produces more secure code than its open source rivals.
In an academic study due to be released next month Dr Richard Ford, from the Florida Institute of Technology, and Dr Herbert Thompson, from application security firm Security Innovation, analysed vulnerabilities and patching and were forced to conclude that Windows Server 2003 is more secure than Red Hat Linux.
Now, I'll concede that Dr. Ford and Dr. Thompson do sound reputable, but one is an admitted Windows enthusiast and while the other one is a Linux fan who changed his minds, this hardly sounds like a study
It's an interesting question, and I'm sure there is no clear cut answer, but a more systematic study (with more parties, rather than just two scientists) is going to be needed to answer this sort of question before the 'results' are trumpetted. I'm sure Microsoft will pick this one up and run with it, however.. more of those annoying ads that seem peppered throughout Slashdot.
Not only that, but I find this quote odd.. (Score:5, Insightful)
Umm, so MS showed him their source code? I find that a little hard to believe.
If he can't see the source, how can he make any determination at all?
Parent
Re:Newsflash... ONE Linux Fan.. (Score:5, Insightful)
I'm getting a little disturbed at the way all pro-Linux studies are being accepted and all other studies are being dismissed here. Critical thinking should always be welcome. And, yes, Linux is NOT perfect, it is NOT flawless, and it IS full of security holes like anything else. Nobody should take their operating systems so personally that they feel attacked when Linux is criticized.
Note that this doesn't go for everybody. But there are a lot of zealots in the community who need to learn to see outside their own perspective.
Parent
Linux thrives on criticism (Score:5, Insightful)
Linux is awesome, this study doesn't change that but we always need to work to make it better and easier to secure. Critics of Linux are our best friends, because they do the work of finding out where we need to improve for free.
The best thing about linux is that when people have a legitimate complaint, it's well within our power to fix it! If Linux is temporarily less secure, so what? After reading this, everyone will adapt their linux distros to render the complaints moot.
This is part of why we love open source, right?
Parent
Also I think the point here was particularly good (Score:5, Insightful)
It's not all that useful to research how tight a competent admin can lock down a box because the answer for almost any OS is "very well". You get a good admin that knows their OS and is on top of things, they can keep anything secure, even Windows. So it's not of much use to say a compentent Linux admin can make a secure system, we already knew that.
It is useful, however, to know that a less competent admin will have trouble. More useful would be to know what specificly need to be done to fix it, but just knowing that it's a problem is a start. If Linux continues to gain in popularity, more people that are not as competent will be running it. While you can never truly protect someone from themselves, there are things you can do to make things more secure for those that don't know what they are doing, and that's a good thing for Linux developers to be looking in to.
Parent
Re:Newsflash... ONE Linux Fan.. (Score:5, Informative)
Um, no. Your average system administrator earns about $62k has at least 2 years experience, and generally a bachelors degree in a related field. At least according to most industry figures. [salary.com]
The job title also entails tweaking system configurations for security, evaluating patches, etc. etc.
Parent
Not again... (Score:5, Insightful)
So Windows is more secure than Red Hat because Microsoft chooses to report less vulnerabilities and release less patches? Hmmm...
(Move along, nothing new to see here.)
Non Story (Score:5, Insightful)
The security of a server... (Score:5, Insightful)
Now let the flaming begin, so you can all argue about the number of patches/updates required for each system, how long it takes for Linux/Windows to respond to problems, and all that good stuff. We all know that's the only reason this kind of story shows up on Slashdot is to start a good flame/troll war!
Self-Evident (Score:5, Insightful)
I'm no zealot (Score:5, Insightful)
No matter how fast a patch is issued, you still have to install it for it to work.
Delay in announcing MS vulnerabilities? (Score:5, Insightful)
Enthusiast?! (Score:5, Funny)
Hardly a study (Score:5, Insightful)
Sorry, but this "study" is not a study.
Why was this even posted?
RTFA then talk (Score:5, Funny)
"Believe it or not, a Windows Web server is more secure than a [i]similarly set-up[/i] Linux server, according to a study presented yesterday by two Florida researchers."
So when you load a linux server with software that has known security holes....they are both equally as secure.
It's not groundbreaking news.
"Days of Risk" vs. Full Disclosure (Score:5, Insightful)
Secondly, there's no discussion of how the criticality of a vulnerability was weighed. If every "day of risk" for Windows was "critical," and every "day of risk" for RedHat was "moderate," then I'd differ with their conclusions. Further, there was no mention of whether they considered actual exploits in the wild.
Also in the news... (Score:5, Funny)
Horribly flawed (Score:5, Insightful)
Are they joking? Their metric (reported vulnerabilities) is absurd for a number of reasons.
1) Microsoft reports only a fraction of its vulnerabilities. Remember when Win2000 had over 65000 known (to Microsoft) flaws? No more than a handful were ever reported. Microsoft reports flaws only after bearing enormous public humiliation. Of course Microsoft's flaw count is going to be low. Microsoft hides them all until forced to disclose.
2) Linux vendors report every hair out of place. It doesn't matter if the flaw causes a D to look like an O on the third day of the Summer Solstice, but only if that day matches the 4th digit of PI, and only if the computer has calculated the cure for cancer at exactly 15 milliseconds after the user's orgasm.
3) Seriousness of vulnerabilities. Due to the nature of full disclosure under Linux, it will -always- have higher reported flaw counts than Windows. The vast majority of reported Linux flaws, however, are relatively benign, while the vast majority of reported Windows flaws hand over complete control of your computer to some third party.
4) Widespread Propagation. Windows, by its intended design, makes propagating exploits to these vulnerabilities trivially easy (automatic, actually), while this has yet to be accomplished on Linux (and likely won't be).
Sorry, but this "study" is complete nonsense.
Quality Research (Score:5, Insightful)
If you lean WAAAY over to the left... (Score:5, Insightful)
The researchers used reported vulnerabilites as their guideline, and 'days of risk;' quote: "the period from when a vulnerability is first reported to when a patch is issued."
Windows Server 2003 had 30 days of risk, Linux (Red Hat Enterprise Server 3) 71 days.
But which reports of vulns are they considering? Microsoft often provides their own reports, which are released WITH THE PATCH. I wouldn't give those reports the same weight, since the vuln could have been there (and unofficially known) for MONTHS.
I fully expect Linux to have MORE vulns in any case, since Linux ultimately is a collection of separate programs working together, each of which has their own potential insecurities. But, a vuln in sendmail is NOT going to affect my webserver, because I'm going to turn that OFF (if I'm a smart admin).
In fact, the researchers only used a "hypothetical" system to show "what an average system administrator may do." I'm sorry, but if an admin is using anything like a default setup he is BELOW average.
In conclusion, this really sounds like a comparison of how vulnerable the respective systems with a 'default' install. Wake me up when they go head-to-head with OpenBSD.
P.S. Hey researchers- RED HAT IS NOT LINUX.
My God They're Right!!!! (Score:5, Funny)
and run to the store and buy me Server 2003(TCO $599-$3522 + Licencing).
Definitly not going for RHEL(TCO $349-$2499 + Licencing) because no matter how hard I try, I could never get as secure with up2date, SELinux, Pax and Firefox as I could be with Windows Update, Third party antivirus, Windows Firewall and Security Center. NEVER!
And I shouldn't even be comparing Fedora to Server 2003 because Fedora could never be used as a server of any kind. Neither could Slackware(TCO $0.00), Suse(TCO ~$100.00), Mandrake(TCO ~$100.00), Debian(TC0 $0.00) or any other of those insecure Linux distros! They're not SOLD as servers so they absolutely cannot be compared to server 2003. No way, never, uh-uh.
Wow! This study has really opened my eyes to the lie. Why did I abandon my XP installation(TCO $200.00) after only a few dozen major worm outbreaks? I could have done anything on XP that I can do in Linux. It would only have cost be a few thousand dollars, but I could have!
These researchers have really opened my eyes to the lies. I believe everything they say, even without the data to prove it they.....
Ok here my sarcasm must crack under the sheer enormity of the following statement.
The pair said that they lacked the funding to test other operating systems, such as the Apple OSX kernel(TCO $100.00), although they thought it was "amazingly" stable.
WTF!? Are these guys for real? Is this study just a troll? I mean... WTF!!?
I will however take a wild guess that their next server security study will have OpenBSD mysteriously absent.
FUD and a Never-Will-Be-True Assertion (Score:5, Insightful)
But, RH isn't Linux. Linux is many distributions, some good, some not so good, but if you take the pool of Linux administrators against the pool of Windows administrators, you'll find Linux administrators are more knowledgeable about their systems and do smarter things in securing them. This isn't as true as it was a few years ago before the reluctant Windows administrative masses took refuge in RedHat, but you won't see _any_, not even one Linux defector to Windows. Perhaps BSD, but definitely _not_ Windows!
I've never seen one of my Slackware servers (running sendmail, _even_ and FrontPage extensions with PHP on the Apache server) compromised. It's never happened in the 10 years I've been using them.
I've been wasting a lot of time lately poring through logs for a new project and it's ludicrous how much additional coding I've had to put into my Perl scripts to make allowances for compromised Windows boxes that have inundated my web server with traffic during their Code Red and Slammer compromises, not to mention all the other little oddities Windows clients do when downloading mp3s from the server, such as client caching and sending 32k+ search strings in the URL. It creates work to have these obnoxiously configured client machines on the Internet.
I'm not going to complain too loudly since without all these Windows users on the Internet surfing my site, there wouldn't be much of interest to process in these logs, but to assert Windows as more secure than Linux?! Really....
Could someone please post the name of which Micro$oft C?O's budget backed this study, so we can move on to a more interesting and valid discussion?
Bruce Schneier on Linux security (Score:5, Informative)
Bruce Schneier [schneier.com]
Posted on January 06, 2005 at 01:45 PM
------------
Different methodology, different results. My money's on Schneier.
Biased? (Score:5, Insightful)
As someone said, "extraordinary claims demand extraordinary evidence". In a lot of peoples' opinion, the claim that Windows is more secure than Linux is just that, an extraordinary claim.
How would the authors of their study reconcile it with something like this one [theregister.co.uk], which showed that a default installation of Windows got infected with a virus within 20 minutes?
Re:From the website of the sponsor (Score:5, Funny)
Whew. For a second there, I was worried I'd have to get out the mat.
Parent